Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 18:18
General
-
Target
4ea6cbe0e0cd72064350f96c88278e948b5e90d28601e82337a798539ab67098.xlsm
-
Size
50KB
-
MD5
a2583ae6b93f22c2c4b1acbcaf441520
-
SHA1
a244f15473fae8ecf68bfaa7598892453c61d5ae
-
SHA256
4ea6cbe0e0cd72064350f96c88278e948b5e90d28601e82337a798539ab67098
-
SHA512
96560dbc95c45e0d15c9862a03ade72a81e1a7982c1d40cfdd748ea958b87ba489ab876244043687c62dc28a1c812f087e0bb95e7313499fb759a185d330e202
-
SSDEEP
768:Xx9D9onsXslSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KA0P4F:XXD9okncDSmSIBlGeuSEcm2h0BPu
Malware Config
Extracted
http://centrobilinguelospinos.com/wp-admin/VrgzWT/
http://boardingschoolsoftware.com/backup/CtMR5Yi/
http://bsa.iain-jember.ac.id/asset/x0hMwOPVpkQSNoS8WCN/
http://ctha.uy/cgi-bin/zGhvZLq6kSV1L1Vi/
https://descontador.com.br/css/q5nrG6ua/
http://letea.eu/wp-content/3GgF4miFZTq9/
http://quoctoan.c1.biz/wp-admin/j8Zu/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4ea6cbe0e0cd72064350f96c88278e948b5e90d28601e82337a798539ab67098.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5325987dd2975c75fd8d3037eb8b924aa
SHA17733c16e4cfb85b3f2a2fb83a82187fd4b5aa719
SHA256c34279242a4bb62e9e18001fff6c43c7ede0c578fef4227f91afed7086d75be2
SHA512279943a155a39c85915e4c707dd5e737e2ab80cba64667fc21a33a5660618d704e8246efc86f319686ab17730ca8aec73b0c7d9962be901ea49b35b2beb59eae
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB