Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/11/2024, 03:50
Behavioral task
behavioral1
Sample
7fbfc88255e9f681ca08d07150119d643ca9776e5e22987ebe73870ca651c6d7.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7fbfc88255e9f681ca08d07150119d643ca9776e5e22987ebe73870ca651c6d7.xls
Resource
win10v2004-20241007-en
General
-
Target
7fbfc88255e9f681ca08d07150119d643ca9776e5e22987ebe73870ca651c6d7.xls
-
Size
47KB
-
MD5
984908c2b1090d3cd49e98c60d0f6404
-
SHA1
5fb42d2be7fb955a7f5650fda2befd1c550ed7b5
-
SHA256
7fbfc88255e9f681ca08d07150119d643ca9776e5e22987ebe73870ca651c6d7
-
SHA512
305a94d413c718308a7578380c8f71247aa94fb2b47fb916709a063c668abe8649bde93bd99f9a4ad2c56fe7499cf4f9b216c96a1f617f7fee2a2174fe67bbbd
-
SSDEEP
768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFq:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gP
Malware Config
Extracted
https://www.escueladecinemza.com.ar/_installation/IBlj/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 3068 2268 regsvr32.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2268 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2268 EXCEL.EXE 2268 EXCEL.EXE 2268 EXCEL.EXE 2268 EXCEL.EXE 2268 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2268 wrote to memory of 3068 2268 EXCEL.EXE 32 PID 2268 wrote to memory of 3068 2268 EXCEL.EXE 32 PID 2268 wrote to memory of 3068 2268 EXCEL.EXE 32 PID 2268 wrote to memory of 3068 2268 EXCEL.EXE 32 PID 2268 wrote to memory of 3068 2268 EXCEL.EXE 32 PID 2268 wrote to memory of 3068 2268 EXCEL.EXE 32 PID 2268 wrote to memory of 3068 2268 EXCEL.EXE 32
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\7fbfc88255e9f681ca08d07150119d643ca9776e5e22987ebe73870ca651c6d7.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe ..\wnrul.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5dfdb83bd3445e3f2ea46b104976c8d43
SHA178e1237f69e9ba18a68a2c72b6a78179fc01c29b
SHA25676e4a6a2d7ade92678bdc5dd447199ce8f16496d32b36b000726053a89e89443
SHA5126950cad2b1e7f9a20015ee358a44a7def9db96cb395c21a21fece6348e24cf4d307e10091b5f84edeb84368d9f435a82366ed992bcb372e078571a7b97cc328a