Overview

overview

10

Static

static

10

201417f7cb...b.xlsm

windows7-x64

10

201417f7cb...b.xlsm

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    20-11-2024 18:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    201417f7cbaa4eaacac2c74854ea2b5a7e683ca636e499bd6cb4895d198176db.xlsm

  • Size

    74KB

  • MD5

    7f83c0b2ef2a5dc0300d7eec9b986ddc

  • SHA1

    d6be7205d8e582a8f91d49979a49f9344bb24c0f

  • SHA256

    201417f7cbaa4eaacac2c74854ea2b5a7e683ca636e499bd6cb4895d198176db

  • SHA512

    4835a09656a0498765dd9cfd9e7c9fbbf926495fc6e1ba69106d12739f725f1442aa18619b86f612e1791dcc2c65eb6ef6c68d15799111d598ea3e07811e5d66

  • SSDEEP

    1536:4qSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzB3g:43tzSmICpH7OZuvZGsMl

Score
10/10
discovery

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://part-co.org/wp-admin/u4NPmsvZ3EWBa8tYlZv/
xlm40.dropper

https://protokol.mx/Archivos/HgTqbLkgrgLAvunV/
xlm40.dropper

http://letea.eu/wp-content/CgaqeucmpVT2NEK/
xlm40.dropper

http://ponizinny.nl/wp-admin/KdLO9n/
xlm40.dropper

http://sport-foto.nu/wp-content/Jqf9mfIPcA/
xlm40.dropper

http://www.citybridgesc.at/Ergebnisse/K7mPH42tTl7slZgWH/
xlm40.dropper

http://life.lst.dx.am/img/WNIWv/

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\201417f7cbaa4eaacac2c74854ea2b5a7e683ca636e499bd6cb4895d198176db.xlsm
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2004

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2004-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2004-1-0x0000000072C3D000-0x0000000072C48000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2004-19-0x0000000072C3D000-0x0000000072C48000-memory.dmp

    Filesize

    44KB

    Download