Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 13:32
General
-
Target
fd4c84611d6f720548fcdcfed9d029fb2bb67898c4a95cef78ee6639ba94d4bf.xlsm
-
Size
46KB
-
MD5
4340a556457a9587d6c08b2bdd2cfe9e
-
SHA1
2215cfe36a738165e02bbd19f3caaebf807cb179
-
SHA256
fd4c84611d6f720548fcdcfed9d029fb2bb67898c4a95cef78ee6639ba94d4bf
-
SHA512
c16e4966ae51b33903f84cd9f00e66b2706439c42933f6cddf3ad13de1c46e964f0a396c1c77d5a228a40e706289a2c57639fe5ac42c0ee39b7252cfc03e4978
-
SSDEEP
768:iEoTBvDOevZCwrvtWzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2ceI:tolvDmtT5fTR4Lh1NisFYBc3cr+UqVUz
Malware Config
Extracted
http://moveconnects.com/wp-admin/network/7T8g9DAohsL/
http://benzo-pl.com/wp-content/NVJU3gASPcyRDctfsM/
http://mentalpeaks.care/kymogram/ex1hhh/
https://melhoreseudia.club/assets/JbQzzZ7UBaXq7bB/
http://meca-global.com/okickb/Vm1FMsVcbL/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\fd4c84611d6f720548fcdcfed9d029fb2bb67898c4a95cef78ee6639ba94d4bf.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58be29394a2a897f5a2026e25aacf38ba
SHA1f908cdc98ff6b23602ddcf510673e28a72c9350e
SHA25681a84b13517d8e423009fed21fc29ae1f5f87425d310a23e93ad7cec41de63cf
SHA5122a3df7d400c240519301954719d7e4c203f050dbade5e6d1fb362d08ba9ddbf14bb21977a96f1457bcb33fc4f229a403de5fcbee94b613eb69d2530ca4b48164
-
Filesize
114B
MD5e89f75f918dbdcee28604d4e09dd71d7
SHA1f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA2566dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
SHA5128df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB