Analysis
-
max time kernel
133s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 10:37
General
-
Target
9f3792dda5bf1752ce0d2b97f110e12f16559a5a81b0295eb121510301ffff6c.xlsm
-
Size
20KB
-
MD5
24f60b9c1868193515db85e4131f9ede
-
SHA1
4a3e643badb408ed1e918cf7a86ebba24f389aa5
-
SHA256
9f3792dda5bf1752ce0d2b97f110e12f16559a5a81b0295eb121510301ffff6c
-
SHA512
52a23e3072f989f122f2be17dda8b93afd1b57914ad3a0f75302791c995f8f6d207de0eda246e84aae4689b482c21e5a2890095e1093dc384122c68d7d1a6684
-
SSDEEP
384:15Jm7qVb1GNjyo4CGzPd6ZIwBKb5CzgObff9kC+xbX7Qi9rc5:15J7IN+o4FLNCBn9kC+xbLQf
Malware Config
Extracted
https://benconry.com/wp-includes/eUXuRrm1G6bRZ/
http://actividades.laforetlanguages.com/wp-admin/PXMxDnqZrr/
http://atbiotique.com/images/ESistuSH6DbQFkxTz/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9f3792dda5bf1752ce0d2b97f110e12f16559a5a81b0295eb121510301ffff6c.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d53a20bae42d3e61cb16a5ad18e973d0
SHA15afdb5eeb62c72ccb4cb62349aa9247ed8d85507
SHA256f8e932caeb370f124b6b7f90a86d8e4420d77ceaaebcab99c107e2b22b7f5da3
SHA512b500f1b27888951ce0ed0bbb38eb8ce53af13211b69fe9edd85c11c43399197cea0e05f2fcea22130d0bc61ea03541cda6335ae350bebe335d73eba02c617f21
-
Filesize
6KB
MD5c16ce81d99df3f8fcc14dee6884354cf
SHA17cbafe67db47973d52415430fcf7da87c0a6e9bf
SHA25646edae29f49b47f8cd66b3ac609ad698a9a832c83710d2c536d0e63efe292770
SHA512d8a7be3fff25e30f2c7362980b8018fdbaf87995918988a5ececd34fb2cd07580ce6c3318d8ac339483888796b721e2948b3937b712d11143221d76cd8cf6fc1
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB