Analysis
-
max time kernel
133s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 05:37
General
-
Target
5df125e34d80cb2d69bf1decda461cb7b8663c4a739050ca3a1a0a8b06c0a2d1.xlsm
-
Size
20KB
-
MD5
ec54c5a515df08c95080df4bd69b8b47
-
SHA1
f6895f5c64dff0303e27fdebfcc93b6f18ae68aa
-
SHA256
5df125e34d80cb2d69bf1decda461cb7b8663c4a739050ca3a1a0a8b06c0a2d1
-
SHA512
c4d29545642e952f012e0d17747ac95e961bed0ecccf58637222c9059ea760ebb6a4d43d3837265572cb3ad33b4445bf28f662e5c9606c4b0579643845eb3dcc
-
SSDEEP
384:0HTyVb1GNjyo4CGzPd6ZIwGdKb5CzgObff9kC+xbX7zUSA:guIN+o4FLYCBn9kC+xbLzK
Malware Config
Extracted
http://osmani.atwebpages.com/wp-content/Ynwrr/
https://50-50aravidis.gr/thesi/wmL/
https://amplamaisbeneficios.com.br/contratos/MWnnZG/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\5df125e34d80cb2d69bf1decda461cb7b8663c4a739050ca3a1a0a8b06c0a2d1.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5400bd1ef96c3110aff273cc1cc068b37
SHA1a284be77655d9c6e07e3b9824116abe340b081e2
SHA256a16ca65c06f1e7054ef51671956e137815209f4062bb5a696c3b5930dbba6b84
SHA512838db12bdd85d0a8bce791a7799394b201b5e5257a6919999f1f7f3befa36a41d01bff1e87d410ad6c6b68ce62cffc16bac7779c634ec319bcd290a9eab205a0
-
Filesize
3KB
MD5cc666088a917dd7f5da8b6689069aec0
SHA1f688de634ccd20939a522391abb5049483e726bd
SHA256332d102987273318f13e7fc89a043613c6dd5dd7eb7d21033a2ab73dd438a405
SHA51277a15aebeb10d355e3723fdebd2ea59a09a60d54f09ab9a6f06c52dbfa3bea0965ff49b7a1c2e6f4ff94f3fe903e6301188de2f80801a8a978c8c09b3356c8dc
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB