Analysis
-
max time kernel
133s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 05:34
General
-
Target
2f8ee0365d85b25f9891a6347a0f87d001dec8c0e200c9cbdfada2a26477220b.xls
-
Size
243KB
-
MD5
b7366c3143ffd59510bde00af4fb9771
-
SHA1
c148e7452543677c8ebfcb367159544764834546
-
SHA256
2f8ee0365d85b25f9891a6347a0f87d001dec8c0e200c9cbdfada2a26477220b
-
SHA512
fb3e654597cda37f3749844cad7b58affbafe9fa6dfbb9b0d063a3c3031fe382642ccb6c68a398867cb7881202387b8c8ae51ef05e2b789dcf623bead3bc38dc
-
SSDEEP
6144:DKpbdrHYrMue8q7QPX+5xtFEdi8/dg/ThvsiKIjvl5fd1Xh8rsoX/w/0Y:ghEXs5fXR8rsNT
Malware Config
Extracted
http://servidorcarlosydavid.es/wp-admin/jkNPgHxNjF/
https://gmo-sol-p10.heteml.jp/includes/UoJMgYAc1EES/
https://iashanghai.cn/z/Z1PG6ulBh20plss/
https://www.pasionportufuturo.pe/wp-content/HkUfvw0xuCy5/
http://dmdagents.com.au/vqwbgz/CL4Bo4C4VS0deg/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2f8ee0365d85b25f9891a6347a0f87d001dec8c0e200c9cbdfada2a26477220b.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe /s ..\xxw1.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD50993562b86561cff748b4979261714e6
SHA10a781cc1d4232891f0dd5108d9bbf485364b8244
SHA256025af997364948e68743a409c0c2b87d7fc89bda4eefce26d053f4cab4132753
SHA512426067ab3691a7b7996547e9174e34b50989e775e51e58b69a22320ad5aa24750360b36f6d6ad309694e326dabd4362ebaef60ca4985548363c8563a35ce13ef
-
Filesize
45KB
MD50cfe08d0b76f6c16d79dffcb527d94bb
SHA160d63b9a567e6d1df9b0527ae21b1cd4c767bd8b
SHA256f3a99f22b32ae07964ad6e46f8ccd537f654da7eaa70ebe162efc85cfc1a332d
SHA51203852181f0944ba7a8fd67b9aa8ef1cb1d947be6f5b774eac2d8a5efaa689a1229918eaa9ae9d9384dfaa40b85c1a1a5d3ee036aec5e41f11012b16d33bb48cb
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB