Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
20/11/2024, 14:59
General
-
Target
0a6f06b1263bf707a19fd0c77c34daec67fd79d02b42aa5726fd56bd92d24093.xlsm
-
Size
74KB
-
MD5
eaa6e4c2dab5ae9f529ec28ac1cc8a8d
-
SHA1
bef868f62062dc9d8c8a2b8317bc7e7a5801c287
-
SHA256
0a6f06b1263bf707a19fd0c77c34daec67fd79d02b42aa5726fd56bd92d24093
-
SHA512
b24cf593c2dc7bcd955096ee7662dc5166272e53fae0adb7fadb148ad3d9b59f32eae743b6e5d7fa94f58da8e1978e4927626a6bf3611af8aabbca87b66fd606
-
SSDEEP
1536:WuSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:wtzSmICpH7OZuvZGsMo
Malware Config
Extracted
https://thesparklezbox.com/wp-admin/kFkWN/
https://herbtytox.com/wp-admin/dq/
http://www.asyadegirmen.com/Template/nEMRY55nQgF/
https://westthamesphysio.com/blog/D8AAkEyZ7u/
https://www.adcreators.com.au/adcreators-edm/RDk3LtiwMkuDQy/
https://www.nipunpharmaskill.com/css/xm17DssGXjChcmm/
https://www.afyonmagazin.com/wp-content/DcnLRE/
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\0a6f06b1263bf707a19fd0c77c34daec67fd79d02b42aa5726fd56bd92d24093.xlsm1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB