Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 00:41
General
-
Target
26aff9db2c1eff028cb1bd89235b9ef1b171cec86d6272dc791abb04f75afb42.xls
-
Size
243KB
-
MD5
b4a59bca88d855a885cbc2cbc0e3fd53
-
SHA1
678909ea475580709b65df327e072f599756f544
-
SHA256
26aff9db2c1eff028cb1bd89235b9ef1b171cec86d6272dc791abb04f75afb42
-
SHA512
05f7fe2ab707850c225be7715dd58a355c59bf92cdef1c0a2069c9b6c0445a902851ee58ba95086a53876eedf87583ede26d53b28ae94ff320010387d36f08a8
-
SSDEEP
6144:DKpbdrHYrMue8q7QPX+5xtFEdi8/dg/ThvsiKIjvl5fd1Xh8rsoX/w/0Y:ghEXs5fXR8rsNT
Malware Config
Extracted
http://servidorcarlosydavid.es/wp-admin/jkNPgHxNjF/
https://gmo-sol-p10.heteml.jp/includes/UoJMgYAc1EES/
https://iashanghai.cn/z/Z1PG6ulBh20plss/
https://www.pasionportufuturo.pe/wp-content/HkUfvw0xuCy5/
http://dmdagents.com.au/vqwbgz/CL4Bo4C4VS0deg/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\26aff9db2c1eff028cb1bd89235b9ef1b171cec86d6272dc791abb04f75afb42.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe /s ..\xxw1.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ce12ab48b72d605177431c05fccdba40
SHA19bc9f104c40a919f7225604f49883e7f58ea1873
SHA256cae8c64267da87e219cc0f73d3ec0b710d0f484852cc9ff514e63e548fa80ace
SHA5128b57f03a8853f271ff5b2685f997e50520016c0d56149f0e46cc06615755de46ea5bdc569f252437f91d11c230661742a31f20459776fdae14d122e4044bfc6a
-
Filesize
45KB
MD50cfe08d0b76f6c16d79dffcb527d94bb
SHA160d63b9a567e6d1df9b0527ae21b1cd4c767bd8b
SHA256f3a99f22b32ae07964ad6e46f8ccd537f654da7eaa70ebe162efc85cfc1a332d
SHA51203852181f0944ba7a8fd67b9aa8ef1cb1d947be6f5b774eac2d8a5efaa689a1229918eaa9ae9d9384dfaa40b85c1a1a5d3ee036aec5e41f11012b16d33bb48cb
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB