Analysis
-
max time kernel
133s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 22:57
General
-
Target
374f364d444f1be80ef14826d16c8850bb4f4aa87f1a329bed932f4ae5432618.xls
-
Size
101KB
-
MD5
4704b2d76974e75799b325aec09ac2c1
-
SHA1
234d7550b75af09d8481b0cd5453755313f5c7b7
-
SHA256
374f364d444f1be80ef14826d16c8850bb4f4aa87f1a329bed932f4ae5432618
-
SHA512
feb072c0e5f21994dd9f9dd5d793793ab39423484b72aa684cc2edae39ef49fcb0adb1d4ea5a3edd0d9166ceddcf8e773907d488e079c94599fe416f0c413480
-
SSDEEP
3072:+Kpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+MbOBzbq0f6RlD9fxW8s8OA:+Kpb8rGYrMPe3q7Q0XV5xtuE8vG8UM+U
Malware Config
Extracted
http://dlfreight.com/wp-includes/zLuZdtVkoriGTaRE/
http://hadramout21.com/jetpack-temp/KjOqTnCwBbVrz8w/
http://groupesther.com/wp-admin/2hhcMwfOG0aRi1t/
http://datainline.com/aspnet_client/56LwAJvy/
http://greycoconut.com/edm/0ywf2bF/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\374f364d444f1be80ef14826d16c8850bb4f4aa87f1a329bed932f4ae5432618.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\txdn.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d1614b90ebd1ce47897b348677c2641d
SHA18b01576224053d3de8035a6c605c0457b109b487
SHA256d2ce62855c4606683e121430323511837ee8422272249b89b0ba73e7278924f1
SHA5129033da807ed1d13e53d4a5fe5364ab657ee8a20d814aa5ad3ff567acfcf0f72e4df5e3126adc49ccca38150e728c0b5e9df31f846b0d41c550d6e15a71a4af38
-
Filesize
36KB
MD53b79e62476916ff33ddc0668a0898e6d
SHA1fe4f73a8019a0407cec5e2eb0c344adc4ab73bae
SHA256418099d0e61f486fc52144bd0b16c8833b893eb9203163835c59045ca9782b81
SHA5123b42ec3d6c8d68824e43ea8bd0b62c4434fd995f8dc93c3a278e229168b080c5920b226c02236bd98cd7ddadab19536dd05a4e4f35323393ac9ef766b0759bfa
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB