Analysis
-
max time kernel
135s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
31-01-2023 14:52
Static task
static1
Behavioral task
behavioral1
Sample
BankStatement-1675176567.xll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
BankStatement-1675176567.xll
Resource
win10v2004-20221111-en
General
-
Target
BankStatement-1675176567.xll
-
Size
75KB
-
MD5
ad0b110ff2ecc9cb8243358b4cd2eaf1
-
SHA1
5c87fbef6bc4cfda56d837f3be724d9a0528d7f7
-
SHA256
448e4cbdfc4374985301a5f58b44495cbc7a9ce1457b0e290903534ea31c5aa4
-
SHA512
34174c0e8a630e53af532aeb67d7077b9d71807368273e7ee362f3b86d7a95aa6a880003871d408aa017090ae3db0d16b0c78e5e35d916fb01659c0a4e9b5d36
-
SSDEEP
768:RWPEHLuWs0sxOUKVfZ4ntEdUl9318F/ARYCD6DgUach39MHmqCegBY1iABMQ:qkL40XUKVfZ4nt+UL3180ErX8mfBcBMQ
Malware Config
Extracted
Extracted
raccoon
470ed711dadd97d5f2669317d6d3ee7d
http://102.130.113.39
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.execmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1832 4652 powershell.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1796 4652 cmd.exe EXCEL.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 55 3064 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
filesetup11.5.6.exepid process 3804 filesetup11.5.6.exe -
Loads dropped DLL 2 IoCs
Processes:
EXCEL.EXEpid process 4652 EXCEL.EXE 4652 EXCEL.EXE -
Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
Processes:
powershell.exepid process 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 3064 set thread context of 3468 3064 powershell.exe aspnet_compiler.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4652 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepid process 1832 powershell.exe 1832 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe 3064 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1832 powershell.exe Token: SeDebugPrivilege 3064 powershell.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
EXCEL.EXEpid process 4652 EXCEL.EXE 4652 EXCEL.EXE 4652 EXCEL.EXE 4652 EXCEL.EXE 4652 EXCEL.EXE 4652 EXCEL.EXE 4652 EXCEL.EXE 4652 EXCEL.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
EXCEL.EXEcmd.exefilesetup11.5.6.exepowershell.exedescription pid process target process PID 4652 wrote to memory of 1832 4652 EXCEL.EXE powershell.exe PID 4652 wrote to memory of 1832 4652 EXCEL.EXE powershell.exe PID 4652 wrote to memory of 1796 4652 EXCEL.EXE cmd.exe PID 4652 wrote to memory of 1796 4652 EXCEL.EXE cmd.exe PID 1796 wrote to memory of 3804 1796 cmd.exe filesetup11.5.6.exe PID 1796 wrote to memory of 3804 1796 cmd.exe filesetup11.5.6.exe PID 1796 wrote to memory of 3804 1796 cmd.exe filesetup11.5.6.exe PID 3804 wrote to memory of 3064 3804 filesetup11.5.6.exe powershell.exe PID 3804 wrote to memory of 3064 3804 filesetup11.5.6.exe powershell.exe PID 3804 wrote to memory of 3064 3804 filesetup11.5.6.exe powershell.exe PID 3064 wrote to memory of 3468 3064 powershell.exe aspnet_compiler.exe PID 3064 wrote to memory of 3468 3064 powershell.exe aspnet_compiler.exe PID 3064 wrote to memory of 3468 3064 powershell.exe aspnet_compiler.exe PID 3064 wrote to memory of 3468 3064 powershell.exe aspnet_compiler.exe PID 3064 wrote to memory of 3468 3064 powershell.exe aspnet_compiler.exe PID 3064 wrote to memory of 3468 3064 powershell.exe aspnet_compiler.exe PID 3064 wrote to memory of 3468 3064 powershell.exe aspnet_compiler.exe PID 3064 wrote to memory of 3468 3064 powershell.exe aspnet_compiler.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\BankStatement-1675176567.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Expand-Archive -Path "C:\Users\Admin\AppData\Local\Temp\mypictures.zip" -DestinationPath "C:\Users\Admin\AppData\Local\Temp\."2⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.execmd.exe /cstart C:\Users\Admin\AppData\Local\Temp\filesetup11.5.6\filesetup11.5.6.exe2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\filesetup11.5.6\filesetup11.5.6.exeC:\Users\Admin\AppData\Local\Temp\filesetup11.5.6\filesetup11.5.6.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"4⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BankStatement-1675176567.xllFilesize
75KB
MD5ad0b110ff2ecc9cb8243358b4cd2eaf1
SHA15c87fbef6bc4cfda56d837f3be724d9a0528d7f7
SHA256448e4cbdfc4374985301a5f58b44495cbc7a9ce1457b0e290903534ea31c5aa4
SHA51234174c0e8a630e53af532aeb67d7077b9d71807368273e7ee362f3b86d7a95aa6a880003871d408aa017090ae3db0d16b0c78e5e35d916fb01659c0a4e9b5d36
-
C:\Users\Admin\AppData\Local\Temp\BankStatement-1675176567.xllFilesize
75KB
MD5ad0b110ff2ecc9cb8243358b4cd2eaf1
SHA15c87fbef6bc4cfda56d837f3be724d9a0528d7f7
SHA256448e4cbdfc4374985301a5f58b44495cbc7a9ce1457b0e290903534ea31c5aa4
SHA51234174c0e8a630e53af532aeb67d7077b9d71807368273e7ee362f3b86d7a95aa6a880003871d408aa017090ae3db0d16b0c78e5e35d916fb01659c0a4e9b5d36
-
C:\Users\Admin\AppData\Local\Temp\filesetup11.5.6\filesetup11.5.6.exeFilesize
826.2MB
MD52d7dc2b28e742731e5c1aca9ca2504c1
SHA1dfdc514b64369b26b8d5be715ee26e3001d56769
SHA256d38483ae38d39071c1c5926bb1940671d8a324915cc608e6b35df41f4826d6be
SHA512aa100b61fd542846949d10f2716cf155b796f32060ca2c24e8216ef0336a87dfd5d16f0072fec062da7415e1977bb9a7b8304dc424e2419a14a55aa4f5ff0f95
-
C:\Users\Admin\AppData\Local\Temp\filesetup11.5.6\filesetup11.5.6.exeFilesize
826.2MB
MD52d7dc2b28e742731e5c1aca9ca2504c1
SHA1dfdc514b64369b26b8d5be715ee26e3001d56769
SHA256d38483ae38d39071c1c5926bb1940671d8a324915cc608e6b35df41f4826d6be
SHA512aa100b61fd542846949d10f2716cf155b796f32060ca2c24e8216ef0336a87dfd5d16f0072fec062da7415e1977bb9a7b8304dc424e2419a14a55aa4f5ff0f95
-
C:\Users\Admin\AppData\Local\Temp\mypictures.zipFilesize
6.9MB
MD5b145c7b31e020809beb62b5ff5c7b66b
SHA14bfae85a04739c8c3d39b9b60b5f2afd4db5c4cf
SHA256a68bf293252d2e9f4e86646d8b0be474bf858bfb8dde2a787fd8f5e8aabd8af0
SHA51284835b1a6936f6a4c0dea466936f3f1ce438a06636b22a6a7a966aa7d1e39f028a184a21ae8e6956ba30033982eaef3716cdade9485ba2b5040ca3f965788941
-
memory/1796-149-0x0000000000000000-mapping.dmp
-
memory/1832-147-0x00007FFC4D6B0000-0x00007FFC4E171000-memory.dmpFilesize
10.8MB
-
memory/1832-148-0x00007FFC4D6B0000-0x00007FFC4E171000-memory.dmpFilesize
10.8MB
-
memory/1832-145-0x0000026FA63D0000-0x0000026FA63DA000-memory.dmpFilesize
40KB
-
memory/1832-141-0x0000000000000000-mapping.dmp
-
memory/1832-142-0x0000026F8DF20000-0x0000026F8DF42000-memory.dmpFilesize
136KB
-
memory/1832-143-0x00007FFC4D6B0000-0x00007FFC4E171000-memory.dmpFilesize
10.8MB
-
memory/1832-144-0x0000026FA6640000-0x0000026FA6652000-memory.dmpFilesize
72KB
-
memory/3064-166-0x0000000005CB0000-0x0000000005D16000-memory.dmpFilesize
408KB
-
memory/3064-168-0x00000000064E0000-0x00000000064FE000-memory.dmpFilesize
120KB
-
memory/3064-164-0x0000000005680000-0x0000000005CA8000-memory.dmpFilesize
6.2MB
-
memory/3064-165-0x0000000005590000-0x00000000055B2000-memory.dmpFilesize
136KB
-
memory/3064-158-0x0000000000000000-mapping.dmp
-
memory/3064-167-0x0000000005DD0000-0x0000000005E36000-memory.dmpFilesize
408KB
-
memory/3064-172-0x0000000007870000-0x000000000788A000-memory.dmpFilesize
104KB
-
memory/3064-171-0x0000000007ED0000-0x000000000854A000-memory.dmpFilesize
6.5MB
-
memory/3064-170-0x00000000077D0000-0x0000000007846000-memory.dmpFilesize
472KB
-
memory/3064-169-0x0000000007650000-0x0000000007694000-memory.dmpFilesize
272KB
-
memory/3064-163-0x0000000002B50000-0x0000000002B86000-memory.dmpFilesize
216KB
-
memory/3468-173-0x0000000000000000-mapping.dmp
-
memory/3468-174-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3468-176-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3468-177-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3804-153-0x0000000000690000-0x000000000077C000-memory.dmpFilesize
944KB
-
memory/3804-156-0x0000000005200000-0x000000000520A000-memory.dmpFilesize
40KB
-
memory/3804-150-0x0000000000000000-mapping.dmp
-
memory/3804-154-0x00000000056F0000-0x0000000005C94000-memory.dmpFilesize
5.6MB
-
memory/3804-155-0x0000000005140000-0x00000000051D2000-memory.dmpFilesize
584KB
-
memory/4652-159-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmpFilesize
64KB
-
memory/4652-132-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmpFilesize
64KB
-
memory/4652-162-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmpFilesize
64KB
-
memory/4652-160-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmpFilesize
64KB
-
memory/4652-138-0x00007FFC34210000-0x00007FFC34220000-memory.dmpFilesize
64KB
-
memory/4652-133-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmpFilesize
64KB
-
memory/4652-134-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmpFilesize
64KB
-
memory/4652-161-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmpFilesize
64KB
-
memory/4652-135-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmpFilesize
64KB
-
memory/4652-136-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmpFilesize
64KB
-
memory/4652-137-0x00007FFC34210000-0x00007FFC34220000-memory.dmpFilesize
64KB