Analysis
-
max time kernel
133s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 00:03
General
-
Target
e5a5957ddd40e78877357645ebb63e9f4f7827b4e4e91b1fd79b19b073547742.xlsm
-
Size
30KB
-
MD5
97311b9cc97478e878fb669702eb27e7
-
SHA1
aa244f5d61de51c575a7324a574a27608342665c
-
SHA256
e5a5957ddd40e78877357645ebb63e9f4f7827b4e4e91b1fd79b19b073547742
-
SHA512
b97e63a72f6f53ff78df794d198c26255c764db6d30af84dc07e719c86495b4572e2396ab862f728c53de7f4e520c63775b3af45d25d8a97b2af2f3721899ce6
-
SSDEEP
384:X842JZPFhNjtOA7icg0SCdiVH2KgUrNU/qWhZOdBNPJM+kqr9eCgh0k5M2E6v:QHFhNZliH2ydFfPdkqstJhE6v
Malware Config
Extracted
http://henrysfreshroast.com/6cc4ts0bkrOlXq/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e5a5957ddd40e78877357645ebb63e9f4f7827b4e4e91b1fd79b19b073547742.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5be76b95eb0502c62e9f53ff3fcc3887f
SHA1eff2c8e5d75eb70486d621118d8667aa0bfbf99a
SHA2568050219528e740b8ea91fd900aabdb98a0a0511e6a3497f4fca01d4c19913131
SHA512da790e9ba246b5a6efdf7977d52f8a823b790c78dfef2b1ac8c209c96c1e53afbf85c79c3989178c45ef17d44c81ac686726bb4bf643e278e832772d032087a8
-
Filesize
56KB
MD5d5cbf3235a39c09c9d292dafdf0393a5
SHA1ae109e202e6f0965b47f38ee29b3725800939a9f
SHA256208d15c175407bc56c9e1d1a6e31290cf8c04fe1da742e4ad0dbe06960b7f1dd
SHA512202212aeb1cabe772e05ec7649b83be4a04b68b644a1621993e91e370dc0b9de268ea50f0dab3a74178ecb648d06b5173222d3ed1f0e31d04abeded020b079bd
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB