Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 11:31
General
-
Target
b57b2e29f2c1e6055519631c2b5bd3649bb0d6b8b84103a0a4084326aa1b176e.xlsm
-
Size
20KB
-
MD5
06e24cdca3f1d7eedd445720f850f92e
-
SHA1
920ebb28f24c1d4846a7f63e4bc6118aff6bc4a0
-
SHA256
b57b2e29f2c1e6055519631c2b5bd3649bb0d6b8b84103a0a4084326aa1b176e
-
SHA512
175f784174ec05d3623271507d505f0ad1be4fdc352d3238767fa482b019c58a1387591b24ad096bb39e65dbc87f7ae816b93bd5b492cc6e878d08dd700694e0
-
SSDEEP
384:m/Vb1GNjU5o4CGzPd6ZIw8R3Kb5CzgObff9kC+xbX7zJBq1:mtINAo4FLkCBn9kC+xbLzJy
Malware Config
Extracted
http://antaoco.com/wp-admin/5WaIjOuHnUj/
http://amakpost.com/assets/IaeePiSroWtpfZ8uURa/
http://anat-bar.co.il/cgi-bin/UNS6bRMcF4pOTf/
http://andrewpharma.com/wp-includes/WqgKtKrYJM/
http://amkltd.co.uk/amk/IPuhx/
http://gees.com.pl/geessw/2YmxITo6/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\b57b2e29f2c1e6055519631c2b5bd3649bb0d6b8b84103a0a4084326aa1b176e.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD506773329f73765cddfc36ee9bf08c1ec
SHA1fd57527f5db19cdd92fa62c49e29c09fed2c1d10
SHA256c0737a276f57a646dfdb40ffbfb291010861390ab19972696d2560cf8ec2f942
SHA512cc068172274f04b5290bff65c444268294475fcda9056522df8fea0a2dc439a63652a1b6eead86c4fa16e77c08fe918aab4cb6af7a4e78840ce3ca8aef711b9f
-
Filesize
106KB
MD5f537008283d93aac2820cd4bc174ec4d
SHA11c519191742657bf485d6eb9610c4e338b156065
SHA256d06031cf39464070ea999017818dd1b0f97d9c9f7d292cdc078681c2897bde24
SHA512a12d5a4f5f825893a7d0d679eda86685386948fcdc4e24ad501c33bde6451d0b5b86862edcb87630b891c04bec62e26d1b15b2243df3d8157ff84c2b6341e4ae
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB