Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
20/11/2024, 08:53
General
-
Target
a3b3d1579fb1784dc854bb7e38b8acdd92c8e2806f82035084261fb7af3796dc.xlsm
-
Size
35KB
-
MD5
ef70bf98c43c7de723f2cfb0d89ff94c
-
SHA1
733216bf2b742891b7c185888906f0e471b01ef7
-
SHA256
a3b3d1579fb1784dc854bb7e38b8acdd92c8e2806f82035084261fb7af3796dc
-
SHA512
26bf65acbbde7fad0e5b21052281b2d91d9c73a84c0e107a3aa043e09a37b77d455f057bfb7da156085cf26c081cc5dbbd7fe104120b1b8e8dfead19a781c808
-
SSDEEP
768:/rtDp5eCAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooNQ3:/rtlgCUOZZ1ZYpoQ/pMAIY
Malware Config
Extracted
https://fikti.bem.gunadarma.ac.id/monon/OAH7XngpmWiT1vLkmP/
https://brutobrasil.com.br/pdf/SSscCUKBvL/
https://mdmd.fun/wp-includes/Y00y/
https://appanwendung.com/wp-admin/dvDn7/
https://hotel-boehmerwaldhof.at/wp-admin/mmhZydbNdqVxzc/
https://camaravotuporanga.sp.gov.br/conteudo/LFT3r6eLqdvHvD/
https://dnvqqk.cn/about/fW4aBbnaoOIDwjmpuqf/
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\a3b3d1579fb1784dc854bb7e38b8acdd92c8e2806f82035084261fb7af3796dc.xlsm1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB