Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 05:00
General
-
Target
1d3cdf703fa3d5fb83f70a69ae913ddcda0d7f1d4a26cd4ac8203a9f19e05498.xlsm
-
Size
20KB
-
MD5
4ed529f7ab78c5ab0325baefb7fd147c
-
SHA1
b4ca75333b89b30e453a3967bcb44b09040ebc3c
-
SHA256
1d3cdf703fa3d5fb83f70a69ae913ddcda0d7f1d4a26cd4ac8203a9f19e05498
-
SHA512
b5c3e6c63f41b6cb1cece90c55fc6c4e5c4c81f842c78fe7b78a4487306109d0b6e5f99a76826dabb90d59395cbf50d86ab099afee6c907b628c0df699a77733
-
SSDEEP
384:6/Vb1GNjU5o4CGzPd6ZIw8R3Kb5CzgObff9kC+xbX7zJBq1:6tINAo4FLkCBn9kC+xbLzJy
Malware Config
Extracted
http://antaoco.com/wp-admin/5WaIjOuHnUj/
http://amakpost.com/assets/IaeePiSroWtpfZ8uURa/
http://anat-bar.co.il/cgi-bin/UNS6bRMcF4pOTf/
http://andrewpharma.com/wp-includes/WqgKtKrYJM/
http://amkltd.co.uk/amk/IPuhx/
http://gees.com.pl/geessw/2YmxITo6/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1d3cdf703fa3d5fb83f70a69ae913ddcda0d7f1d4a26cd4ac8203a9f19e05498.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d38c62ded72d32ee9a743de0def20b16
SHA19402c542b6ccc6e1953b9d6fe4b5b3a5ad33f2b3
SHA2560f3ea82169b9660c808d44aae4ccd8af1769c28426c1b8d9dc285909e9e54404
SHA5126154567accce9319b2a0730c01e4c925a9f8434d75899978ff530e0abe411c079af4722406d5efadcec8609525dab1803667cd1644aab693235ed0759bc1dc47
-
Filesize
106KB
MD5f537008283d93aac2820cd4bc174ec4d
SHA11c519191742657bf485d6eb9610c4e338b156065
SHA256d06031cf39464070ea999017818dd1b0f97d9c9f7d292cdc078681c2897bde24
SHA512a12d5a4f5f825893a7d0d679eda86685386948fcdc4e24ad501c33bde6451d0b5b86862edcb87630b891c04bec62e26d1b15b2243df3d8157ff84c2b6341e4ae
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB