Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 17:17
General
-
Target
9cb4641d9d261f888d9eecd5c23c2839f052ecb0be5393fcf22fa554d4c68c1f.xls
-
Size
40KB
-
MD5
7099d2e5ec3d8302c134796858fe3321
-
SHA1
60a98aded1a95f11b40a614295906a4ae429bdb5
-
SHA256
9cb4641d9d261f888d9eecd5c23c2839f052ecb0be5393fcf22fa554d4c68c1f
-
SHA512
7dc58f7ac4068485cbc5ed730df828f9fddfbd38ddef9f153cdce5e7da9ea4dcc057945930d883d8df7fceb2050f969e3aab4d6b6e18938a16e33c6099b1156c
-
SSDEEP
768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgACCBn9kC+xbwcZfqG9tMvcVi1lc:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dk
Malware Config
Extracted
http://easiercommunications.com/wp-content/w/
http://dulichdichvu.net/libraries/QhtrjCZymLp5EbqOdpKk/
https://www.whow.fr/wp-includes/H54Fgj0tG/
http://genccagdas.com.tr/assets/TTHOm833iNn3BxT/
http://heaventechnologies.com.pk/apitest/xdeAU0rx26LT9I/
http://goonboy.com/goonie/bSFz7Av/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9cb4641d9d261f888d9eecd5c23c2839f052ecb0be5393fcf22fa554d4c68c1f.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe ..\wurod.ocx2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD562bf2f1388355d75e86f581fef0c23fd
SHA150921ab4cc2027e387669e05957753c34e366441
SHA25633b72cd4c39c792e09dfc61dd90e0290bfb09b9f6d170d7accf51c87b297e259
SHA512d1acbfbefa3238aa8f88d63d8431109a8e4248d07b7a27fae6ff5042045d6324ead61e78a902bfed7ef4a7c1605233aa9635d27b511b1ce5876413d56cee402d
-
Filesize
7KB
MD5797e94343f2bd6d4cdea65cc8b1fdf00
SHA1ad3aa4de0584f6e92e2cf571bc02eb4a8138ba66
SHA256168c6189f01359d4d46c94a1681c214403f530d0c6d643154bc530b5e947407e
SHA51292302d8b4e0c1ec95efafaf33c0e3248a4a071284691cf9b3d96d6f380ed668798cfda620a7389a76c9f1df07c25dd53d32cc26623f27f176f03f8b4eb8498d3
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB