Analysis
-
max time kernel
45s -
max time network
40s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
21/03/2025, 21:36
General
-
Target
24ec37e213c6fb8ce9c6094c124754b178ea285c3fad7b5bd57ace6d4bed6618.xls
-
Size
56KB
-
MD5
08d32837ce6208c8327e6ff96ebb004b
-
SHA1
113fca0e71a139a0569f52c595e15ace252cfb97
-
SHA256
24ec37e213c6fb8ce9c6094c124754b178ea285c3fad7b5bd57ace6d4bed6618
-
SHA512
3609c93c2e849632871cf69f8b3a2c1c71fa4d45dcfdaa7ba2091421c8af503ac8224ac4f806aecae70f63ee93b167a821f6c9a69df000e80e2305d518ff9182
-
SSDEEP
1536:bsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umv+:YKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgJ
Malware Config
Extracted
http://church.ktc-center.net/PbSkdCOW/
https://chobemaster.com/components/gus/
https://christianchapman.com/cgi-bin/gADHL9UXSFUTN/
http://chmiola.net/audio/6OuzyjPS/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\24ec37e213c6fb8ce9c6094c124754b178ea285c3fad7b5bd57ace6d4bed6618.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\adw.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
671B
MD55a73e77316f31c81cff45233a8f21d5e
SHA16a4f33a72c9720844df7fa1946db759dc236f0ae
SHA2567666b4d0a9fab93092f224462f9f79e90508299393fc0f4b2130f9ab4a095199
SHA5123aab8c53f070c7a17c6b737981a15846a8dc27b009dcdf63db9e2421b38707c57ed47b1e10cabccaaef38763d9f54ccdfc210e17cfdeefc4074d71a8720d282d
-
Filesize
40KB
MD545a9c27ee5fd8f1dc7fc30f5d1fd4bc3
SHA166da98676b92f5b70eb7570ade0964653061ad38
SHA2567b2d278f9ef44faba163656df444bc7acb80d25e9dc708dffd3ce75b77732120
SHA5128706b6b76c826b0bae155d921a17c5adcd21974594d345070833cb2933e7f81c87c143e450b08c1d7a3fe3d33c071b5eba6cfd53e48686864c55d5729bfe7f9f
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB