Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 03:25
General
-
Target
ee52449c51d541faabb9dde1e83dcd28cfd5e272b247059ed75e54b58ddef109.xlsm
-
Size
49KB
-
MD5
0d3955763848d32fd66194164e48a457
-
SHA1
0f4f03c6cf1f0fc8235720ede6464b4b40b357ae
-
SHA256
ee52449c51d541faabb9dde1e83dcd28cfd5e272b247059ed75e54b58ddef109
-
SHA512
c353d623288a0e9944a77fa625e0e79a264dcbb09cbbc72d6bdac817b324c41d84c01924dba53486da0aea091a57514bfad34aa9133069d11c23f4924df7272d
-
SSDEEP
768:2YCKEWvxLh0lSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KA05lAMIB:2Yu2xXncDSmSIBlGeuSEcm2h0B5lqB
Malware Config
Extracted
http://retailhpsinterview.com/search/yNbsL/
http://www.agretto.com/Template/pnM0iPs4b2IfR7XY7v/
http://www.agnesleung.com/raw.backup/p8D6ttXDaNwd/
http://xnxx.c1.biz/images/iJNVpahOW4CBuidDD66/
https://pakistannakliye.com/Dodonian/tSasxFCiQXxh5Qvin/
https://gsmjordan.com/SupplierPanel/XII/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ee52449c51d541faabb9dde1e83dcd28cfd5e272b247059ed75e54b58ddef109.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\ax.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ed318a8e30c87609422bb86b7cdb4bc5
SHA1178bc589a315509a74632e594e399dab038bbe20
SHA256ec1f45039afaeb1708d3805ff01304e2d480c25fa2d6f9be8f27846c4276a116
SHA5120520d356d104ad305cb3c002d20e298dc98c71db08db7a98e43f52a9f595aaab387fc17a9fb1a42a8c158fa38af38c2fa6fb56c815f87601018d0f07af39b037
-
Filesize
802B
MD5583cb8cac58c7c55c1e250f9ab286d52
SHA15e91029ac4c1f7ab7fc5a8a00b14c30f785ee562
SHA256e2d4d6591f4ceeb810f8fcff3b4bf2a39470b8d079dda76089c1f369e877f0f4
SHA512dfae2abca729ab8d4f3162dcd96c611cdcc2d41f07370cb21964f2e360f929eebaf21919d582e590076d9dfa8eb59e70dddd7781ebc681814d66757b072f008e
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB