Analysis
-
max time kernel
133s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 10:42
General
-
Target
0b133c331dbc662e5af6b8fe1b58157653a958c878f9029bf0fdb8686ce0ca20.xlsm
-
Size
40KB
-
MD5
cc8b5fee0ec76ba6679e3ca2f380c05b
-
SHA1
af00cfc5df82e5be83e9517e2dfb5fdc7f2d1fe6
-
SHA256
0b133c331dbc662e5af6b8fe1b58157653a958c878f9029bf0fdb8686ce0ca20
-
SHA512
9d8ec69c0de47817f33dbde2206f0fa88ae32f89b23aff19553b6439b2510c89605344c289a479b2a09634a3d021017e21e469ea64a73a789da26ae154191280
-
SSDEEP
768:ytby3nCsqi1O3mnOzyKfcrND59V+L9Rw4eWrXcTqy0y3:qbunC5iymqylND59V4jwmXc2Xy3
Malware Config
Extracted
http://foroviviendaparaguay.com/wp-admin/hx8U6XMffnkv8HI2Oig/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0b133c331dbc662e5af6b8fe1b58157653a958c878f9029bf0fdb8686ce0ca20.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\xda.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e8429f9b96a58c59b3502a8af846e294
SHA14502853eaac5acdd66384695e66398426ecc7472
SHA2566a623f2b92c11abe3d3649457ef0c8f6a5bfee74ef4b01b6fdb049590aac1b55
SHA512c942727f391fc2fffdb59cb7faab7c53b12dba6efb3d6ddfd66e47eef50965a351b0f478f097dc111e1a1df2b318c184af6130e072442ce5cac07711916a1461
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB