Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 20:47
General
-
Target
3f0a8e5d62e1e1f12e9fb8159660f3637509a35382a273ce922156ce967de9fb.xlsm
-
Size
40KB
-
MD5
bb8a64c65853a170d6aabfc1ecf6d52d
-
SHA1
12acb33f348bbc9e7f62bcd7e0251e167d16c777
-
SHA256
3f0a8e5d62e1e1f12e9fb8159660f3637509a35382a273ce922156ce967de9fb
-
SHA512
6ff7557e107e2bd6a2053e7d2964cb4df1ea33a7f95fe742e299ab7d4022703ecee7adc3765248233d00580459789165558de7fb79991787578b815c2dd2956c
-
SSDEEP
768:Tomihd8DOevZCwt79yKfcrND59V+L9Rw4eWrXcTqZ0VfEw/5:Tom8eDNylND59V4jwmXc2CVfEA
Malware Config
Extracted
http://updatesgarmin.com/c/X5oK7bz/
https://drsniffles.com/OldBackup/2gc7uoHraTd/
https://leblogducbd.com/wp-includes/h5WdaXow/
https://ipekozmel.net/wp-content/hiwPw9KvUFV2jKZc/
https://yassinezeroual.com/imsi-hilo/DufS8rvZ/
https://anjumaneshiateali.org/e5qty/Cngg0NcOM/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\3f0a8e5d62e1e1f12e9fb8159660f3637509a35382a273ce922156ce967de9fb.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD55cd333d3c87142b6746cd4e0b6914410
SHA1c07ea872d2b9b2dfc85e49092d778e6f87dc7a60
SHA256e20b795ba886ce2396329fb3f41ca061ddfaaf8714dce1a565f9dba0e2ff5b1d
SHA512903060ca510245df2cabb4e46da66a51f3a97bb15ae8ffda1aed855b0ee7d70a7055b41aeef1a3e8ee5bd41808924df6ca759f65bc1cbe5679a9b37383f087d7
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB