Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2022 09:58
Static task
static1
Behavioral task
behavioral1
Sample
PO_SFOWRN5.xlsx.exe
Resource
win7-20220812-en
General
-
Target
PO_SFOWRN5.xlsx.exe
-
Size
856KB
-
MD5
5cd6d4a5fc1b37d7bd936f5b075831e8
-
SHA1
f92ecb4827c429295fc5a948202c0465804fe3e6
-
SHA256
64e0057d190f33bf5ff58de46d663ab4d075b3176d1c59361f931ab7f7dd7185
-
SHA512
e79f76bb81733ecbcc540fc0c507013a412d088cb32f50e11d25d882c537a57e026b160ca5111472d6b8893b0d873186eedafd9e1b67ae918514b9bf35801bfa
-
SSDEEP
24576:kPQaN6H0nDN0o++EKzgte7w7En1gSp4TL9j:kXIUnDN09+EWgte7w7EnOSC/
Malware Config
Extracted
formbook
n2hm
XCeG4IxNKbAl
YzJWbnC+El84nA==
KAJcdmP8yEcO5LXPCFF42Wfb
I+J+xYO95GJQWVU=
GtgxPPv3FmQmhw==
Og9NYF4xEl+j7vGTR93xvg==
506Cg07bsT0G6yK+A96H0h35V+JLkwI=
wAYXFN+pSFIXgQ==
ijzLI/f+FmQmhw==
UfT2PweNm+w8
GQWVw5aZnfF/kS5e
30BKYjua9zcA7gAwsPUngLnjyrBNEgo=
AM65OrmyFmQmhw==
VSlTVxISZ4J/kS5e
GGKj6K33SRh6e0/YzT5nQGlK5CXRqw==
B9H98cUUfX+AWOqiTA==
MxVffWOIoVnM37zrd2sTaOY=
z6bxCgG/mGhR7oDzQA==
pQgSLSRi6AK3M/PdArpX
6rRRsYuSnXx/kS5e
tJRNn0ias3Yw
7c4NEQLSp/R/kS5e
TJmwu5Aa/IuRHtoXXQ==
TLoRUygkiJQE5GoRji0aff0=
Y83qB/DsQFYeZzahj6pYqw==
Bup2q3PHFmQmhw==
cDTa78WEWaYMdoDdArpX
28Rw4MRMnjT52raaTR5KhtMJYa8=
WydpZS7v/4XubCZuhkdxP2OAKdyK68u6
B+osKudaL8yAV/K/VAH3T+Q=
qVz9Y0QD3TGeM/PdArpX
+r49VzlFXLpFegdyc4q5ow==
gsXk990afa1hl6ATTA==
XkblOQWRaet/kS5e
4TNPSf2OcfNk9cfPCFF42Wfb
NaIIUEoRdKYr
ITSqBfn5FmQmhw==
KPRUmWnqxVE0hERFtyo=
VLzd1qk6E5wNcQ49KnmhAoT3Ok5roMK4kQ==
65jM2pKJ8EIST04=
I3+JoYVgYgDiv3O15Ntvw0On/sJroMK4kQ==
C+YhNzH20aCpy8MqVw==
yBZRl4HdPn+RHtoXXQ==
pGQATg0mMfntSBR9c4q5ow==
YUKFixIRdKYr
Hv+C4cZTOMAKV+/dArpX
MVW+PJpyCVA=
FX2AJYBFYbgk
/cX1CsjSpvU+
fWoThWagDVhBHt4yMjWQifM=
/vCd69xrS8QwuCt/yD8=
GvAsSzbCRxplG582TKzVug==
S6zlGfJ6DFc4TBNUvig=
k0z/QwnTpfR/kS5e
KPofKfkPcoRqxowFuWWNhvM=
Xrj+JvENc3yBln4OUw==
ScTatpYj/IKRHtoXXQ==
vLRdwbLyTpzFn+dAR93xvg==
mLTJe/eFp2kxl69W
Cbr5/dRQbio2P/e8ay0aff0=
xooviWn51V7DI7mMOwWT4lCIJUlf
l0t7fTmLqSCAuIYIVA==
06xFejwYMSkbfETTiNT21O0=
bWzTF+1nS4kxlydW
madamkikkiey.net
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PO_SFOWRN5.xlsx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation PO_SFOWRN5.xlsx.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO_SFOWRN5.xlsx.exePO_SFOWRN5.xlsx.exemsdt.exedescription pid process target process PID 4736 set thread context of 1304 4736 PO_SFOWRN5.xlsx.exe PO_SFOWRN5.xlsx.exe PID 1304 set thread context of 2984 1304 PO_SFOWRN5.xlsx.exe Explorer.EXE PID 404 set thread context of 2984 404 msdt.exe Explorer.EXE -
Processes:
msdt.exedescription ioc process Key created \Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msdt.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
PO_SFOWRN5.xlsx.exePO_SFOWRN5.xlsx.exemsdt.exepid process 4736 PO_SFOWRN5.xlsx.exe 4736 PO_SFOWRN5.xlsx.exe 1304 PO_SFOWRN5.xlsx.exe 1304 PO_SFOWRN5.xlsx.exe 1304 PO_SFOWRN5.xlsx.exe 1304 PO_SFOWRN5.xlsx.exe 1304 PO_SFOWRN5.xlsx.exe 1304 PO_SFOWRN5.xlsx.exe 1304 PO_SFOWRN5.xlsx.exe 1304 PO_SFOWRN5.xlsx.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2984 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
PO_SFOWRN5.xlsx.exemsdt.exepid process 1304 PO_SFOWRN5.xlsx.exe 1304 PO_SFOWRN5.xlsx.exe 1304 PO_SFOWRN5.xlsx.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO_SFOWRN5.xlsx.exePO_SFOWRN5.xlsx.exemsdt.exedescription pid process Token: SeDebugPrivilege 4736 PO_SFOWRN5.xlsx.exe Token: SeDebugPrivilege 1304 PO_SFOWRN5.xlsx.exe Token: SeDebugPrivilege 404 msdt.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO_SFOWRN5.xlsx.exeExplorer.EXEmsdt.exedescription pid process target process PID 4736 wrote to memory of 1304 4736 PO_SFOWRN5.xlsx.exe PO_SFOWRN5.xlsx.exe PID 4736 wrote to memory of 1304 4736 PO_SFOWRN5.xlsx.exe PO_SFOWRN5.xlsx.exe PID 4736 wrote to memory of 1304 4736 PO_SFOWRN5.xlsx.exe PO_SFOWRN5.xlsx.exe PID 4736 wrote to memory of 1304 4736 PO_SFOWRN5.xlsx.exe PO_SFOWRN5.xlsx.exe PID 4736 wrote to memory of 1304 4736 PO_SFOWRN5.xlsx.exe PO_SFOWRN5.xlsx.exe PID 4736 wrote to memory of 1304 4736 PO_SFOWRN5.xlsx.exe PO_SFOWRN5.xlsx.exe PID 2984 wrote to memory of 404 2984 Explorer.EXE msdt.exe PID 2984 wrote to memory of 404 2984 Explorer.EXE msdt.exe PID 2984 wrote to memory of 404 2984 Explorer.EXE msdt.exe PID 404 wrote to memory of 1768 404 msdt.exe Firefox.exe PID 404 wrote to memory of 1768 404 msdt.exe Firefox.exe PID 404 wrote to memory of 1768 404 msdt.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO_SFOWRN5.xlsx.exe"C:\Users\Admin\AppData\Local\Temp\PO_SFOWRN5.xlsx.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO_SFOWRN5.xlsx.exe"C:\Users\Admin\AppData\Local\Temp\PO_SFOWRN5.xlsx.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/404-146-0x0000000000000000-mapping.dmp
-
memory/404-154-0x0000000000570000-0x000000000059D000-memory.dmpFilesize
180KB
-
memory/404-152-0x0000000002690000-0x000000000271F000-memory.dmpFilesize
572KB
-
memory/404-151-0x0000000002890000-0x0000000002BDA000-memory.dmpFilesize
3.3MB
-
memory/404-149-0x0000000000920000-0x0000000000977000-memory.dmpFilesize
348KB
-
memory/404-150-0x0000000000570000-0x000000000059D000-memory.dmpFilesize
180KB
-
memory/1304-137-0x0000000000000000-mapping.dmp
-
memory/1304-147-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1304-141-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1304-142-0x0000000001860000-0x0000000001BAA000-memory.dmpFilesize
3.3MB
-
memory/1304-144-0x0000000001780000-0x0000000001790000-memory.dmpFilesize
64KB
-
memory/1304-148-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1304-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1304-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2984-145-0x00000000086C0000-0x000000000879C000-memory.dmpFilesize
880KB
-
memory/2984-153-0x0000000008A70000-0x0000000008B14000-memory.dmpFilesize
656KB
-
memory/2984-155-0x0000000008A70000-0x0000000008B14000-memory.dmpFilesize
656KB
-
memory/4736-132-0x0000000000EB0000-0x0000000000F8A000-memory.dmpFilesize
872KB
-
memory/4736-136-0x00000000083F0000-0x000000000848C000-memory.dmpFilesize
624KB
-
memory/4736-135-0x00000000035D0000-0x00000000035DA000-memory.dmpFilesize
40KB
-
memory/4736-134-0x0000000005960000-0x00000000059F2000-memory.dmpFilesize
584KB
-
memory/4736-133-0x0000000005F10000-0x00000000064B4000-memory.dmpFilesize
5.6MB