Analysis
-
max time kernel
133s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 20:43
Behavioral task
behavioral1
Sample
405e23b66e28cfd2085e9612437a0d55de4321f9aea69abba7478181b1720bbf.xlsm
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
405e23b66e28cfd2085e9612437a0d55de4321f9aea69abba7478181b1720bbf.xlsm
Resource
win10v2004-20241007-en
General
-
Target
405e23b66e28cfd2085e9612437a0d55de4321f9aea69abba7478181b1720bbf.xlsm
-
Size
74KB
-
MD5
b1741588177a87f24cad49ac1b1d53d6
-
SHA1
b0a4c819282651438cbda27b74b394faac6774b6
-
SHA256
405e23b66e28cfd2085e9612437a0d55de4321f9aea69abba7478181b1720bbf
-
SHA512
d255f6e92ffd8655b9ddd887ba9543cb00302d439f3c39e8a3169d14b1e47b824e99cc506f51f190e3a52393de356108c4e4888d4ffcde3c204f9c8c2a6a17a2
-
SSDEEP
1536:SuSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:stzSmICpH7OZuvZGsMo
Malware Config
Extracted
https://thesparklezbox.com/wp-admin/kFkWN/
https://herbtytox.com/wp-admin/dq/
http://www.asyadegirmen.com/Template/nEMRY55nQgF/
https://westthamesphysio.com/blog/D8AAkEyZ7u/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1936 3964 regsvr32.exe EXCEL.EXE -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
regsvr32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3964 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 3964 EXCEL.EXE 3964 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 3964 wrote to memory of 1936 3964 EXCEL.EXE regsvr32.exe PID 3964 wrote to memory of 1936 3964 EXCEL.EXE regsvr32.exe PID 3964 wrote to memory of 1936 3964 EXCEL.EXE regsvr32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\405e23b66e28cfd2085e9612437a0d55de4321f9aea69abba7478181b1720bbf.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\rds.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:1936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize2KB
MD5eab99fd641229b83a414b6eaa8d1371e
SHA121fe9c169385130d4985f01750363098901ed716
SHA256a85ffa79aa9522f274112c35db9ffb3325029160411152b82d147486ad58cbf7
SHA512e76d222605b46278179856f6a264eb92c9aa6ec4346aad94224935744351c94dd697bbfa301ddfc392db58ff470e913389c9db30c4a7158ac22c318bf78c4370
-
Filesize
966B
MD51a8978d9d37041fe0089728cd6c23233
SHA1f0485019f25ee50bb77f23081a8964e28e56cfb2
SHA25687a97454942b85b5afc9cb9733bb7ce96cdf3422f6bfc95823f8edf6b2e2c607
SHA5129ea43ede1eab73d3ac65bc3e9c13836c51d768daf5e300a0f57a26c0ca9cb2655455e5731664a92c969520dc05f7c71292d6a947405e06c2b1f88a399cd8d42b