Overview
overview
1Static
static
xlsx/xlsx/...st.ps1
windows7_x64
1xlsx/xlsx/...st.ps1
windows10-2004_x64
1xlsx/xlsx/...st.ps1
windows7_x64
1xlsx/xlsx/...st.ps1
windows10-2004_x64
1xlsx/xlsx/...O.xlsx
windows7_x64
1xlsx/xlsx/...O.xlsx
windows10-2004_x64
1xlsx/xlsx/...J.xlsx
windows7_x64
1xlsx/xlsx/...J.xlsx
windows10-2004_x64
1xlsx/xlsx/...ck.ps1
windows7_x64
1xlsx/xlsx/...ck.ps1
windows10-2004_x64
1xlsx/xlsx/.../ga.js
windows7_x64
1xlsx/xlsx/.../ga.js
windows10-2004_x64
1xlsx/xlsx/...ery.js
windows7_x64
1xlsx/xlsx/...ery.js
windows10-2004_x64
1xlsx/xlsx/...pup.js
windows7_x64
1xlsx/xlsx/...pup.js
windows10-2004_x64
1xlsx/xlsx/...ins.js
windows7_x64
1xlsx/xlsx/...ins.js
windows10-2004_x64
1xlsx/xlsx/...e.html
windows7_x64
1xlsx/xlsx/...e.html
windows10-2004_x64
1xlsx/xlsx/...age.js
windows7_x64
1xlsx/xlsx/...age.js
windows10-2004_x64
1xlsx/xlsx/...ck.ps1
windows7_x64
1xlsx/xlsx/...ck.ps1
windows10-2004_x64
1xlsx/xlsx/...x.html
windows7_x64
1xlsx/xlsx/...x.html
windows10-2004_x64
1Analysis
-
max time kernel
148s -
max time network
203s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-06-2022 07:24
Static task
static1
Behavioral task
behavioral1
Sample
xlsx/xlsx/xl/link/Excel/BlackList.ps1
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
xlsx/xlsx/xl/link/Excel/BlackList.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
xlsx/xlsx/xl/link/Excel/PO/BlackList.ps1
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
xlsx/xlsx/xl/link/Excel/PO/BlackList.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
xlsx/xlsx/xl/link/Excel/PO/PO.xlsx
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
xlsx/xlsx/xl/link/Excel/PO/PO.xlsx
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
xlsx/xlsx/xl/link/Excel/PO/POJ.xlsx
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
xlsx/xlsx/xl/link/Excel/PO/POJ.xlsx
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
xlsx/xlsx/xl/link/Excel/PO/block.ps1
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
xlsx/xlsx/xl/link/Excel/PO/block.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
xlsx/xlsx/xl/link/Excel/PO/ga.js
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
xlsx/xlsx/xl/link/Excel/PO/ga.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
xlsx/xlsx/xl/link/Excel/PO/jquery.js
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
xlsx/xlsx/xl/link/Excel/PO/jquery.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
xlsx/xlsx/xl/link/Excel/PO/jquery_popup.js
Resource
win7-20220414-en
Behavioral task
behavioral16
Sample
xlsx/xlsx/xl/link/Excel/PO/jquery_popup.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
xlsx/xlsx/xl/link/Excel/PO/l0gins.js
Resource
win7-20220414-en
Behavioral task
behavioral18
Sample
xlsx/xlsx/xl/link/Excel/PO/l0gins.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
xlsx/xlsx/xl/link/Excel/PO/page.html
Resource
win7-20220414-en
Behavioral task
behavioral20
Sample
xlsx/xlsx/xl/link/Excel/PO/page.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral21
Sample
xlsx/xlsx/xl/link/Excel/PO/page.js
Resource
win7-20220414-en
Behavioral task
behavioral22
Sample
xlsx/xlsx/xl/link/Excel/PO/page.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral23
Sample
xlsx/xlsx/xl/link/Excel/block.ps1
Resource
win7-20220414-en
Behavioral task
behavioral24
Sample
xlsx/xlsx/xl/link/Excel/block.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral25
Sample
xlsx/xlsx/xl/link/Excel/index.html
Resource
win7-20220414-en
Behavioral task
behavioral26
Sample
xlsx/xlsx/xl/link/Excel/index.html
Resource
win10v2004-20220414-en
General
-
Target
xlsx/xlsx/xl/link/Excel/PO/page.html
-
Size
19KB
-
MD5
a99eba08a837777ca726dbe6949b68db
-
SHA1
3347e3043496786a8b912e3c321b2f6c33e5b4ea
-
SHA256
be8578d26da2c5da354ac7f9701a235ad6a44f4bab1fb1722c394d0902a2027a
-
SHA512
d45051d566720906a73aa0c4bde5f5e3f6c858b36a67757b5e1ff780de44c1ecaf6941cb996f60a0c82ba0ad8617184fc745fba3c52b6b6e24e4f8f21c85aab9
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000850f07ecb424934d8f5a48a59e73cec000000000020000000000106600000001000020000000302f9d57409a03a3e3c6a3d04c64d8444bd3c8dbde57ddef0c49865cbcc51375000000000e8000000002000020000000484416d7f6fb3b6e5051029748e62a389f4b11a8eb0486f52838b7ca7f9366f99000000078f456911aa2c9785d46f75b0fe2d9490495baffd65065eb75d4716ac4a3988f2513d2281418acd34d0ca1653844dd0af578ba4f6964e7af8404d6ee855ebca1c365cd0afe733739e2883dc83b000fcf96068780f3d738614d7fbe2013d11f83eb2258ed62ce0cd353a67f90be439c92ee1a4f93bd78b0a3abc417939ecab4c6a1fa904ffe9ff9267fda8e29a35b1022400000009815344ccb223240ad9b0ef4f6e7536f32676966a7fc195884b29ee8ce0858babe8e465b77563874c69d64b7f09e790dce0c88f717e9d5cf7c20ee03c8f43699 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3095e768d080d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "362073484" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{78D8F8D1-ECC3-11EC-955B-7EE61918B1DD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000850f07ecb424934d8f5a48a59e73cec000000000020000000000106600000001000020000000d253ea85b94b3ce84790f2082324619d2c7216a3acb9cf4d680f042a8af7f96e000000000e800000000200002000000070d4e7c6f5f5b5f4aac3bee097c46c94e78755841c4576f68e7e0abfedff471220000000b590e89ef639b7b8b9af43984897ee0f3380658c199088be704323d3e8df9d20400000008dc5ed6c911649871c13c9d0ba658aa0594a77b5112eec02acd2a0b49420a5a0ace3804528878c017a0b0157e3efe4480fd021c77f6df8fd5545767a5606e403 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1984 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1984 iexplore.exe 1984 iexplore.exe 1028 IEXPLORE.EXE 1028 IEXPLORE.EXE 1028 IEXPLORE.EXE 1028 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1984 wrote to memory of 1028 1984 iexplore.exe IEXPLORE.EXE PID 1984 wrote to memory of 1028 1984 iexplore.exe IEXPLORE.EXE PID 1984 wrote to memory of 1028 1984 iexplore.exe IEXPLORE.EXE PID 1984 wrote to memory of 1028 1984 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\xlsx\xlsx\xl\link\Excel\PO\page.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PGP27Q79.txtFilesize
604B
MD536bac63c5eec22211b0f39dcf2547c5a
SHA10c09f2ec611db6f2ca458356cfd8cd7383ba473c
SHA256aa968ebdcec7b32d1bb20625199063c2a0c3263350777eb04f304f0198c05731
SHA5125cebe38ff8353b3526d6900de60a0128d6cf4d9f98ecd0e283c5084476771d90c955bcfba009fbbab1266319cb7421198fd0e5038207ed70a03185d647ec0692