Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 15:52
General
-
Target
0bec13768d7f2aa66c9f0e41e52c246839ac16239b9df4605607f2eb7d994462.xls
-
Size
110KB
-
MD5
9aff5ea7385d929cc9e316b408b02295
-
SHA1
6796b1ecd6533260414fcc552c6160827d0c7866
-
SHA256
0bec13768d7f2aa66c9f0e41e52c246839ac16239b9df4605607f2eb7d994462
-
SHA512
bfd8d2d16a014812623bc539d84760bfa6121e83a32eaf2ee6f364fe4be9c8192b3fcd901b733a5bd0dfa9e88d521ffba3e6124055c94e952ba1e4e73166bc39
-
SSDEEP
3072:VfKpbdrHYrMue8q7QPX+5xtekEdi8/dgVyVIBk6h2bsllScQjnxM:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgVf
Malware Config
Extracted
https://duvarkagitlarimodelleri.com/42hhp/gZXakh7/
https://dolphinwavehavuzrobotu.com/wp-includes/RmCbvIKjjtlB3tabyPo/
http://animalsandusfujairah.com/wp-admin/JWO58zeUOwSI/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0bec13768d7f2aa66c9f0e41e52c246839ac16239b9df4605607f2eb7d994462.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe /s ..\xxw1.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5556293a2610c3cd6f92c537f6a9ed3eb
SHA17a2d9d4cb77feba30448716300e3c86012e7618b
SHA256b62ed01cd7a6a95c69f04fc01296d8f5ca14e1871d0d9a275af6924ad321cc2d
SHA5120eda0ae043a164429d15ec6d72bcb203236ffe7bca671ebf27cf55fe895563c7faf723857542012c94b60c4b3a384d38333030720d0854590144510098fe6299
-
Filesize
1KB
MD51326c16a18441423830933fbb3a6a290
SHA1d62b5f0ec9ae7a82209938c347311519b9fc1084
SHA2563bb40456027c77d05b991e4686f10e51739a6ebdca3e33ec5edcd1e2c28b34cf
SHA5122b9076d43ccc836c89bcd4cc1946008b1d0268edf432d37659960f4ffb9836ca65e638b61305f374ba71b2fa21ac3210482c0e6287288e75bcd44d4fbeb3e528
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB