Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 15:59
General
-
Target
6507e09462fdf5ec2e58f42634366d036e1b5e613807aad5fa45b88179757c1f.xls
-
Size
70KB
-
MD5
2cf1feeae2646b5cd18f8ca9a8c704a2
-
SHA1
b70aaed2e4e4caa89dd6d0dab86efc931d735e97
-
SHA256
6507e09462fdf5ec2e58f42634366d036e1b5e613807aad5fa45b88179757c1f
-
SHA512
532ad5c5cd8cd093608f546f7b1fd35f0049f858537d366d9b401e5dbafe4a7b027cb09aa00520c8ea25d9916b2bf42f53413ea6031c954652d6d08824df5cc8
-
SSDEEP
1536:tOKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+1YW/ESKQHS1yXJFa5etTv:AKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM8
Malware Config
Extracted
http://congtycamvinh.com/plugins/jG3iqpQaTL1TXYMolH/
http://ecube.com.mx/e2oCWBnC/6wp2K4sfQmVIRy6ZvdiH/
http://dulichdichvu.net/libraries/6vhzwoZoNDSMtSC/
http://gnif.org/administrator/G68HwUGlKNJNU2vh5cz/
https://edoraseguros.com.br/cgi-bin/l7ZERv5deNsfzlZUZ/
https://sanoma.allrent.nl/cgi-bin/KXbI5OhLJ/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\6507e09462fdf5ec2e58f42634366d036e1b5e613807aad5fa45b88179757c1f.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a6e1fc7bbd36fdf612c7689e16cdbd36
SHA1dafe3e784d78c625e5a74f6dd43df74c1e2ec431
SHA256c83583cc63d2a485863f10ffb666c7a9bacf798b3fe0bc5c1ce207318080ece9
SHA51254d6d8a1da223ac8c33a8c3d557bf59d6c7662703bd46d5cf62b42191946d28dee61ce38782b9986e5aba77d4b7888ba3c8b6205317fff244d27bdbf756a6131
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB