Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 21:21
General
-
Target
d2c05d3ecc78976f4cbde830b995e9763f9e64c13dbd79db7546ccb72b8db78b.xlsm
-
Size
49KB
-
MD5
2416fe2df23daf5475973631c5d75b9a
-
SHA1
e54f4fe4de5e14d1d962d8a17da4f031205d2e4e
-
SHA256
d2c05d3ecc78976f4cbde830b995e9763f9e64c13dbd79db7546ccb72b8db78b
-
SHA512
60c0a884554ea79728e03af544ada215daa63bd8da3228751ab9c6622e32b72626aeb2b82e3275f5df95ec283cd5649a158432176c01177ef6e613933323b054
-
SSDEEP
768:SYCKEWvxLh0lSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KA05lAMIB:SYu2xXncDSmSIBlGeuSEcm2h0B5lqB
Malware Config
Extracted
http://retailhpsinterview.com/search/yNbsL/
http://www.agretto.com/Template/pnM0iPs4b2IfR7XY7v/
http://www.agnesleung.com/raw.backup/p8D6ttXDaNwd/
http://xnxx.c1.biz/images/iJNVpahOW4CBuidDD66/
https://pakistannakliye.com/Dodonian/tSasxFCiQXxh5Qvin/
https://gsmjordan.com/SupplierPanel/XII/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d2c05d3ecc78976f4cbde830b995e9763f9e64c13dbd79db7546ccb72b8db78b.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\ax.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e6a006cb115e701975ca9b521be7c891
SHA17559e9c4e39c901d4b7a8b84ab5ca381d4a71493
SHA256bf650e8a87b49b8f286c9d3e691b1656eec1cebfcfef447bcd1b2b0dd2434bf9
SHA5125ab8d7f62ce01b80dcd99bccc4dfe9aaa2b432878eca436d4f01c3bd12a341fceabbbfd6fae7d26b7ff95c99d8cb0c961c72bf907843738545baa3b9bcde908d
-
Filesize
802B
MD5583cb8cac58c7c55c1e250f9ab286d52
SHA15e91029ac4c1f7ab7fc5a8a00b14c30f785ee562
SHA256e2d4d6591f4ceeb810f8fcff3b4bf2a39470b8d079dda76089c1f369e877f0f4
SHA512dfae2abca729ab8d4f3162dcd96c611cdcc2d41f07370cb21964f2e360f929eebaf21919d582e590076d9dfa8eb59e70dddd7781ebc681814d66757b072f008e
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB