Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/11/2024, 00:41
Behavioral task
behavioral1
Sample
865a77019eb39474518493a2d0f8499d33cbbdcac68a958f29d0f46b6e041eb4.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
865a77019eb39474518493a2d0f8499d33cbbdcac68a958f29d0f46b6e041eb4.xlsm
Resource
win10v2004-20241007-en
General
-
Target
865a77019eb39474518493a2d0f8499d33cbbdcac68a958f29d0f46b6e041eb4.xlsm
-
Size
40KB
-
MD5
2be5f58cc856cdd101e6c5fa24543a1d
-
SHA1
762a17da15560c510715f5a956fe8118402e927d
-
SHA256
865a77019eb39474518493a2d0f8499d33cbbdcac68a958f29d0f46b6e041eb4
-
SHA512
03da13aa228cc98596cbf5bb50824adc405de503e9b9d2bb80f7baa60c78d961037176fd4838041bd98dc04bf951410f62bbabe0c461e72dcfc06f83a7f339ed
-
SSDEEP
768:itby3nCsqi1O3mnOzyKfcrND59V+L9Rw4eWrXcTqy0y3:abunC5iymqylND59V4jwmXc2Xy3
Malware Config
Extracted
http://foroviviendaparaguay.com/wp-admin/hx8U6XMffnkv8HI2Oig/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2828 2848 regsvr32.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2848 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2848 EXCEL.EXE 2848 EXCEL.EXE 2848 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2828 2848 EXCEL.EXE 32 PID 2848 wrote to memory of 2828 2848 EXCEL.EXE 32 PID 2848 wrote to memory of 2828 2848 EXCEL.EXE 32 PID 2848 wrote to memory of 2828 2848 EXCEL.EXE 32 PID 2848 wrote to memory of 2828 2848 EXCEL.EXE 32 PID 2848 wrote to memory of 2828 2848 EXCEL.EXE 32 PID 2848 wrote to memory of 2828 2848 EXCEL.EXE 32
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\865a77019eb39474518493a2d0f8499d33cbbdcac68a958f29d0f46b6e041eb4.xlsm1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\xda.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5227e7b463cd1fc86edd950e582d38a94
SHA1ca53a756bb71d510cf1d3a0b093e7490d97ea383
SHA2561a0def2412e70e255541e831aa45be10ce962cbf23f5dff79b74510d9c38f5ce
SHA5129e50ef10c27fef866174c6d04d333e0f81464d14b7cbbd13db48efcf57cb267c35086545998a648b061d269b6b5e82464f2963d552f41c950e4f4bceed55f35a