Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 14:15
General
-
Target
c5e91b67025af43532ffbc06cf7009684f0c632e61d1b41a022c6de9243b8c9a.xlsm
-
Size
20KB
-
MD5
3cf35d21c013505c2af4e059eff8b552
-
SHA1
c1b2af94d52f68da802dbba83f0820da05110fd6
-
SHA256
c5e91b67025af43532ffbc06cf7009684f0c632e61d1b41a022c6de9243b8c9a
-
SHA512
dc82ea8c6411a5fecf1fad1ff1d6e563f87e7ca875bea10cd55335a077ffa6f1dfe1e2afc9b9352e45d327bb2255e6fb268b3dc0b84aff414ca7b8b5e1a0b3c3
-
SSDEEP
384:eJaVb1GNjImo4CGzPd6ZIwwSKb5CzgObff9kC+xbX7Fg7a:kiIN3o4FLTCBn9kC+xbLF1
Malware Config
Extracted
https://banrai.ac.th/website/IHI0iNLLWDh9P/
http://bangsoe.dk/__backup/JON6L/
http://bahr.se/tvillingar2-filer/0wFIrmZ70Vl/
https://barkstage.es/wp-content/S0Q/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\c5e91b67025af43532ffbc06cf7009684f0c632e61d1b41a022c6de9243b8c9a.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50486136efdabb72f5a8e9e8a66b1f2f3
SHA1f847de2bfc39e14608205b846e398953f9c263eb
SHA256aaad156175a01444c2b3231916c448b15a80f9b2069af75dc5afb52d891e4ece
SHA512e77a18e73b3917830e703e393d645894cfe8f19abd89efd3f7f77d78e33e2d740a57aef491419306936add2a8080c8d106a3678083b2edaf4065ac81d6524fea
-
Filesize
1KB
MD5f31d92a3abb20013993df6cf8c3a6966
SHA1e8c85ac9fe0f61134c18d91e2112708dd033c41c
SHA25668139c01e5888ab346bc1657472b8f29ace14a21ed31b927e4036227a1da32c0
SHA5127cdb720387c1090bb43b3eaa3df42ae307d9e307a540c57b6bae0b3befb83cd8f04cf181d1b1e5efef69f8737bca806ee982096537324f28429d17d0020aa547
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB