Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 03:22
General
-
Target
9116730ccc91476ed10f874ad69397ccf7e890a95be035bf4ae16735a7170845.xlsm
-
Size
32KB
-
MD5
4c301bcf342d05d3694b76a053e05b1e
-
SHA1
365da880c78ad6b5898a2308e4a5cc329c55b1c4
-
SHA256
9116730ccc91476ed10f874ad69397ccf7e890a95be035bf4ae16735a7170845
-
SHA512
f37dd5ff00e5ae6484e36dfb9db7e7d5d078cecd5f7f8d0326707e561fc71166fbd1e64748686ea1f5b9b53a0a026cec2e6407ea44d32c7cd22d34a818936b92
-
SSDEEP
768:cjFH4QqFhN+DizXT2RdFfPdkqstJkjE6oB:2S7TkgXendkqJE62
Malware Config
Extracted
https://www.aulavirtualapecc.com/server/qramDt1UIotz/
https://ingelse.net/Overview/slWIUhVtK/
http://calzadoyuyin.com/cgj-bin/uzOOL/
https://wimmergroup.com/home_tours/Pvnw2/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9116730ccc91476ed10f874ad69397ccf7e890a95be035bf4ae16735a7170845.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bef5a61caa6ec04b4a9934ac7e7d64a6
SHA102f1309267d0b73e6883cc05c112c186a1354b97
SHA256efea8f94f6d7d6da1f27c071a48d8086648d09505981fac711f8af3489be0535
SHA5124c13ac6ea6c5c6f344e146f1d419215774a69436a1adc4a00d9107ee8ad42bca74c26cde398d40042b228e6c57a00c33a7425d83717e7be1509e69a167c89ab9
-
Filesize
633B
MD597ccb5bdd2cc1a56913714b542766adc
SHA11e6e7a902fa43241690deff9d3ae3dc4486bfdcb
SHA2569ff9b6c1f9556c61456fc36b30b65db26167c962b595c305fd185048b769de35
SHA512092be4b51af9c073a77526eb0d14e73a109aff14296e371d1558a661c505c11ca6d81855d910435b619233714f69928240b744a384f83891a1a4aa86483efcbc
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB