Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 13:25
General
-
Target
2663b91a3207ca1cbe597e77bda827af6faf72ac4582dd047df0dd9639ed6ef5.xls
-
Size
142KB
-
MD5
7e61fa5a05ebbdf32588983f15e65fc2
-
SHA1
b9a60ea5c38b94659727e002463c1bdcbafa5a2d
-
SHA256
2663b91a3207ca1cbe597e77bda827af6faf72ac4582dd047df0dd9639ed6ef5
-
SHA512
6998df2150898fc49b737b25d89fa8c8316aa37d9b331076ee6837fb874ee21729cb4a0ce0d1ee6996aa7139836325cdcf268d85e0b73384f4d90a9d42a58cfb
-
SSDEEP
3072:kfKpbdrHYrMue8q7QPX+5xtekEdi8/dgR/c/mrWmngyYXnMJelsSKThsdskl4Wjd:8KpbdrHYrMue8q7QPX+5xtFEdi8/dgRA
Malware Config
Extracted
https://www.certika-bolivia.com/omeltxveatup/9Gb/
https://www.cfoodsnepal.com/index/rvAYVKkJgVWiCwt0wV/
https://www.cgaei.com/fonts/ABuQi/
https://www.chotdonhang.com/noi-dung/w1hMfkjuwAne4W2epiP/
https://www.charmingsoftech.com/css/mJQYPVknv/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2663b91a3207ca1cbe597e77bda827af6faf72ac4582dd047df0dd9639ed6ef5.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5fe32d0ae91ee87268cdeb5ddb215b5e0
SHA110b9aebf18b111014cfb01de5054b5b3be223db0
SHA256583a7f90b6ac4ae7af6b0d231a31f8d1f17c561c863bf7e1453c595d2636c827
SHA5121ca0ad703d501e2147a27fc65a26f9b5dd1d093efbfcd5d37596cfac3ffb2c707db2dba3fc321fb23d9b9b0d474203431f621577f4b823f57484e9fe3763ba6a
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB