Analysis
-
max time kernel
133s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 20:42
General
-
Target
f9790c9151deb69c4936c7798e925fc91f5cb689d8385c86327cd0052992cff6.xlsm
-
Size
50KB
-
MD5
6e496339047173b963306043f0ddbfd2
-
SHA1
dad3926704ec038c55d86c98c4ee3c3fb1aa6d2f
-
SHA256
f9790c9151deb69c4936c7798e925fc91f5cb689d8385c86327cd0052992cff6
-
SHA512
f3c8448063aad7ec026240d2c90f3ec502cca00cba02b346c1010c809d6c3b566664fc19c09948d0fc95e2c11cb3be04735d408bfac19eec70c5152fb80a50ac
-
SSDEEP
768:nx9D9onsXslSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KA0P4F:nXD9okncDSmSIBlGeuSEcm2h0BPu
Malware Config
Extracted
http://centrobilinguelospinos.com/wp-admin/VrgzWT/
http://boardingschoolsoftware.com/backup/CtMR5Yi/
http://bsa.iain-jember.ac.id/asset/x0hMwOPVpkQSNoS8WCN/
http://ctha.uy/cgi-bin/zGhvZLq6kSV1L1Vi/
https://descontador.com.br/css/q5nrG6ua/
http://letea.eu/wp-content/3GgF4miFZTq9/
http://quoctoan.c1.biz/wp-admin/j8Zu/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\f9790c9151deb69c4936c7798e925fc91f5cb689d8385c86327cd0052992cff6.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5b024094dd9c0a191b31bc05a51ac33f2
SHA10c9ea9e7572f940b70d386884ef0069c4ce16910
SHA25655ff3300f88f126b5f7e97fb6f1fa404935fcf1fb352b61b865f223f4aa97a3a
SHA512ae98a8a585db3c3b5c79f175eb7de0c883a39cd9c647c5f9ff36e320bca26f29f0ec7a44ceb07ce109131faf71afb89bfe4f28b3108be3d30fd224e9365cd50c
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB