Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 20:46
General
-
Target
29dca541012fbc9bfb87f0ecca2d449dd4e87688acee6d491a18fd2c94cb55df.xls
-
Size
50KB
-
MD5
ef57c2af40933debcc72ac951bfc1f02
-
SHA1
75c127c8b468044ea9c63e3e2ef743350b9f6638
-
SHA256
29dca541012fbc9bfb87f0ecca2d449dd4e87688acee6d491a18fd2c94cb55df
-
SHA512
180e76cc2442ea2d2133728518a153e84475c60320add1a5328c339a30c609beee57e4e777c7d388a28e1c046ec5c763b6868f50b8e1e796d77f9660835e1d7a
-
SSDEEP
1536:8RKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+E43SaU3hz/:KKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMX
Malware Config
Extracted
https://bvirtual.com/affinita/ryXUZdAHcNNEG/
https://bulldogironworksllc.com/temp/32930RoofbdmQ0r/
https://www.almoeqatar.com/cgi-bin/qoOYPhlkRGnBClmNu5I/
https://bosny.com/aspnet_client/UZlstV/
http://mulmatdol.com/adm/Semrx6pQ/
http://escgayrimenkul.com/cgi-bin/RuqpDmm/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\29dca541012fbc9bfb87f0ecca2d449dd4e87688acee6d491a18fd2c94cb55df.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5cd607bb9e3aaab4faad59a489cf7edb6
SHA1d43b5b00fa8017d29a7a6c70475425604f00fe91
SHA256fd19089286da8a886adc7cf6f135557835bc343f41175964761b1b67506ff43e
SHA5122eb749cab0a6d86dc1dc5d2b861fc169ba9694ca602cab20e8a85cd2aef289b24285a33beb9dcaec5f74e799a79d8c45bdd65cff0a517b9d92e490b3011058f2
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB