Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 13:48
General
-
Target
5a4f22eb0f076f94a729dab9f36c523ee63060e10a3222e7cc9d5d40e18e6825.xls
-
Size
110KB
-
MD5
17930414c6d73cfd112a5a56b18fff41
-
SHA1
3c861338632115d7f748299e4326d82ad25bd57d
-
SHA256
5a4f22eb0f076f94a729dab9f36c523ee63060e10a3222e7cc9d5d40e18e6825
-
SHA512
77332e2a14af9dd38a834af71b860587e995aaef7920fbc6ec457fdee1069004e2685c4f7591009350dca5e7b75f79d38a8cae16e6f9628125797634af3f3381
-
SSDEEP
3072:VfKpbdrHYrMue8q7QPX+5xtekEdi8/dgVyVIBk6h2bsllScQjnx8:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgVv
Malware Config
Extracted
https://duvarkagitlarimodelleri.com/42hhp/gZXakh7/
https://dolphinwavehavuzrobotu.com/wp-includes/RmCbvIKjjtlB3tabyPo/
http://animalsandusfujairah.com/wp-admin/JWO58zeUOwSI/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\5a4f22eb0f076f94a729dab9f36c523ee63060e10a3222e7cc9d5d40e18e6825.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe /s ..\xxw1.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD565aada412ccbd0a8ee4a37f7c98f41e5
SHA121b0c41b986e7876da83a1020d74b1644c177451
SHA2568c578c5ab4bfdfcaeed426f9b12abd5e38a9ffd451882974642136a0a66622b2
SHA512815f054a338888dba0b760fc25398e8354ef5ffacb28c2798b5319c67ee75273019e1f51a84f610f5f7cdfbf053edb33eebc46f5578d7f88be64bef5b22b2624
-
Filesize
154KB
MD5861961ab8b41c5b30a061236e9500e91
SHA1a0ec85be8db5cb48796879150a086517073d6d47
SHA25676638e4f7850bb2bb514bad3454f54396f2bfc3114b309091eb8d2ee5a4da7d2
SHA512db78fc1a51e8a1532ca824ea4c1fa842112d7793ea985cbefae2db0a5dbed54913e3eee6b5cca67e6e7416e51d9f6efbfa7f024e2da677904cd5a3c1892d5522
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB