Analysis
-
max time kernel
133s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 18:57
General
-
Target
7abce88c1258a0c723fdffaf8135fdf00a78221df95978187de5fb567af627c5.xlsm
-
Size
35KB
-
MD5
79e7c9ec84e0533f680b0e1c4dd83af1
-
SHA1
75ef704c542fa1e2f790fbe7cb6e32fe6efef8ef
-
SHA256
7abce88c1258a0c723fdffaf8135fdf00a78221df95978187de5fb567af627c5
-
SHA512
258f9f6e02658a6188d0f9659889fe7ac5c5bbe75a8142e75b6a33cbbb8041ab775be6e96e02ee79bcdd197c67f026eb7dd9728bf51523a74e60e7cc4a74b29b
-
SSDEEP
768:CFtT5eBvAjOZpqcVbZYpoRuBlIiOKMArOoooooooooooooooooooooooooo0+6:ytTghUOZZ1ZYpoQ/pMAz
Malware Config
Extracted
https://freebingpops.com/cgi-bin/DmVp7VBVEpHssN/
https://www.kinfri.com/licenses/3fKSJkZXZ3JH6dXWU/
https://globaltextiles.net/cgi-bin/7naWzYGRrrN/
https://cartoriogasparin.com.br/rosesq/gOfN6jvyRme/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7abce88c1258a0c723fdffaf8135fdf00a78221df95978187de5fb567af627c5.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD54b2374bea8f66c6e9eaa1f9679124fa2
SHA13030f097a938283fb681544c12bc6bc6d3a923f5
SHA2566ee16dbf80e184702e22c7b96af4e0f71d82c7a25a236eec82697767d8af8df5
SHA512bd979405733b3a7b1f24fe14e2d9ba575f6d66906c706af5ebe9e9eea498562a92ba2e472f1ab3120e43d17af433028b421bc97c8c309bc9b9ca823a61506d8c
-
Filesize
45KB
MD55d6c18308546abe59a9b54dc3c024e2a
SHA193d6e35531db29afe807054826d68feea63fd966
SHA25670f7307f2ce7ca23f901efb9a55626b6543742d98e473b46d0ff8fefaa21bc00
SHA512848c5b17b180cdce74ec8511b8dd0011994db1298411a04a96440ed9f04f18ff1fba648e5b377b72fbc8cf9214816552ee2595ee5343403d4676f0ab76b26c34
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB