Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31-01-2023 17:07
Static task
static1
Behavioral task
behavioral1
Sample
BankStatement-1675184346.xll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
BankStatement-1675184346.xll
Resource
win10v2004-20220812-en
General
-
Target
BankStatement-1675184346.xll
-
Size
75KB
-
MD5
ab5f556f96d8899eb5f77be82419107f
-
SHA1
65c9f27bee36e773a7db8a4ee4f5d77c126e570a
-
SHA256
1e2ec32a10710dd484a69caa60bdacc87a3ab932e6a0316a799646a8d0517eff
-
SHA512
ac5a719779ad0b6167a2a868eb72a0a3258bb2fe592486747a51c867d92544834a1840f8275a6069be3411badf6ab8e5fd74f0321a55b8939baaba35c36f66d8
-
SSDEEP
1536:1GfKhE0XUKlOZ9p+Ut3hGy3Nr8dGAaUDBMQ:kChEuUKlOZTxt3hGwry/DBR
Malware Config
Extracted
Extracted
raccoon
470ed711dadd97d5f2669317d6d3ee7d
http://102.130.113.39
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.execmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1632 1868 powershell.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1528 1868 cmd.exe EXCEL.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 114 3000 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
filesetup11.5.6.exepid process 4372 filesetup11.5.6.exe -
Loads dropped DLL 2 IoCs
Processes:
EXCEL.EXEpid process 1868 EXCEL.EXE 1868 EXCEL.EXE -
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
Processes:
powershell.exepid process 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 3000 set thread context of 1300 3000 powershell.exe aspnet_compiler.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1868 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepid process 1632 powershell.exe 1632 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe 3000 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1632 powershell.exe Token: SeDebugPrivilege 3000 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 1868 EXCEL.EXE 1868 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
EXCEL.EXEpid process 1868 EXCEL.EXE 1868 EXCEL.EXE 1868 EXCEL.EXE 1868 EXCEL.EXE 1868 EXCEL.EXE 1868 EXCEL.EXE 1868 EXCEL.EXE 1868 EXCEL.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
EXCEL.EXEcmd.exefilesetup11.5.6.exepowershell.exedescription pid process target process PID 1868 wrote to memory of 1632 1868 EXCEL.EXE powershell.exe PID 1868 wrote to memory of 1632 1868 EXCEL.EXE powershell.exe PID 1868 wrote to memory of 1528 1868 EXCEL.EXE cmd.exe PID 1868 wrote to memory of 1528 1868 EXCEL.EXE cmd.exe PID 1528 wrote to memory of 4372 1528 cmd.exe filesetup11.5.6.exe PID 1528 wrote to memory of 4372 1528 cmd.exe filesetup11.5.6.exe PID 1528 wrote to memory of 4372 1528 cmd.exe filesetup11.5.6.exe PID 4372 wrote to memory of 3000 4372 filesetup11.5.6.exe powershell.exe PID 4372 wrote to memory of 3000 4372 filesetup11.5.6.exe powershell.exe PID 4372 wrote to memory of 3000 4372 filesetup11.5.6.exe powershell.exe PID 3000 wrote to memory of 1300 3000 powershell.exe aspnet_compiler.exe PID 3000 wrote to memory of 1300 3000 powershell.exe aspnet_compiler.exe PID 3000 wrote to memory of 1300 3000 powershell.exe aspnet_compiler.exe PID 3000 wrote to memory of 1300 3000 powershell.exe aspnet_compiler.exe PID 3000 wrote to memory of 1300 3000 powershell.exe aspnet_compiler.exe PID 3000 wrote to memory of 1300 3000 powershell.exe aspnet_compiler.exe PID 3000 wrote to memory of 1300 3000 powershell.exe aspnet_compiler.exe PID 3000 wrote to memory of 1300 3000 powershell.exe aspnet_compiler.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\BankStatement-1675184346.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Expand-Archive -Path "C:\Users\Admin\AppData\Local\Temp\mypictures.zip" -DestinationPath "C:\Users\Admin\AppData\Local\Temp\."2⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.execmd.exe /cstart C:\Users\Admin\AppData\Local\Temp\filesetup11.5.6\filesetup11.5.6.exe2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\filesetup11.5.6\filesetup11.5.6.exeC:\Users\Admin\AppData\Local\Temp\filesetup11.5.6\filesetup11.5.6.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"4⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BankStatement-1675184346.xllFilesize
75KB
MD5ab5f556f96d8899eb5f77be82419107f
SHA165c9f27bee36e773a7db8a4ee4f5d77c126e570a
SHA2561e2ec32a10710dd484a69caa60bdacc87a3ab932e6a0316a799646a8d0517eff
SHA512ac5a719779ad0b6167a2a868eb72a0a3258bb2fe592486747a51c867d92544834a1840f8275a6069be3411badf6ab8e5fd74f0321a55b8939baaba35c36f66d8
-
C:\Users\Admin\AppData\Local\Temp\BankStatement-1675184346.xllFilesize
75KB
MD5ab5f556f96d8899eb5f77be82419107f
SHA165c9f27bee36e773a7db8a4ee4f5d77c126e570a
SHA2561e2ec32a10710dd484a69caa60bdacc87a3ab932e6a0316a799646a8d0517eff
SHA512ac5a719779ad0b6167a2a868eb72a0a3258bb2fe592486747a51c867d92544834a1840f8275a6069be3411badf6ab8e5fd74f0321a55b8939baaba35c36f66d8
-
C:\Users\Admin\AppData\Local\Temp\filesetup11.5.6\filesetup11.5.6.exeFilesize
826.2MB
MD52d7dc2b28e742731e5c1aca9ca2504c1
SHA1dfdc514b64369b26b8d5be715ee26e3001d56769
SHA256d38483ae38d39071c1c5926bb1940671d8a324915cc608e6b35df41f4826d6be
SHA512aa100b61fd542846949d10f2716cf155b796f32060ca2c24e8216ef0336a87dfd5d16f0072fec062da7415e1977bb9a7b8304dc424e2419a14a55aa4f5ff0f95
-
C:\Users\Admin\AppData\Local\Temp\filesetup11.5.6\filesetup11.5.6.exeFilesize
826.2MB
MD52d7dc2b28e742731e5c1aca9ca2504c1
SHA1dfdc514b64369b26b8d5be715ee26e3001d56769
SHA256d38483ae38d39071c1c5926bb1940671d8a324915cc608e6b35df41f4826d6be
SHA512aa100b61fd542846949d10f2716cf155b796f32060ca2c24e8216ef0336a87dfd5d16f0072fec062da7415e1977bb9a7b8304dc424e2419a14a55aa4f5ff0f95
-
C:\Users\Admin\AppData\Local\Temp\mypictures.zipFilesize
6.9MB
MD5b145c7b31e020809beb62b5ff5c7b66b
SHA14bfae85a04739c8c3d39b9b60b5f2afd4db5c4cf
SHA256a68bf293252d2e9f4e86646d8b0be474bf858bfb8dde2a787fd8f5e8aabd8af0
SHA51284835b1a6936f6a4c0dea466936f3f1ce438a06636b22a6a7a966aa7d1e39f028a184a21ae8e6956ba30033982eaef3716cdade9485ba2b5040ca3f965788941
-
memory/1300-167-0x0000000000000000-mapping.dmp
-
memory/1300-168-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1300-170-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1300-171-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1528-148-0x0000000000000000-mapping.dmp
-
memory/1632-144-0x0000023D66C70000-0x0000023D66C7A000-memory.dmpFilesize
40KB
-
memory/1632-141-0x0000000000000000-mapping.dmp
-
memory/1632-143-0x0000023D66C80000-0x0000023D66C92000-memory.dmpFilesize
72KB
-
memory/1632-142-0x0000023D66930000-0x0000023D66952000-memory.dmpFilesize
136KB
-
memory/1632-146-0x00007FFBB24F0000-0x00007FFBB2FB1000-memory.dmpFilesize
10.8MB
-
memory/1632-147-0x00007FFBB24F0000-0x00007FFBB2FB1000-memory.dmpFilesize
10.8MB
-
memory/1868-137-0x00007FFB99260000-0x00007FFB99270000-memory.dmpFilesize
64KB
-
memory/1868-176-0x00007FFB9B4D0000-0x00007FFB9B4E0000-memory.dmpFilesize
64KB
-
memory/1868-138-0x00007FFB99260000-0x00007FFB99270000-memory.dmpFilesize
64KB
-
memory/1868-132-0x00007FFB9B4D0000-0x00007FFB9B4E0000-memory.dmpFilesize
64KB
-
memory/1868-174-0x00007FFB9B4D0000-0x00007FFB9B4E0000-memory.dmpFilesize
64KB
-
memory/1868-175-0x00007FFB9B4D0000-0x00007FFB9B4E0000-memory.dmpFilesize
64KB
-
memory/1868-173-0x00007FFB9B4D0000-0x00007FFB9B4E0000-memory.dmpFilesize
64KB
-
memory/1868-136-0x00007FFB9B4D0000-0x00007FFB9B4E0000-memory.dmpFilesize
64KB
-
memory/1868-135-0x00007FFB9B4D0000-0x00007FFB9B4E0000-memory.dmpFilesize
64KB
-
memory/1868-133-0x00007FFB9B4D0000-0x00007FFB9B4E0000-memory.dmpFilesize
64KB
-
memory/1868-134-0x00007FFB9B4D0000-0x00007FFB9B4E0000-memory.dmpFilesize
64KB
-
memory/3000-162-0x0000000004D50000-0x0000000004D6E000-memory.dmpFilesize
120KB
-
memory/3000-160-0x0000000005090000-0x00000000050F6000-memory.dmpFilesize
408KB
-
memory/3000-161-0x0000000005230000-0x0000000005296000-memory.dmpFilesize
408KB
-
memory/3000-159-0x0000000004FF0000-0x0000000005012000-memory.dmpFilesize
136KB
-
memory/3000-163-0x00000000065C0000-0x0000000006604000-memory.dmpFilesize
272KB
-
memory/3000-164-0x0000000007350000-0x00000000073C6000-memory.dmpFilesize
472KB
-
memory/3000-165-0x0000000007A50000-0x00000000080CA000-memory.dmpFilesize
6.5MB
-
memory/3000-166-0x00000000073F0000-0x000000000740A000-memory.dmpFilesize
104KB
-
memory/3000-158-0x00000000052A0000-0x00000000058C8000-memory.dmpFilesize
6.2MB
-
memory/3000-157-0x00000000026A0000-0x00000000026D6000-memory.dmpFilesize
216KB
-
memory/3000-156-0x0000000000000000-mapping.dmp
-
memory/4372-155-0x0000000005140000-0x000000000514A000-memory.dmpFilesize
40KB
-
memory/4372-154-0x0000000005080000-0x0000000005112000-memory.dmpFilesize
584KB
-
memory/4372-153-0x0000000005590000-0x0000000005B34000-memory.dmpFilesize
5.6MB
-
memory/4372-152-0x00000000005D0000-0x00000000006BC000-memory.dmpFilesize
944KB
-
memory/4372-149-0x0000000000000000-mapping.dmp