Analysis

  • max time kernel
    133s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2024 19:50

General

  • Target

    2fe72a79e674e35de504e4d960568938f9b5424d2df8f1c33eadec3ab194462c.xls

  • Size

    53KB

  • MD5

    1a366af73ac6c993064396714277f6e8

  • SHA1

    e6628fb59e55fcd8edc8a484b3d528ce21546ec5

  • SHA256

    2fe72a79e674e35de504e4d960568938f9b5424d2df8f1c33eadec3ab194462c

  • SHA512

    312866aa3b6fbe005f608d1b386b7272157893b45e524e3a7878ec57f9f80d66722d2eeee17c375faeb0697d527ced03466c0c1fcb154c7915f1324aff226ef4

  • SSDEEP

    1536:te2tfQXi8vgLZkTOHkQT51Vp6AwPe8gQ66aOKb:82tfQXi8vgLZkTOHkQT51Vp6AwPe8gQ+

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://gandhitoday.org/video/6JvA8/

xlm40.dropper

https://fpd.cl/cgi-bin/N/

xlm40.dropper

http://djunreal.co.uk/site/ApOKpFad/

xlm40.dropper

http://genccagdas.com.tr/assets/doWHIxLe7e/

xlm40.dropper

http://johnsonsmedia.it/img/ZBNk0xpRL8YEVl/

xlm40.dropper

http://grafischer.ch/fit-well/wDPTwKtZPoWL12/

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2fe72a79e674e35de504e4d960568938f9b5424d2df8f1c33eadec3ab194462c.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:4264

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4264-8-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB

  • memory/4264-12-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB

  • memory/4264-16-0x00007FF950B50000-0x00007FF950B60000-memory.dmp

    Filesize

    64KB

  • memory/4264-19-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB

  • memory/4264-21-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB

  • memory/4264-23-0x00007FF950B50000-0x00007FF950B60000-memory.dmp

    Filesize

    64KB

  • memory/4264-22-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB

  • memory/4264-20-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB

  • memory/4264-18-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB

  • memory/4264-17-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB

  • memory/4264-15-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB

  • memory/4264-14-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB

  • memory/4264-13-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB

  • memory/4264-11-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB

  • memory/4264-10-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB

  • memory/4264-9-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB

  • memory/4264-7-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB

  • memory/4264-6-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

    Filesize

    64KB

  • memory/4264-5-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB

  • memory/4264-4-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

    Filesize

    64KB

  • memory/4264-3-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

    Filesize

    64KB

  • memory/4264-2-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

    Filesize

    64KB

  • memory/4264-1-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

    Filesize

    64KB

  • memory/4264-0-0x00007FF992D0D000-0x00007FF992D0E000-memory.dmp

    Filesize

    4KB

  • memory/4264-39-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB

  • memory/4264-38-0x00007FF992D0D000-0x00007FF992D0E000-memory.dmp

    Filesize

    4KB

  • memory/4264-40-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB

  • memory/4264-41-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

    Filesize

    2.0MB