Overview

overview

1

Static

static

xlsx/xlsx/...st.ps1

windows7_x64

1

xlsx/xlsx/...st.ps1

windows10-2004_x64

1

xlsx/xlsx/...st.ps1

windows7_x64

1

xlsx/xlsx/...st.ps1

windows10-2004_x64

1

xlsx/xlsx/...O.xlsx

windows7_x64

1

xlsx/xlsx/...O.xlsx

windows10-2004_x64

1

xlsx/xlsx/...J.xlsx

windows7_x64

1

xlsx/xlsx/...J.xlsx

windows10-2004_x64

1

xlsx/xlsx/...ck.ps1

windows7_x64

1

xlsx/xlsx/...ck.ps1

windows10-2004_x64

1

xlsx/xlsx/.../ga.js

windows7_x64

1

xlsx/xlsx/.../ga.js

windows10-2004_x64

1

xlsx/xlsx/...ery.js

windows7_x64

1

xlsx/xlsx/...ery.js

windows10-2004_x64

1

xlsx/xlsx/...pup.js

windows7_x64

1

xlsx/xlsx/...pup.js

windows10-2004_x64

1

xlsx/xlsx/...ins.js

windows7_x64

1

xlsx/xlsx/...ins.js

windows10-2004_x64

1

xlsx/xlsx/...e.html

windows7_x64

1

xlsx/xlsx/...e.html

windows10-2004_x64

1

xlsx/xlsx/...age.js

windows7_x64

1

xlsx/xlsx/...age.js

windows10-2004_x64

1

xlsx/xlsx/...ck.ps1

windows7_x64

1

xlsx/xlsx/...ck.ps1

windows10-2004_x64

1

xlsx/xlsx/...x.html

windows7_x64

1

xlsx/xlsx/...x.html

windows10-2004_x64

1

Analysis

  • max time kernel
    43s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    15-06-2022 07:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    xlsx/xlsx/xl/link/Excel/block.ps1

  • Size

    1KB

  • MD5

    5116adad80c341b85d93671a323a55af

  • SHA1

    59918eb53b6d37cd6052f33812fca9a05fdf883e

  • SHA256

    b7121cded6b3c0d4ce457605b757087545bbb0e9339101e86ee46530c496d170

  • SHA512

    471948ccbffbe950dc04cae1c4ce8648cdc5321568ee4102426fc086a20452294dd3fd3c56e79c384ffe20d40962da2b1a12f6f2e5ffc1929ae9803362b3fa8f

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\xlsx\xlsx\xl\link\Excel\block.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1100-54-0x000007FEFC111000-0x000007FEFC113000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1100-55-0x000007FEF4620000-0x000007FEF5043000-memory.dmp
    Filesize

    10.1MB

    Download
  • memory/1100-57-0x0000000002564000-0x0000000002567000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1100-56-0x000007FEF3AC0000-0x000007FEF461D000-memory.dmp
    Filesize

    11.4MB

    Download
  • memory/1100-58-0x0000000002564000-0x0000000002567000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1100-59-0x000000000256B000-0x000000000258A000-memory.dmp
    Filesize

    124KB

    Download