535f2b04a4086696d3fafb347cba4a40d6647a3c9c0b8b4690e966d789b5f45e

General

Target

MV SPYRO AFEA VOY 156 PARTICULARS.xlsm
Size

51KB
MD5

63e87619e5dcb07ca54ef9d82d99f7c0
SHA1

7fd77e39fbf7ad6e8ade3e6592580a81a7373c54
SHA256

535f2b04a4086696d3fafb347cba4a40d6647a3c9c0b8b4690e966d789b5f45e
SHA512

f7ba6d6d7b45b3f335bdb787c2393f0fc22aea8b01317643b3b3d006801c4cfc1a40301aa71cee87a57b460ba70c12be603369b042081dcfb1539466c904e8d1

Score

10^/10

spyware

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1100 EXCEL.EXE

pid	process
1100	EXCEL.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cscript.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1512	1100	cscript.exe	EXCEL.EXE

Blacklisted process makes network request 2 IoCs

Processes:

cscript.execscript.exe

flow pid process

1 1512 cscript.exe
2 1848 cscript.exe
Executes dropped EXE 3 IoCs

Processes:

5znX0kpa.exe5znX0kpa.exe5znX0kpa.exe

pid process

1640 5znX0kpa.exe
1484 5znX0kpa.exe
1496 5znX0kpa.exe
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1412 EQNEDT32.EXE
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1108 schtasks.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

EXCEL.EXE5znX0kpa.exe

pid process

1100 EXCEL.EXE
1100 EXCEL.EXE
1100 EXCEL.EXE
1496 5znX0kpa.exe

flow	pid	process
1	1512	cscript.exe
2	1848	cscript.exe

pid	process
1640	5znX0kpa.exe
1484	5znX0kpa.exe
1496	5znX0kpa.exe

pid	process
1412	EQNEDT32.EXE

pid	process
1108	schtasks.exe

pid	process
1100	EXCEL.EXE
1100	EXCEL.EXE
1100	EXCEL.EXE
1496	5znX0kpa.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

EQNEDT32.EXEcmd.exeEXCEL.EXEcscript.execmd.execscript.exe5znX0kpa.exe

description	pid	process	target process
PID 1412 wrote to memory of 1588	1412	EQNEDT32.EXE	cmd.exe
PID 1412 wrote to memory of 1588	1412	EQNEDT32.EXE	cmd.exe
PID 1412 wrote to memory of 1588	1412	EQNEDT32.EXE	cmd.exe
PID 1412 wrote to memory of 1588	1412	EQNEDT32.EXE	cmd.exe
PID 1588 wrote to memory of 808	1588	cmd.exe	cscript.exe
PID 1588 wrote to memory of 808	1588	cmd.exe	cscript.exe
PID 1588 wrote to memory of 808	1588	cmd.exe	cscript.exe
PID 1588 wrote to memory of 808	1588	cmd.exe	cscript.exe
PID 1100 wrote to memory of 1512	1100	EXCEL.EXE	cscript.exe
PID 1100 wrote to memory of 1512	1100	EXCEL.EXE	cscript.exe
PID 1100 wrote to memory of 1512	1100	EXCEL.EXE	cscript.exe
PID 808 wrote to memory of 1784	808	cscript.exe	cmd.exe
PID 808 wrote to memory of 1784	808	cscript.exe	cmd.exe
PID 808 wrote to memory of 1784	808	cscript.exe	cmd.exe
PID 808 wrote to memory of 1784	808	cscript.exe	cmd.exe
PID 1784 wrote to memory of 1848	1784	cmd.exe	cscript.exe
PID 1784 wrote to memory of 1848	1784	cmd.exe	cscript.exe
PID 1784 wrote to memory of 1848	1784	cmd.exe	cscript.exe
PID 1784 wrote to memory of 1848	1784	cmd.exe	cscript.exe
PID 1512 wrote to memory of 1640	1512	cscript.exe	5znX0kpa.exe
PID 1512 wrote to memory of 1640	1512	cscript.exe	5znX0kpa.exe
PID 1512 wrote to memory of 1640	1512	cscript.exe	5znX0kpa.exe
PID 1512 wrote to memory of 1640	1512	cscript.exe	5znX0kpa.exe
PID 1640 wrote to memory of 1108	1640	5znX0kpa.exe	schtasks.exe
PID 1640 wrote to memory of 1108	1640	5znX0kpa.exe	schtasks.exe
PID 1640 wrote to memory of 1108	1640	5znX0kpa.exe	schtasks.exe
PID 1640 wrote to memory of 1108	1640	5znX0kpa.exe	schtasks.exe
PID 1640 wrote to memory of 1484	1640	5znX0kpa.exe	5znX0kpa.exe
PID 1640 wrote to memory of 1484	1640	5znX0kpa.exe	5znX0kpa.exe
PID 1640 wrote to memory of 1484	1640	5znX0kpa.exe	5znX0kpa.exe
PID 1640 wrote to memory of 1484	1640	5znX0kpa.exe	5znX0kpa.exe
PID 1640 wrote to memory of 1496	1640	5znX0kpa.exe	5znX0kpa.exe
PID 1640 wrote to memory of 1496	1640	5znX0kpa.exe	5znX0kpa.exe
PID 1640 wrote to memory of 1496	1640	5znX0kpa.exe	5znX0kpa.exe
PID 1640 wrote to memory of 1496	1640	5znX0kpa.exe	5znX0kpa.exe
PID 1640 wrote to memory of 1496	1640	5znX0kpa.exe	5znX0kpa.exe
PID 1640 wrote to memory of 1496	1640	5znX0kpa.exe	5znX0kpa.exe
PID 1640 wrote to memory of 1496	1640	5znX0kpa.exe	5znX0kpa.exe
PID 1640 wrote to memory of 1496	1640	5znX0kpa.exe	5znX0kpa.exe
PID 1640 wrote to memory of 1496	1640	5znX0kpa.exe	5znX0kpa.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5znX0kpa.exe5znX0kpa.exe

description pid process

Token: SeDebugPrivilege 1640 5znX0kpa.exe
Token: SeDebugPrivilege 1496 5znX0kpa.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

description	pid	process
Token: SeDebugPrivilege	1640	5znX0kpa.exe
Token: SeDebugPrivilege	1496	5znX0kpa.exe

Script User-Agent 2 IoCs

Processes:

description	flow	ioc
HTTP User-Agent header	1	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

5znX0kpa.exe5znX0kpa.exe

pid process

1640 5znX0kpa.exe
1640 5znX0kpa.exe
1496 5znX0kpa.exe
1496 5znX0kpa.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

5znX0kpa.exe

description pid process target process

PID 1640 set thread context of 1496 1640 5znX0kpa.exe 5znX0kpa.exe
NTFS ADS 1 IoCs

Processes:

EXCEL.EXE

description ioc process

File created C:\programdata\asc.txt:script1.vbs EXCEL.EXE

pid	process
1640	5znX0kpa.exe
1640	5znX0kpa.exe
1496	5znX0kpa.exe
1496	5znX0kpa.exe

description	pid	process	target process
PID 1640 set thread context of 1496	1640	5znX0kpa.exe	5znX0kpa.exe

description	ioc	process
File created	C:\programdata\asc.txt:script1.vbs	EXCEL.EXE

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\MV SPYRO AFEA VOY 156 PARTICULARS.xlsm"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- NTFS ADS
PID:1100

C:\Windows\System32\cscript.exe
"C:\Windows\System32\cscript.exe" C:\programdata\asc.txt:script1.vbs
2⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1512

C:\programdata\5znX0kpa.exe
C:\programdata\5znX0kpa.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1640

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KwXzcETxLrNyv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4CD7.tmp"
4⤵
- Creates scheduled task(s)
PID:1108

C:\programdata\5znX0kpa.exe
"{path}"
4⤵
- Executes dropped EXE
PID:1484

C:\programdata\5znX0kpa.exe
"{path}"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1496

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1412

C:\Windows\SysWOW64\cmd.exe
cmd /c ren %tmp%\mm v&cScriPT %tmp%\v?..wsf C
2⤵
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\SysWOW64\cscript.exe
cScriPT C:\Users\Admin\AppData\Local\Temp\v?..wsf C
3⤵
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cscript C:\Users\Admin\AppData\Local\Temp\xx.vbs
4⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp\xx.vbs
5⤵
- Blacklisted process makes network request
PID:1848

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1

T1203

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\5znX0kpa.exe

Download Submit
C:\ProgramData\5znX0kpa.exe

Download Submit
C:\ProgramData\5znX0kpa.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\mm

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4CD7.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\xx

Download Submit
C:\programdata\5znX0kpa.exe

Download Submit
C:\programdata\asc.txt:script1.vbs

Download Submit
memory/808-9-0x0000000002600000-0x0000000002604000-memory.dmp

Filesize
16KB

Download
memory/808-2-0x0000000000000000-mapping.dmp

Download
memory/1100-3-0x0000000006080000-0x0000000006180000-memory.dmp

Filesize
1024KB

Download
memory/1108-19-0x0000000000000000-mapping.dmp

Download
memory/1496-23-0x000000000044564E-mapping.dmp

Download
memory/1496-25-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1496-22-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1496-26-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1512-14-0x00000000025A0000-0x00000000025A4000-memory.dmp

Filesize
16KB

Download
memory/1512-7-0x0000000000000000-mapping.dmp

Download
memory/1588-0-0x0000000000000000-mapping.dmp

Download
memory/1640-18-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1640-12-0x0000000000000000-mapping.dmp

Download
memory/1784-8-0x0000000000000000-mapping.dmp

Download
memory/1848-16-0x00000000028C0000-0x00000000028C4000-memory.dmp

Filesize
16KB

Download
memory/1848-11-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads