Analysis
-
max time kernel
133s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 12:29
General
-
Target
9770df307dd78fb196a87e999fb8bdcd242227d74e0385c14b0640b890a6ba26.xlsm
-
Size
73KB
-
MD5
5143808aa0ffbedb6289d365b901614d
-
SHA1
8aed92bece1b9f194fe9a1120605e5953ac1c724
-
SHA256
9770df307dd78fb196a87e999fb8bdcd242227d74e0385c14b0640b890a6ba26
-
SHA512
d944140cefc359145f5d98c433d5d0edf081e89aab992981f910882a97dcad1a4205aff6df17da2cda26334477ae446146aba7a788d5d64b5c6b4f55423bb2d9
-
SSDEEP
1536:i41yiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV4XG:B1yiCtzSmICpH7OZuvZGsMX
Malware Config
Extracted
https://appleinfoway.com/venv/5Pp/
http://www.atelierkikala.com/Facebook/vXY2sLFfbSSCTh/
http://astrogurusunilbarmola.com/css/ucDJnRTACskNjrZOHr/
http://atters.net/cgi-bin/0yIPlpXo3156/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9770df307dd78fb196a87e999fb8bdcd242227d74e0385c14b0640b890a6ba26.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cc41d342eb1aac4830eb83613e7367b2
SHA10e51ef27842efdcee680f19896dbb722533857e7
SHA2567c79a1a685e5fc6fb7335afcb72b6d1eead3484b757e6bb62a16c47e35efa4e6
SHA51295aa902569f2211d97939df69c3301c9adfab3f0cdfc142d1ba70c06894d44b37a06e8e90acff857c6159a8af739035b04401c1f4a7c98e7549507a52b8764d2
-
Filesize
91B
MD513602a959153b8c9b4600e17dc98ebdb
SHA11ac6cd8cd54a7d9a013e7f92be645b275a75243b
SHA2567b5dcf39a3facf8ee0b21a1738d6b652b67768e3321aa848f2d1a5b9f80458c2
SHA512e9bdf50715f9caf53644f3bf4d40e7e31620f00df1e462a9f9c9885f056cdd442cc178c1b5f9f12e5c541199e1e4ca9e06048a9c03413a77276f6ab43b46d923
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB