Resubmissions

01-12-2024 00:29

241201-as8kssvmek 7

01-12-2024 00:19

241201-amnnfavkek 7

30-11-2024 15:39

241130-s34npssjbj 7

30-11-2024 15:34

241130-sz6znaxmgs 7

07-10-2024 06:29

241007-g9dkbavcnh 10

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    30-11-2024 15:34

General

  • Target

    language/sky.xml

  • Size

    45KB

  • MD5

    7802e24c3814c955207f0585cdea7828

  • SHA1

    4042da1359a70a12360cb8455e9a13b3fc72f308

  • SHA256

    5304bc8125592ab0f367f144f46f5575d1d03e314b02efe27f7c15ab9e14fda6

  • SHA512

    3f909a1f3412415eb48f5e3c6e72e1b685d4bf3e7822b31e34b635e0dd3fdfca8aa2cfb899877ab200211c8ce830ad5610a2c41d480e66189a3d8a2b2de0acd6

  • SSDEEP

    768:qFYetEdKrc3j1IBFmZ0Of6RL1wZIqVWF/CYxJf6wU0+PpH7AxRe8pB3C3pZb0tRq:UYetEdKrc3j1IbdOf6RL1wZIqVWF/CYW

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\language\sky.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1124
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\language\sky.xml
      2⤵
      • Modifies Internet Explorer settings
      PID:3084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1124-1-0x00007FFC4C943000-0x00007FFC4C944000-memory.dmp

    Filesize

    4KB

  • memory/1124-0-0x00007FFC0C930000-0x00007FFC0C940000-memory.dmp

    Filesize

    64KB

  • memory/1124-2-0x00007FFC4C8A0000-0x00007FFC4CAA9000-memory.dmp

    Filesize

    2.0MB

  • memory/1124-7-0x00007FFC4C8A0000-0x00007FFC4CAA9000-memory.dmp

    Filesize

    2.0MB

  • memory/1124-6-0x00007FFC4C8A0000-0x00007FFC4CAA9000-memory.dmp

    Filesize

    2.0MB

  • memory/1124-9-0x00007FFC0C930000-0x00007FFC0C940000-memory.dmp

    Filesize

    64KB

  • memory/1124-10-0x00007FFC4C8A0000-0x00007FFC4CAA9000-memory.dmp

    Filesize

    2.0MB

  • memory/1124-8-0x00007FFC4C8A0000-0x00007FFC4CAA9000-memory.dmp

    Filesize

    2.0MB

  • memory/1124-5-0x00007FFC0C930000-0x00007FFC0C940000-memory.dmp

    Filesize

    64KB

  • memory/1124-4-0x00007FFC0C930000-0x00007FFC0C940000-memory.dmp

    Filesize

    64KB

  • memory/1124-3-0x00007FFC0C930000-0x00007FFC0C940000-memory.dmp

    Filesize

    64KB

  • memory/1124-11-0x00007FFC4C8A0000-0x00007FFC4CAA9000-memory.dmp

    Filesize

    2.0MB

  • memory/1124-13-0x00007FFC4C8A0000-0x00007FFC4CAA9000-memory.dmp

    Filesize

    2.0MB

  • memory/1124-14-0x00007FFC4C8A0000-0x00007FFC4CAA9000-memory.dmp

    Filesize

    2.0MB

  • memory/1124-12-0x00007FFC4C8A0000-0x00007FFC4CAA9000-memory.dmp

    Filesize

    2.0MB

  • memory/1124-19-0x00007FFC4C8A0000-0x00007FFC4CAA9000-memory.dmp

    Filesize

    2.0MB

  • memory/1124-18-0x00007FFC0C930000-0x00007FFC0C940000-memory.dmp

    Filesize

    64KB

  • memory/1124-17-0x00007FFC0C930000-0x00007FFC0C940000-memory.dmp

    Filesize

    64KB

  • memory/1124-16-0x00007FFC0C930000-0x00007FFC0C940000-memory.dmp

    Filesize

    64KB

  • memory/1124-15-0x00007FFC0C930000-0x00007FFC0C940000-memory.dmp

    Filesize

    64KB