Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 16:17
General
-
Target
56d4082122fe007428b4de680a0fa442bda843de5178adf1ec518a1b50b4ec93.xls
-
Size
70KB
-
MD5
ccdb38bd22fe5619b32243909cc30fe9
-
SHA1
95804e47848401ea4763ba66f88ecd839c6d962d
-
SHA256
56d4082122fe007428b4de680a0fa442bda843de5178adf1ec518a1b50b4ec93
-
SHA512
90357fe26c4a7d8283e33695e5f564ddae42b9ce44e6b65a422e3a613accb4ab0f5acf29ded6104be131fb7edf42a280a9fbb6b05cd3a5e4871560e43aca5252
-
SSDEEP
1536:tOKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+1YW/ESKQHS1yXJFa5etmv:AKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMt
Malware Config
Extracted
http://congtycamvinh.com/plugins/jG3iqpQaTL1TXYMolH/
http://ecube.com.mx/e2oCWBnC/6wp2K4sfQmVIRy6ZvdiH/
http://dulichdichvu.net/libraries/6vhzwoZoNDSMtSC/
http://gnif.org/administrator/G68HwUGlKNJNU2vh5cz/
https://edoraseguros.com.br/cgi-bin/l7ZERv5deNsfzlZUZ/
https://sanoma.allrent.nl/cgi-bin/KXbI5OhLJ/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\56d4082122fe007428b4de680a0fa442bda843de5178adf1ec518a1b50b4ec93.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58b8e78699877af9aaf6af45d34c7a5b9
SHA1da7cd41fe939cf1ed93f2ffa2627233d8b1276c7
SHA2567941c48662a4757dd1fb17d1427e271ce7ecb3d8811f808b518eb3ea73ea60d8
SHA512f16f78d5d448aabb55b1c654b137758968472692ec9751549db37f1269f522cbb171412e5580025c1362dc09a49629fe2dc37f24f175b63fd45196a368ac4cad
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB