Analysis
-
max time kernel
133s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 21:15
General
-
Target
ac6e3aaa1362c0d90a2f8579ece2bb2f8c3ed2cedef0a86bee2be24d1326944c.xls
-
Size
45KB
-
MD5
22f178981be291f958252d6cb08e2114
-
SHA1
6dea36cf90c21d32bffd6c050abba896f3e87f7f
-
SHA256
ac6e3aaa1362c0d90a2f8579ece2bb2f8c3ed2cedef0a86bee2be24d1326944c
-
SHA512
e7b4ca1570ae8021b0d2957328ca3969c81127200daa0b69ff6d58e7f8ead5bacd38672bcbf7fb635bc3857660a754016864af9d1c2ea4f58b76e76ef4f12822
-
SSDEEP
768:bkPKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAPVdtWgojJcFDqCRt6vuVUeJlZ:bsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dB
Malware Config
Extracted
https://fpd.cl/cgi-bin/83E0xgTMc/
https://el-energiaki.gr/wp-content/plugins/really-simple-ssl/testssl/serverport443/WUV5PJA/
https://www.manchesterslt.co.uk/a-to-z-of-slt/Ntrci3Ry/
http://contactworks.nl/layouts/fFxKZabh/
http://baykusoglu.com.tr/wp-admin/Y3sRBcOfZ34wg2sO/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ac6e3aaa1362c0d90a2f8579ece2bb2f8c3ed2cedef0a86bee2be24d1326944c.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe ..\xdwno.ocx2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c4a9cccd77d78e7d68fb85074b51b3a1
SHA14707369b0adf1c7dd645509556fc55cd03470d8a
SHA256447938066fba522669cfef6028636508372576d6b6c426710999b7f57972f902
SHA512a48be713e7767d539c607ea58a4446c941a9220930267764cafaf7591e8dd4f7a38cc87620b1d656b7c03c4da62842eafddc17019cdc28ec3c6f00dcc259873b
-
Filesize
25KB
MD58cd3c109905ddb9afe61a50b08309b04
SHA1e102c758a1df661078e4f94daa92547aeb438126
SHA256f531beb78f404dce76f46154b9a79744d3b6341f30cc42edd2b83ab69c154d20
SHA5129720ca0830540ea301f907568e6607d32766b95a08e2589f9d27c4cecaba78b044c19bfbfa755614da715a7bb7586836d8453c34f2852f5222584fb61be80b57
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB