Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 20:47
General
-
Target
1b5a2dceba683eda2ca19ac0a20e974a0b745e710577f00caeec53e0a78330c4.xlsm
-
Size
73KB
-
MD5
df4647eb940cc66b12b3a665d9e7239a
-
SHA1
ad72fb82d34defb618d3518cec77291117a3392a
-
SHA256
1b5a2dceba683eda2ca19ac0a20e974a0b745e710577f00caeec53e0a78330c4
-
SHA512
6defeca863fda7e665cd9cb162c9a0e66c3cf36f0702ed022e85ff10e6deb5ffc2043f53b3383c7c0df9a3d455cdda696211fb5199ca343dab1f7ed33a879255
-
SSDEEP
1536:W41yiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV4XG:d1yiCtzSmICpH7OZuvZGsMX
Malware Config
Extracted
https://appleinfoway.com/venv/5Pp/
http://www.atelierkikala.com/Facebook/vXY2sLFfbSSCTh/
http://astrogurusunilbarmola.com/css/ucDJnRTACskNjrZOHr/
http://atters.net/cgi-bin/0yIPlpXo3156/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1b5a2dceba683eda2ca19ac0a20e974a0b745e710577f00caeec53e0a78330c4.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50d7b15fad9bc6a7342aa16bff7c5661d
SHA109a3ee6cee9b735f5562fad4a69354b12326e394
SHA256db2059fc51f626431f2524d35fb7c65ccdd3f4fc723b760ea1c97f88498edf7a
SHA5124092fc7d445c0d0ebef752a984536cca357add6ae11b9aac5d61143f0e36060932aef2b69536a20f35a5a09d795672dcde3e51f7cce56dc151c949bb38580773
-
Filesize
91B
MD513602a959153b8c9b4600e17dc98ebdb
SHA11ac6cd8cd54a7d9a013e7f92be645b275a75243b
SHA2567b5dcf39a3facf8ee0b21a1738d6b652b67768e3321aa848f2d1a5b9f80458c2
SHA512e9bdf50715f9caf53644f3bf4d40e7e31620f00df1e462a9f9c9885f056cdd442cc178c1b5f9f12e5c541199e1e4ca9e06048a9c03413a77276f6ab43b46d923
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB