Analysis
-
max time kernel
133s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 15:06
General
-
Target
0d464cb146c0a1153054424b29be3f6c763951eb6b3109cde0faf6b973aecd42.xlsm
-
Size
73KB
-
MD5
9869f4ce6c602c661dbc68055103aa17
-
SHA1
e19c08ee4db0b92dd3807c062dd32150abcf42e0
-
SHA256
0d464cb146c0a1153054424b29be3f6c763951eb6b3109cde0faf6b973aecd42
-
SHA512
375cd51a4297dbaae77bc05e39ede5d069172f00e0bb3bb694c523031a3d26b5b8737719b430bb23f0b42cba81abeb4171931b60d75538de38eca6011bdfb024
-
SSDEEP
1536:2LgT1WiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV6BD:x1WiCtzSmICpH7OZuvZGsM0
Malware Config
Extracted
https://www.ankeoman.com/undercons_files/l88ETG/
http://atbiotique.com/images/Luf2JK8NAHSkvg3H83g/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0d464cb146c0a1153054424b29be3f6c763951eb6b3109cde0faf6b973aecd42.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
671B
MD53f90b048dbfe1f39b67f32f6a0cc3046
SHA179436f45c16e29bf3a3dc07b0ef380565ccd564e
SHA256bd45f0f6e1cba19728626bf80a79b80c49edffbbd6d8db9537e9046264211759
SHA512609e1998cae1e41bb3b7a8a28c6c4cbf55f50092415fdc6da426935f69883f66a863c86e9cd4379102b9b7e08ee87e97e0c44e424f50fa6702e1d016b488205b
-
Filesize
6KB
MD5c16ce81d99df3f8fcc14dee6884354cf
SHA17cbafe67db47973d52415430fcf7da87c0a6e9bf
SHA25646edae29f49b47f8cd66b3ac609ad698a9a832c83710d2c536d0e63efe292770
SHA512d8a7be3fff25e30f2c7362980b8018fdbaf87995918988a5ececd34fb2cd07580ce6c3318d8ac339483888796b721e2948b3937b712d11143221d76cd8cf6fc1
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB