Analysis
-
max time kernel
134s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 21:05
Behavioral task
behavioral1
Sample
48315b0e07f3a7c0f1119c543b499f97d49ffaa838a3d3e32de8fc3a16852c49.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
48315b0e07f3a7c0f1119c543b499f97d49ffaa838a3d3e32de8fc3a16852c49.xlsm
Resource
win10v2004-20241007-en
General
-
Target
48315b0e07f3a7c0f1119c543b499f97d49ffaa838a3d3e32de8fc3a16852c49.xlsm
-
Size
95KB
-
MD5
797d8843fb9328d3cab7ac0f2219d784
-
SHA1
f6a41102de25523dcba0d5215040fbaa499ccc5c
-
SHA256
48315b0e07f3a7c0f1119c543b499f97d49ffaa838a3d3e32de8fc3a16852c49
-
SHA512
79d1516202e86794760902ea01ea9dc57209e1cb4a0b44ba8fccf781a63c2ff57f4a1a975013c6769d3daa8a03d01fa90358238660f0ce0ac2dc999793ceb424
-
SSDEEP
1536:Z+nXm5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVZF:Z43DsVhonV69o2bchgGaWBcpASF
Malware Config
Extracted
http://gavalisangh.astravit.com/umar-rack/fyMw4DZw1JAB/
http://spanish.swslawfirm.com/wp-admin/llSlMYOLL/
https://wowssipworld.com/wp-snapshots/7EzFXGUC3p0ffli/
https://lucacerullo.com/wp-admin/sZ7Sw/
http://198.50.143.158/cgi-bin/PsABe8gznY/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4876 2356 regsvr32.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2356 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2356 EXCEL.EXE 2356 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2356 EXCEL.EXE 2356 EXCEL.EXE 2356 EXCEL.EXE 2356 EXCEL.EXE 2356 EXCEL.EXE 2356 EXCEL.EXE 2356 EXCEL.EXE 2356 EXCEL.EXE 2356 EXCEL.EXE 2356 EXCEL.EXE 2356 EXCEL.EXE 2356 EXCEL.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2356 wrote to memory of 4876 2356 EXCEL.EXE 87 PID 2356 wrote to memory of 4876 2356 EXCEL.EXE 87 PID 2356 wrote to memory of 4876 2356 EXCEL.EXE 87
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\48315b0e07f3a7c0f1119c543b499f97d49ffaa838a3d3e32de8fc3a16852c49.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe /s ..\wo1.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:4876
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD5e4865248699e693cc66a3485ba752f56
SHA174811ce8523861d66fa5b975e951df80520e02ba
SHA256794635cd300c2b694cc2dec003bc36a5fb5c7442c8f1089f31631fa7cadd5f65
SHA512502487fe5c820ff078de0a64cb20d04a1ed74582d551de9d06650689f309c2657ded3e7e70d123fb70da53b48774fd154825772d69b3d24cc45b8e5b96ec1e87
-
Filesize
74KB
MD5903492f463ccf48fd018817dbf20d61a
SHA121cec7743daa8c4059b0d2c7c85da5c984ca9316
SHA256029d77aa3dc2247f58e3fbcccf6d44903972ab84920c1ddecf242c8afe9f589e
SHA512f5fff7e7722a6b7bcc6272f48681c992cfaa2638b7f6c9237acb32e29362419e9accb49f61ffcc2855d4e59f7414dfb386d4ff67949b2fc751bd5931e7520339