Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 07:51
General
-
Target
44ceefe764a0329b03eb74c3f8a5b7fc4c4c6939797415bbf283c562db0abda3.xls
-
Size
110KB
-
MD5
2ff9c406775a6ba995f62d080c221b30
-
SHA1
8daf2422a208e1feff27106310890268b4b5f136
-
SHA256
44ceefe764a0329b03eb74c3f8a5b7fc4c4c6939797415bbf283c562db0abda3
-
SHA512
6150d8a082e3f778303e95fe4e17a44052e88d25cf9a06e9782b4c9bf64a421b71e0ca2b9da4e4728c7ed3f91a87069614a2c22503a2e21971af63b556ed1130
-
SSDEEP
3072:VfKpbdrHYrMue8q7QPX+5xtekEdi8/dgVyVIBk6h2bsllScQjnxc:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgVP
Malware Config
Extracted
https://duvarkagitlarimodelleri.com/42hhp/gZXakh7/
https://dolphinwavehavuzrobotu.com/wp-includes/RmCbvIKjjtlB3tabyPo/
http://animalsandusfujairah.com/wp-admin/JWO58zeUOwSI/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\44ceefe764a0329b03eb74c3f8a5b7fc4c4c6939797415bbf283c562db0abda3.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe /s ..\xxw1.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
154KB
MD53448350f99a7d121d3c933e19083246e
SHA1c5244d0ca23c98373f3b99d850031a7b152fa1fc
SHA2569e69ab916de34344fc21c0cba073d83c50ea06cce9462ba408f99eb0a4612f99
SHA512c0efa9f9adac105df000ff473ee4722e38210610fdc96b0532c2504fe306ca581f253d1c24838908187be8e9343fc4fe757366465b2caee5905dacfa35405bd3
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB