Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 16:41
General
-
Target
7e719ee6bcf016f525c302a96135f649eed29a4f01428793ea82097f6dd622cd.xlsm
-
Size
32KB
-
MD5
a1409d09dd35fb9a308ae78cb1bd5f7c
-
SHA1
c5b2ff0b27494854dbd5ab84f9c5d712e886a1b1
-
SHA256
7e719ee6bcf016f525c302a96135f649eed29a4f01428793ea82097f6dd622cd
-
SHA512
7f14d74dd661a9c28ef58da9d546f0988aeaad3e5610ef2486d372f9c1eb5d26d29f2169a538124667b2482b315a119cd44be987c5178e95db6cb931b148214c
-
SSDEEP
384:wjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:wjpFhNNlizXT28dFfPdkqstJmE6/
Malware Config
Extracted
https://casache.com/web/n3jxwXXwa/
https://www.blessingsource.com/blessingsource.com/rFQ0Ip6lQXXK/
http://ccalaire.com/wp-admin/d1pGRa0X/
http://cdimprintpr.com/brochure2/A9NmYDndZ/
http://careerplan.host20.uk/images/Ls/
http://ausnz.net/2010wc/odSi5tQKkCIXEWl9/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7e719ee6bcf016f525c302a96135f649eed29a4f01428793ea82097f6dd622cd.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5dc50faa8a113d4657a59948cdb83180b
SHA1e2f6488a6c6bbc9d2c45220eb2212481b55b98f6
SHA256b9be8abf57bd91e9876cc3b773fd7f9fef40d60a68a66873aa58322007d41c3c
SHA5129f4075a653ddce660543778d1131f663ab0039d0399bf26ce2ed285035a32687d575030e687a8ff0ede57dfc1a7b3591f8beedbd95efea257962e5dd90fb0e93
-
Filesize
168KB
MD524777d6c462f17ed76d635df55cd09e8
SHA1026f3b82ac2cc5a6603fa7094734990045709621
SHA256b654baf3b7feaaff76aef842cef9132eb1d2379d3d110b21fe6422b909503a23
SHA512064b5bb10457404dbdfa706c081b086daca7353874252192f728ae24c7cab646bda84ee5943528cad70209bf7571a14cbb6d0d35fbd6f9782151f1a481ee0405
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB