Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 00:32
Behavioral task
behavioral1
Sample
22cb6c2f9194e730a399c0d34a91856fde40f0ece3cf50f03d2f347b4520d67a.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
22cb6c2f9194e730a399c0d34a91856fde40f0ece3cf50f03d2f347b4520d67a.xlsm
Resource
win10v2004-20241007-en
General
-
Target
22cb6c2f9194e730a399c0d34a91856fde40f0ece3cf50f03d2f347b4520d67a.xlsm
-
Size
20KB
-
MD5
671a9592e8197f25e6ba7837d57d0b97
-
SHA1
4c5c10ffa05404a586c4928d6a56b8b30515be4b
-
SHA256
22cb6c2f9194e730a399c0d34a91856fde40f0ece3cf50f03d2f347b4520d67a
-
SHA512
a31dc007e272f6a3c91e65a294d89f944d989423966de2d9d1b26035d1a7e1519563e496dab098fa13085ccfaaf6ebffe6737a4cb761655988bcc15d10bba3cf
-
SSDEEP
384:PA2Y5Vb1GNj20o4CGzPd6ZIwLJKb5CzgObff9kC+xbX7k7aU2d:I2EINro4FLAOCBn9kC+xbLkWf
Malware Config
Extracted
http://bctconsulting.se/HelenaWEB/Xf1rQukg8HjfItb9x/
https://binaghetta.it/wp-content/gdONbcsI6Q9/
http://bnbengineering.com.pk/cgi-bin/6n8q1OFBzyGyPSJ/
http://bytesenbits.nl/cgi-bin/OjOn8icwhyf22SzegYA/
http://bioscan.ch/backup_nov05/n6S3o4q9dG8050/
http://abildgren.dk/webmail/XY8XstOvGiLx/
http://grworld.com.tr/fonts/TPxLPt9Us5ALpvY/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1344 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1344 EXCEL.EXE 1344 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1344 EXCEL.EXE 1344 EXCEL.EXE 1344 EXCEL.EXE 1344 EXCEL.EXE 1344 EXCEL.EXE 1344 EXCEL.EXE 1344 EXCEL.EXE 1344 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\22cb6c2f9194e730a399c0d34a91856fde40f0ece3cf50f03d2f347b4520d67a.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD5830457f61ebe16b1f7bfb0ae682fc808
SHA1e7275d085fcc96aa6d352bdb9af6e5368975e2af
SHA25632f2c36556824295a2be14f3316a5a88636ee1036e07957ab5b05f679b761247
SHA51236205a0baf23ab2d9ec1c16449f8073b923982cef1ab7c11c8e26f6cdfbf3b9596a5e2e5dd8efa3108123db0b3e855f1f42a6bb284cf529716e4bfe639807e5b