Analysis
-
max time kernel
133s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 12:53
General
-
Target
0f6fa5793ba67854ecd63ac76ff8233e28d833e6b75262643f2860d639814f57.xlsm
-
Size
46KB
-
MD5
7122187c5d8384b6a699718397228540
-
SHA1
aa401b819b9af211823b69b52839a9188f856369
-
SHA256
0f6fa5793ba67854ecd63ac76ff8233e28d833e6b75262643f2860d639814f57
-
SHA512
8b762d56804f8a86ea84b925511a51fa5eaae12db03fccfcaf6ca5afb7d960cd6b10c2de32264bc609b62d1f9308f2644a118bc9e04fc2e7937c9ac2f9bd005d
-
SSDEEP
768:cwLvfWDOevZCwrvtrDPzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VfskoM:1WDzftT5fTR4Lh1NisFYBc3cr+UqVfD9
Malware Config
Extracted
http://congresoapp2021.com/u07di/wkdehSgS/
http://forocavialpa.com/wp-admin/bnFI6WhjZkffrb/
http://s1.techopesolutions.com/semicanal/g7jRfFqphhUQ5oh/
http://tournhatrang.asia/cgi-bin/2gnqrN/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0f6fa5793ba67854ecd63ac76ff8233e28d833e6b75262643f2860d639814f57.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe /s ..\cre.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD587f74e24607b7e584068a7cbc1318038
SHA156cec9bdd5b4433bc08bdbe452db410d87bf4aff
SHA256155ac677adbe7753292a690b4c5e5e444a529c5766613f669fdea70628fd38af
SHA512cd8e30680a5f81fb90ed2e0fcc3b6425e727d2db0d5e84fdfb876f1c4aadf5ad681c19ad6a95ac33e68933f25d1f1756e6f9e70f04574c2c922eadb4364d5530
-
Filesize
1KB
MD59560915236aff3bcb5a8e097433e93c2
SHA1add953120efd7fd5067c8696616cae6d3c21db58
SHA2567bcbfe2da4bb9d88d266880770dbfba9d07fbabc7f12675a6815d2052e4771f5
SHA512265c4af11f7f64c96c6b7c5fc291563e1181edff5ac6010106be6d55f823c6f6e7e0f61935c3da46a2916bce9cdceb16c787fb4f456362fb48164af47684aed4
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB