Analysis
-
max time kernel
133s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 16:57
General
-
Target
c6ce55de413a333cb1e4bc0b0b2706f38a6bd249a9af5b8dd8c5eafd295801d0.xlsm
-
Size
38KB
-
MD5
ddbe2bff711d828e4c3c21f622274052
-
SHA1
6ab9a632788061bf88e10d4f26476742882b2428
-
SHA256
c6ce55de413a333cb1e4bc0b0b2706f38a6bd249a9af5b8dd8c5eafd295801d0
-
SHA512
c4f75d72c81bb047add2a0d185a3a79183b052e79f3eec81c9770ad139a28d1f5c0d0e6c4279d88f373be5643f952fae68747bbb4598d42454173ed91a0a07f9
-
SSDEEP
768:ibdpCR8kjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIyYS:iwDOZZ1ZYpoQ/pMAeVIyYzaT
Malware Config
Extracted
https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/
https://risamfg.com/wp-admin/JtqFQW/
https://thailand-rocco.com/wp-content/gE7UvFwLh/
https://pregy.org/test/rXTl1DEv0CWCE/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\c6ce55de413a333cb1e4bc0b0b2706f38a6bd249a9af5b8dd8c5eafd295801d0.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD56412ea88d3d36f2eaed9658dceaf88a0
SHA1b8742780269988f1b00262b5751b0c950845d908
SHA256c4ad272334356640d0ae3bf88b3d31aa28520ac17695e029c91a72fa5bebf3d0
SHA5129c40f26e2d4434b321494eac7e366c8d89c9b87a9f265216933d9d75e435c82f2c57ac1c31b8a0a477c85b0d26b470a4414ee56ce1af2e5773dcdc785f1230c7
-
Filesize
1KB
MD51326c16a18441423830933fbb3a6a290
SHA1d62b5f0ec9ae7a82209938c347311519b9fc1084
SHA2563bb40456027c77d05b991e4686f10e51739a6ebdca3e33ec5edcd1e2c28b34cf
SHA5122b9076d43ccc836c89bcd4cc1946008b1d0268edf432d37659960f4ffb9836ca65e638b61305f374ba71b2fa21ac3210482c0e6287288e75bcd44d4fbeb3e528
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB