Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 21:01
General
-
Target
e8b739f3f116d4c924ce38426f34e4ebaaee8722298f4508979d2a1840c663cf.xlsm
-
Size
49KB
-
MD5
0cafedcb1220f5c1ed133535ceeb84b2
-
SHA1
9a0b7c82472a24be402d9eef1d41c324f64d651d
-
SHA256
e8b739f3f116d4c924ce38426f34e4ebaaee8722298f4508979d2a1840c663cf
-
SHA512
4754cc7a4c7bf5ecc6ed50a80605ac4c18f659f944607676385549bb5748eae93221e041d693d7f132873f31fe2e37e58ccb6786c8d4bc074347f94128614493
-
SSDEEP
768:WYCKEWvxLh0lSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KA05lAMIB:WYu2xXncDSmSIBlGeuSEcm2h0B5lqB
Malware Config
Extracted
http://retailhpsinterview.com/search/yNbsL/
http://www.agretto.com/Template/pnM0iPs4b2IfR7XY7v/
http://www.agnesleung.com/raw.backup/p8D6ttXDaNwd/
http://xnxx.c1.biz/images/iJNVpahOW4CBuidDD66/
https://pakistannakliye.com/Dodonian/tSasxFCiQXxh5Qvin/
https://gsmjordan.com/SupplierPanel/XII/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e8b739f3f116d4c924ce38426f34e4ebaaee8722298f4508979d2a1840c663cf.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\ax.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD55b5f35bfcb4c7d7e251a196d347e6912
SHA1f7b6ac859aef010aebc0432e537033f0e68f46b2
SHA256efd0a3783805966d76accc8c1a3677167b9fc04f7acd537e1e608985e436da8d
SHA5129961984e8514c43f3952a3bae71970ff74437bef70a19fa3fe79f7873548aad9307e873c35570d881a46fba2e434f6d31fed9b2abf45671591b12449014ee0bf
-
Filesize
802B
MD5583cb8cac58c7c55c1e250f9ab286d52
SHA15e91029ac4c1f7ab7fc5a8a00b14c30f785ee562
SHA256e2d4d6591f4ceeb810f8fcff3b4bf2a39470b8d079dda76089c1f369e877f0f4
SHA512dfae2abca729ab8d4f3162dcd96c611cdcc2d41f07370cb21964f2e360f929eebaf21919d582e590076d9dfa8eb59e70dddd7781ebc681814d66757b072f008e
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB