Analysis
-
max time kernel
133s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 23:25
General
-
Target
8c4be26253c93a92b09900ec8f68078b348577c8e5935f8f2876893c9fce8ba3.xlsm
-
Size
40KB
-
MD5
c1d253d1616888de115960eaff508ae7
-
SHA1
bc551f19b72d46c2d7db519ac87f2169a25cce2c
-
SHA256
8c4be26253c93a92b09900ec8f68078b348577c8e5935f8f2876893c9fce8ba3
-
SHA512
1c6c16f7c6d69805f348764e0a47c9565d71bb1160ef2825ea5745158f1883c6f11ba3df634e2afc376b1b4854ece1a40ddfc344f6164f11085e28b314d67056
-
SSDEEP
768:+/omdH+DOevZCwttqyKfcrND59V+L9Rw4eWrXcTqZ0VP2HLp:ComdH+DoylND59V4jwmXc2CVCF
Malware Config
Extracted
http://vipteck.com/wp-content/M/
https://shofarshoshanna.com/t0ssm/roE/
https://santacruzam.com/wp-admin/FeDgNEP/
https://thearkrealmproject.com/wp-admin/wxB4Wp3KyEMCsZva/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8c4be26253c93a92b09900ec8f68078b348577c8e5935f8f2876893c9fce8ba3.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5760e93bea9b367ea4982c1e81ae086ce
SHA1b1b62a6f69c05c5bcf59d90928224665db62460d
SHA2569c107526de512e849e908488cb99130ee50d213ee0162744edc6c75bcb5c0d1c
SHA512822a244c0e714e8db03eea71fca87bbdb76d03fad38e43fc8c0a9c0710c407ba981a4875c2feb60df16b3e193ca111240b43ff6cb65ef7bfdf41d6fc13afa43e
-
Filesize
112KB
MD5a791e6f4467e01881d73d419197cbe39
SHA1bba2dbc4c26f5e698c3c118600719c190fbeebf2
SHA2561a6babce9a2061f42692c4d4fdc5c04d05fa0ec717cd0a7be55f76342b0a2698
SHA512d4159c2a6609c58c3cb214cf4ec6729461a82a9cb27eea3ba471d5903481f9622a628b626bece37c24a1e9d59d1c8119f600de6df6f64e373a2864954d12198b
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB