Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 17:25
General
-
Target
1b64a4758ea343a9bf2f15289202813cf3f37ff3a82cad2f9988a22baf2c605d.xls
-
Size
40KB
-
MD5
1fce97e7cd1ec66da1205bd31d5e1bd1
-
SHA1
320294037573cf2bbfcec783b02069dc1b219ae2
-
SHA256
1b64a4758ea343a9bf2f15289202813cf3f37ff3a82cad2f9988a22baf2c605d
-
SHA512
56e8b95232de24593964d874f9312de6809f1483aabbab05e988bc4dbe1c8b3326960d0f6e57ebda0336c651c906157939a1447aa299c3218f95d96eedc5f1dd
-
SSDEEP
768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgACCBn9kC+xbwcZfqG9tMvcVi1lA:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/do
Malware Config
Extracted
http://easiercommunications.com/wp-content/w/
http://dulichdichvu.net/libraries/QhtrjCZymLp5EbqOdpKk/
https://www.whow.fr/wp-includes/H54Fgj0tG/
http://genccagdas.com.tr/assets/TTHOm833iNn3BxT/
http://heaventechnologies.com.pk/apitest/xdeAU0rx26LT9I/
http://goonboy.com/goonie/bSFz7Av/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1b64a4758ea343a9bf2f15289202813cf3f37ff3a82cad2f9988a22baf2c605d.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe ..\wurod.ocx2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD539142fa48fad349a9450d95550204415
SHA1602888cbbe6511a0eb7db8fe75e13bd934fd389d
SHA25677e4dd1f30fe9c9db98714add31b240253605330e2d7767791f2389a4cb9b7cf
SHA512c65aeca06269dc8bb5ab2a0e360bdde0a973c7f89c8f32773ebeedbe1cef4dc633c0bf028c363ec095392dfd32de5b696574a75870da8cd4a63e08587adac163
-
Filesize
7KB
MD5797e94343f2bd6d4cdea65cc8b1fdf00
SHA1ad3aa4de0584f6e92e2cf571bc02eb4a8138ba66
SHA256168c6189f01359d4d46c94a1681c214403f530d0c6d643154bc530b5e947407e
SHA51292302d8b4e0c1ec95efafaf33c0e3248a4a071284691cf9b3d96d6f380ed668798cfda620a7389a76c9f1df07c25dd53d32cc26623f27f176f03f8b4eb8498d3
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB