Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-11-2024 00:29
General
-
Target
8c9daf3ae83f4fdebad6f09fab1fe68050b4b2b6269ddf9896e6ff8b985b66b6.xlsm
-
Size
74KB
-
MD5
f946db4fd30a9995db31106efcebd7aa
-
SHA1
9d70b3f038630359899e20a5e17c76fb9147c87d
-
SHA256
8c9daf3ae83f4fdebad6f09fab1fe68050b4b2b6269ddf9896e6ff8b985b66b6
-
SHA512
7e72dfb939c9e7c5838fd2b8ddc7ec1c93c7921f67a6201e58b7d2c06bea8265b5bc8041e3d04dea2d41c9ae483ca193367219aa487aa6a8ca0e91db2368c38c
-
SSDEEP
1536:SuSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:stzSmICpH7OZuvZGsMo
Malware Config
Extracted
https://thesparklezbox.com/wp-admin/kFkWN/
https://herbtytox.com/wp-admin/dq/
http://www.asyadegirmen.com/Template/nEMRY55nQgF/
https://westthamesphysio.com/blog/D8AAkEyZ7u/
https://www.adcreators.com.au/adcreators-edm/RDk3LtiwMkuDQy/
https://www.nipunpharmaskill.com/css/xm17DssGXjChcmm/
https://www.afyonmagazin.com/wp-content/DcnLRE/
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\8c9daf3ae83f4fdebad6f09fab1fe68050b4b2b6269ddf9896e6ff8b985b66b6.xlsm1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB