Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-02-2024 09:54

General

  • Target

    a8dc4d27425b6112f42ec1ddcc48eb06.xls

  • Size

    36KB

  • MD5

    a8dc4d27425b6112f42ec1ddcc48eb06

  • SHA1

    90c4f621dbbb9a693876013bce7bce09019f4623

  • SHA256

    89d9dcfaf2a84a0c07ae64c0c6cc6654bddfdfed0a1f2db63004d7373308b8af

  • SHA512

    1c1e0761752d644bb658e001b64883a90c7c883733157a79d4fefe28108dfbd47ca52a51caf97b4818d380cc1bba70535ecf3232eaa92dcc683fc13ce0cd8514

  • SSDEEP

    768:MPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJ1bQMA6y44I2zJRqcX:Yok3hbdlylKsgqopeJBWhZFGkE+cL2NR

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\a8dc4d27425b6112f42ec1ddcc48eb06.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2572
    • C:\Windows\explorer.exe
      explorer.exe C:\Users\Public\Documents\zOg.vbs
      2⤵
      • Process spawned unexpected child process
      PID:3472
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2052
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\zOg.vbs"
      2⤵
      • Blocklisted process makes network request
      PID:2220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Documents\zOg.vbs

    Filesize

    584B

    MD5

    ab451593f281bbff9052e6006a4ae9e1

    SHA1

    54bdbb5d886ac489d8fc42dc6077737aedf4d437

    SHA256

    6faad2b8a7703d833488ef272f4744419f4934e632c43c0c9781d369ce5a94f3

    SHA512

    4a80384e7b3fd2ae5fb281eceea7a2d0bcaceaa094933dcfc9defc2c46073670d89672d43507088952e0325b6be6aeaa5d14171d759b0903ce2de5e978f867fe

  • memory/2572-11-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-4-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-14-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-15-0x00007FFD896F0000-0x00007FFD89700000-memory.dmp

    Filesize

    64KB

  • memory/2572-5-0x00007FFD8B910000-0x00007FFD8B920000-memory.dmp

    Filesize

    64KB

  • memory/2572-6-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-7-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-8-0x00007FFD8B910000-0x00007FFD8B920000-memory.dmp

    Filesize

    64KB

  • memory/2572-10-0x00007FFD896F0000-0x00007FFD89700000-memory.dmp

    Filesize

    64KB

  • memory/2572-9-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-12-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-0-0x00007FFD8B910000-0x00007FFD8B920000-memory.dmp

    Filesize

    64KB

  • memory/2572-32-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-2-0x00007FFD8B910000-0x00007FFD8B920000-memory.dmp

    Filesize

    64KB

  • memory/2572-3-0x00007FFD8B910000-0x00007FFD8B920000-memory.dmp

    Filesize

    64KB

  • memory/2572-16-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-17-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-18-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-19-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-20-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-21-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-22-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-1-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-30-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-31-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-13-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmp

    Filesize

    2.0MB