Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 12:26
General
-
Target
bee8c3cf380a2955ee52d42fe216a947e8e2f8e407b11d33560e7d4df92169c6.xlsm
-
Size
21KB
-
MD5
821fef9a78eb818dabbb359512b0f572
-
SHA1
e186c20e6f8b542f9679d664ca0c1c1b674a2037
-
SHA256
bee8c3cf380a2955ee52d42fe216a947e8e2f8e407b11d33560e7d4df92169c6
-
SHA512
ed34536ef14f668d864fe46dd0827251919c1e4dbe1474b1ecbf72be51ecb489c8e2413650d90ffa280cef688154dbd58907bafe5609a016ccf1d4776ffb8932
-
SSDEEP
384:48c5hAuAi/NjxhS8EibbwBlwcSYrLb5CzgObff9kC+xbX7T/1SeyB:4PksNPzXSFCBn9kC+xbLTc9
Malware Config
Extracted
http://astroadvicebaba.com/assets/jYlBTPcWJTsTtamDfX/
https://physioacademy.co.uk/conditions/8I3WSx5t2k/
http://orchidbg.com/aeeiludqootr/OcnjiLHL/
https://westthamesphysio.com/blog/3tsZIz09Sox1Z/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\bee8c3cf380a2955ee52d42fe216a947e8e2f8e407b11d33560e7d4df92169c6.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
966B
MD51a8978d9d37041fe0089728cd6c23233
SHA1f0485019f25ee50bb77f23081a8964e28e56cfb2
SHA25687a97454942b85b5afc9cb9733bb7ce96cdf3422f6bfc95823f8edf6b2e2c607
SHA5129ea43ede1eab73d3ac65bc3e9c13836c51d768daf5e300a0f57a26c0ca9cb2655455e5731664a92c969520dc05f7c71292d6a947405e06c2b1f88a399cd8d42b
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB