Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 23:37
General
-
Target
c6b4359bfbd23a16b78aba27cd2d548eddf616e8b96448fe19bef1a4f26ac114.xlsm
-
Size
20KB
-
MD5
0ab4b87f8d8596a9e1da207eaf361e5f
-
SHA1
f3b38034e64ad5bf9473fda971a6bd4ce2ced1ba
-
SHA256
c6b4359bfbd23a16b78aba27cd2d548eddf616e8b96448fe19bef1a4f26ac114
-
SHA512
08b0d5878971289e7995d66dfca5c9a1ec636a19bb856ff11b1ad80e60c957a585bf6f71550047158d3fea5565e7e6480f36661c4d1003b35b048d931ca83107
-
SSDEEP
384:15Jm7qVb1GNjyo4CGzPd6ZIwBKb5CzgObff9kC+xbX7Qi9rc5:15J7IN+o4FLNCBn9kC+xbLQf
Malware Config
Extracted
https://benconry.com/wp-includes/eUXuRrm1G6bRZ/
http://actividades.laforetlanguages.com/wp-admin/PXMxDnqZrr/
http://atbiotique.com/images/ESistuSH6DbQFkxTz/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\c6b4359bfbd23a16b78aba27cd2d548eddf616e8b96448fe19bef1a4f26ac114.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD55fb35c280e72d6d742e7447f8231c77a
SHA1a92414c82e302a8d7fd5428e17180b989b2d0faf
SHA2565b0783bb9301c588c3fd3adbb004df51fce426b726cf12ece98a2e1672c73f5a
SHA5129a8aff8f78bf41b68b797e0d73349556759688fa92bf1d77334ced5a006e21d2562aa16b0f5f40d5d074682ea08e4de6851f58fcb36c7f787dc1e6a5212eb4f9
-
Filesize
6KB
MD5c16ce81d99df3f8fcc14dee6884354cf
SHA17cbafe67db47973d52415430fcf7da87c0a6e9bf
SHA25646edae29f49b47f8cd66b3ac609ad698a9a832c83710d2c536d0e63efe292770
SHA512d8a7be3fff25e30f2c7362980b8018fdbaf87995918988a5ececd34fb2cd07580ce6c3318d8ac339483888796b721e2948b3937b712d11143221d76cd8cf6fc1
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB