Analysis
-
max time kernel
133s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 02:38
General
-
Target
38146988dfbe9a3bb01e8cfb05a655a78f253e82b669dce4f614d1ee4ddff66e.xlsm
-
Size
46KB
-
MD5
1cc77da245baf5f04aab46997376d4a8
-
SHA1
e2c11a46f06811a395d64df52259f06f142a1929
-
SHA256
38146988dfbe9a3bb01e8cfb05a655a78f253e82b669dce4f614d1ee4ddff66e
-
SHA512
a2740795415904be9071b013df3db9aa28b9cbd905dbaf600308368aad17d03c03bd6254bbfcf8c73ba4641d10c44310ca72938f170aa11d432f0bfe397884f8
-
SSDEEP
768:cwLvfWDOevZCwrvtrDPzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VfskoM:1WDzftT5fTR4Lh1NisFYBc3cr+UqVfD9
Malware Config
Extracted
http://congresoapp2021.com/u07di/wkdehSgS/
http://forocavialpa.com/wp-admin/bnFI6WhjZkffrb/
http://s1.techopesolutions.com/semicanal/g7jRfFqphhUQ5oh/
http://tournhatrang.asia/cgi-bin/2gnqrN/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\38146988dfbe9a3bb01e8cfb05a655a78f253e82b669dce4f614d1ee4ddff66e.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe /s ..\cre.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cd5974e2835146e28d70317517f25db0
SHA178793d91c018f192da9b19b849a326fda0b94f50
SHA2568739c9ac3350c882f0e83ca51697d3f9f0267660662c630a76c31ed3e484f620
SHA512f2c72bec10d1853efd402faf565326b0b4b36be47b3fc98b29b9433e052973a376a0cde0d22f56ad4b6b74d13fde0522387f72036fbda3ab084ba54a3a48f51a
-
Filesize
1KB
MD5df2f87703fd9e9a7ce0603aa604bd3a1
SHA1705e3ee1119cd48f9d98a53968a376a18b602079
SHA256b41754336a2818c6a8854a09eb9cf5989b0d1dae87aab426a04b47bf02ccd596
SHA512654e1bb9f35ec8f1f78455b8c3a4ea1905f8cee7926d07833f06d92122d9646c8d9068b6f47c5e6734994a791c04fc021d92bcd7ddd01b7bccd3e31b1a922240
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB