Analysis
- max time kernel
143s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/03/2024, 00:03
General
- Target e049ebf053a2af12997d932864460793.xlsb
- Size 320KB
- Sample240327-achz7sfc87
- SHA256 b3a4ef5a4d3a9f35b23c6d2d6f8e1f433cc0084ebccf859b02da67ab8592988f
Malware Config
Signatures
- Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 2 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 42 IoCs
- Suspicious use of SetWindowsHookEx 16 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e049ebf053a2af12997d932864460793.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exewmic process call create 'mshta C:\ProgramData\pSteAmtxTzX.sct'2⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\mshta.exemshta C:\ProgramData\pSteAmtxTzX.sct1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
pSteAmtxTzX.sct
memory/3728-5-0x00007FFD484B0000-0x00007FFD484C0000-memory.dmp
memory/3728-57-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
memory/3728-4-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
memory/3728-3-0x00007FFD484B0000-0x00007FFD484C0000-memory.dmp
memory/3728-6-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
memory/3728-0-0x00007FFD484B0000-0x00007FFD484C0000-memory.dmp
memory/3728-7-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
memory/3728-8-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
memory/3728-10-0x00007FFD46340000-0x00007FFD46350000-memory.dmp
memory/3728-11-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
memory/3728-9-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
memory/3728-12-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
memory/3728-2-0x00007FFD484B0000-0x00007FFD484C0000-memory.dmp
memory/3728-13-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
memory/3728-37-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
memory/3728-16-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
memory/3728-17-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
memory/3728-1-0x00007FFD484B0000-0x00007FFD484C0000-memory.dmp
memory/3728-14-0x00007FFD46340000-0x00007FFD46350000-memory.dmp
memory/3728-53-0x00007FFD484B0000-0x00007FFD484C0000-memory.dmp
memory/3728-54-0x00007FFD484B0000-0x00007FFD484C0000-memory.dmp
memory/3728-55-0x00007FFD484B0000-0x00007FFD484C0000-memory.dmp
memory/3728-15-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
memory/3728-56-0x00007FFD484B0000-0x00007FFD484C0000-memory.dmp
memory/3728-58-0x00007FFD88430000-0x00007FFD88625000-memory.dmp
memory/3728-59-0x00007FFD88430000-0x00007FFD88625000-memory.dmp