Analysis
-
max time kernel
133s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 20:37
General
-
Target
a0c1193974c2f9f31dcf33f381fe61c3ed6593807d89cdcda18bde093f385505.xlsm
-
Size
20KB
-
MD5
581493ba1e164329959471c71d4eb877
-
SHA1
8923214be0f945e8812bbff887f40a200de8a42e
-
SHA256
a0c1193974c2f9f31dcf33f381fe61c3ed6593807d89cdcda18bde093f385505
-
SHA512
75b898b8527fe70f95134d5ab65ecdbbb7acf328c270553d01c2698613b00ce8217970f4946997c7d7f668845e1d1db03fe7f0d36576e04acbbcbe0071b09ec4
-
SSDEEP
384:DA2Y5Vb1GNj20o4CGzPd6ZIwLJKb5CzgObff9kC+xbX7k7aU2d:E2EINro4FLAOCBn9kC+xbLkWf
Malware Config
Extracted
http://bctconsulting.se/HelenaWEB/Xf1rQukg8HjfItb9x/
https://binaghetta.it/wp-content/gdONbcsI6Q9/
http://bnbengineering.com.pk/cgi-bin/6n8q1OFBzyGyPSJ/
http://bytesenbits.nl/cgi-bin/OjOn8icwhyf22SzegYA/
http://bioscan.ch/backup_nov05/n6S3o4q9dG8050/
http://abildgren.dk/webmail/XY8XstOvGiLx/
http://grworld.com.tr/fonts/TPxLPt9Us5ALpvY/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\a0c1193974c2f9f31dcf33f381fe61c3ed6593807d89cdcda18bde093f385505.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5629cdf6f40631bd96db4bf23014652c4
SHA1ae54bda589102991321292372e4f606800b4c327
SHA25635766fb6da896394dba233127e2a9f90286c6d7228311933ceb1a2864a41e73e
SHA5122b3db066198380e20779152226d5fc2b5798e9035817e69cc75b486efbb404a68a7bbed5329b31c29e4885e8ecb2c2493481d20bea2ed4ef066f7aafb4fab70f
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB