Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2024 00:32

General

  • Target

    22cb6c2f9194e730a399c0d34a91856fde40f0ece3cf50f03d2f347b4520d67a.xlsm

  • Size

    20KB

  • MD5

    671a9592e8197f25e6ba7837d57d0b97

  • SHA1

    4c5c10ffa05404a586c4928d6a56b8b30515be4b

  • SHA256

    22cb6c2f9194e730a399c0d34a91856fde40f0ece3cf50f03d2f347b4520d67a

  • SHA512

    a31dc007e272f6a3c91e65a294d89f944d989423966de2d9d1b26035d1a7e1519563e496dab098fa13085ccfaaf6ebffe6737a4cb761655988bcc15d10bba3cf

  • SSDEEP

    384:PA2Y5Vb1GNj20o4CGzPd6ZIwLJKb5CzgObff9kC+xbX7k7aU2d:I2EINro4FLAOCBn9kC+xbLkWf

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://bctconsulting.se/HelenaWEB/Xf1rQukg8HjfItb9x/

xlm40.dropper

https://binaghetta.it/wp-content/gdONbcsI6Q9/

xlm40.dropper

http://bnbengineering.com.pk/cgi-bin/6n8q1OFBzyGyPSJ/

xlm40.dropper

http://bytesenbits.nl/cgi-bin/OjOn8icwhyf22SzegYA/

xlm40.dropper

http://bioscan.ch/backup_nov05/n6S3o4q9dG8050/

xlm40.dropper

http://abildgren.dk/webmail/XY8XstOvGiLx/

xlm40.dropper

http://grworld.com.tr/fonts/TPxLPt9Us5ALpvY/

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\22cb6c2f9194e730a399c0d34a91856fde40f0ece3cf50f03d2f347b4520d67a.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1344

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    830457f61ebe16b1f7bfb0ae682fc808

    SHA1

    e7275d085fcc96aa6d352bdb9af6e5368975e2af

    SHA256

    32f2c36556824295a2be14f3316a5a88636ee1036e07957ab5b05f679b761247

    SHA512

    36205a0baf23ab2d9ec1c16449f8073b923982cef1ab7c11c8e26f6cdfbf3b9596a5e2e5dd8efa3108123db0b3e855f1f42a6bb284cf529716e4bfe639807e5b

  • memory/1344-12-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1344-37-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1344-2-0x00007FF802A50000-0x00007FF802A60000-memory.dmp

    Filesize

    64KB

  • memory/1344-6-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1344-7-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1344-9-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1344-8-0x00007FF802A50000-0x00007FF802A60000-memory.dmp

    Filesize

    64KB

  • memory/1344-13-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1344-1-0x00007FF802A50000-0x00007FF802A60000-memory.dmp

    Filesize

    64KB

  • memory/1344-3-0x00007FF802A50000-0x00007FF802A60000-memory.dmp

    Filesize

    64KB

  • memory/1344-5-0x00007FF802A50000-0x00007FF802A60000-memory.dmp

    Filesize

    64KB

  • memory/1344-11-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1344-10-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1344-14-0x00007FF800760000-0x00007FF800770000-memory.dmp

    Filesize

    64KB

  • memory/1344-15-0x00007FF800760000-0x00007FF800770000-memory.dmp

    Filesize

    64KB

  • memory/1344-35-0x00007FF842A6D000-0x00007FF842A6E000-memory.dmp

    Filesize

    4KB

  • memory/1344-36-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1344-0-0x00007FF842A6D000-0x00007FF842A6E000-memory.dmp

    Filesize

    4KB

  • memory/1344-38-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1344-4-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB