Analysis

  • max time kernel
    134s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2024 21:05

General

  • Target

    48315b0e07f3a7c0f1119c543b499f97d49ffaa838a3d3e32de8fc3a16852c49.xlsm

  • Size

    95KB

  • MD5

    797d8843fb9328d3cab7ac0f2219d784

  • SHA1

    f6a41102de25523dcba0d5215040fbaa499ccc5c

  • SHA256

    48315b0e07f3a7c0f1119c543b499f97d49ffaa838a3d3e32de8fc3a16852c49

  • SHA512

    79d1516202e86794760902ea01ea9dc57209e1cb4a0b44ba8fccf781a63c2ff57f4a1a975013c6769d3daa8a03d01fa90358238660f0ce0ac2dc999793ceb424

  • SSDEEP

    1536:Z+nXm5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVZF:Z43DsVhonV69o2bchgGaWBcpASF

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://gavalisangh.astravit.com/umar-rack/fyMw4DZw1JAB/

xlm40.dropper

http://spanish.swslawfirm.com/wp-admin/llSlMYOLL/

xlm40.dropper

https://wowssipworld.com/wp-snapshots/7EzFXGUC3p0ffli/

xlm40.dropper

https://lucacerullo.com/wp-admin/sZ7Sw/

xlm40.dropper

http://198.50.143.158/cgi-bin/PsABe8gznY/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\48315b0e07f3a7c0f1119c543b499f97d49ffaa838a3d3e32de8fc3a16852c49.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Windows\SysWow64\regsvr32.exe
      C:\Windows\SysWow64\regsvr32.exe /s ..\wo1.ocx
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      PID:4876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    e4865248699e693cc66a3485ba752f56

    SHA1

    74811ce8523861d66fa5b975e951df80520e02ba

    SHA256

    794635cd300c2b694cc2dec003bc36a5fb5c7442c8f1089f31631fa7cadd5f65

    SHA512

    502487fe5c820ff078de0a64cb20d04a1ed74582d551de9d06650689f309c2657ded3e7e70d123fb70da53b48774fd154825772d69b3d24cc45b8e5b96ec1e87

  • C:\Users\Admin\wo1.ocx

    Filesize

    74KB

    MD5

    903492f463ccf48fd018817dbf20d61a

    SHA1

    21cec7743daa8c4059b0d2c7c85da5c984ca9316

    SHA256

    029d77aa3dc2247f58e3fbcccf6d44903972ab84920c1ddecf242c8afe9f589e

    SHA512

    f5fff7e7722a6b7bcc6272f48681c992cfaa2638b7f6c9237acb32e29362419e9accb49f61ffcc2855d4e59f7414dfb386d4ff67949b2fc751bd5931e7520339

  • memory/2356-20-0x00007FF820E90000-0x00007FF821085000-memory.dmp

    Filesize

    2.0MB

  • memory/2356-5-0x00007FF820E90000-0x00007FF821085000-memory.dmp

    Filesize

    2.0MB

  • memory/2356-18-0x00007FF7DEA90000-0x00007FF7DEAA0000-memory.dmp

    Filesize

    64KB

  • memory/2356-6-0x00007FF7E0F10000-0x00007FF7E0F20000-memory.dmp

    Filesize

    64KB

  • memory/2356-17-0x00007FF820E90000-0x00007FF821085000-memory.dmp

    Filesize

    2.0MB

  • memory/2356-7-0x00007FF820E90000-0x00007FF821085000-memory.dmp

    Filesize

    2.0MB

  • memory/2356-10-0x00007FF820E90000-0x00007FF821085000-memory.dmp

    Filesize

    2.0MB

  • memory/2356-16-0x00007FF820E90000-0x00007FF821085000-memory.dmp

    Filesize

    2.0MB

  • memory/2356-11-0x00007FF820E90000-0x00007FF821085000-memory.dmp

    Filesize

    2.0MB

  • memory/2356-15-0x00007FF820E90000-0x00007FF821085000-memory.dmp

    Filesize

    2.0MB

  • memory/2356-0-0x00007FF7E0F10000-0x00007FF7E0F20000-memory.dmp

    Filesize

    64KB

  • memory/2356-19-0x00007FF820E90000-0x00007FF821085000-memory.dmp

    Filesize

    2.0MB

  • memory/2356-4-0x00007FF7E0F10000-0x00007FF7E0F20000-memory.dmp

    Filesize

    64KB

  • memory/2356-2-0x00007FF7E0F10000-0x00007FF7E0F20000-memory.dmp

    Filesize

    64KB

  • memory/2356-12-0x00007FF820E90000-0x00007FF821085000-memory.dmp

    Filesize

    2.0MB

  • memory/2356-14-0x00007FF820E90000-0x00007FF821085000-memory.dmp

    Filesize

    2.0MB

  • memory/2356-13-0x00007FF820E90000-0x00007FF821085000-memory.dmp

    Filesize

    2.0MB

  • memory/2356-9-0x00007FF820E90000-0x00007FF821085000-memory.dmp

    Filesize

    2.0MB

  • memory/2356-8-0x00007FF820E90000-0x00007FF821085000-memory.dmp

    Filesize

    2.0MB

  • memory/2356-21-0x00007FF7DEA90000-0x00007FF7DEAA0000-memory.dmp

    Filesize

    64KB

  • memory/2356-3-0x00007FF7E0F10000-0x00007FF7E0F20000-memory.dmp

    Filesize

    64KB

  • memory/2356-46-0x00007FF820E90000-0x00007FF821085000-memory.dmp

    Filesize

    2.0MB

  • memory/2356-47-0x00007FF820F2D000-0x00007FF820F2E000-memory.dmp

    Filesize

    4KB

  • memory/2356-48-0x00007FF820E90000-0x00007FF821085000-memory.dmp

    Filesize

    2.0MB

  • memory/2356-1-0x00007FF820F2D000-0x00007FF820F2E000-memory.dmp

    Filesize

    4KB