Analysis
-
max time kernel
133s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 23:31
General
-
Target
bdbe915e3b57f025f109f99463c4459773e2573a76e9a55e92142a930d6da99b.xlsm
-
Size
20KB
-
MD5
eb6e240307081ed655ac931e76510fd1
-
SHA1
2855d8a522e16facdf958f3c89bec78e4c743ac7
-
SHA256
bdbe915e3b57f025f109f99463c4459773e2573a76e9a55e92142a930d6da99b
-
SHA512
72361d8bca6c3e60ad709eb69b921606f987441e951ad86d9c2009d861b0240aff2be86fae0d7903bd6b366efc6a0ef136a563f21e2347572a480dccbbcc35bb
-
SSDEEP
384:2KAVb1GNjYTo4CGzPd6ZIwL0AOKb5CzgObff9kC+xbX7jvIv:2KYINmo4FLyCBn9kC+xbLA
Malware Config
Extracted
https://www.manchesterslt.co.uk/a-to-z-of-slt/9wq2ESVcG/
http://festival.artdialog.ch/contact/RGhcwH4DRBM/
http://bramynapilota.com.pl/wp-admin/NHk/
http://brwconsultoria.com.br/img/Vl0i9o/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\bdbe915e3b57f025f109f99463c4459773e2573a76e9a55e92142a930d6da99b.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51d6a4e97312fdf8ec2bd2751f4f3bb6b
SHA16edcf6915045068cd16c6ef89c3a072ae931ff5d
SHA2561dffdef853d25184b5c61f0fc129f543fdba0170bb202bc5670de9a45dce5e42
SHA5120a5e3588803099fc0797a7633d7f9ba964a75d945fdb4a549146303d18fb93568d70614e1d158b7a7aa001a9247841d940405f5c34f608c4f46c290aab5f6629
-
Filesize
1KB
MD51326c16a18441423830933fbb3a6a290
SHA1d62b5f0ec9ae7a82209938c347311519b9fc1084
SHA2563bb40456027c77d05b991e4686f10e51739a6ebdca3e33ec5edcd1e2c28b34cf
SHA5122b9076d43ccc836c89bcd4cc1946008b1d0268edf432d37659960f4ffb9836ca65e638b61305f374ba71b2fa21ac3210482c0e6287288e75bcd44d4fbeb3e528
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB