648eb3dd8252073b53f16887084c5415f56e90877aee69d29393efe1382679b4

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-12-2024 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eicar-standard-antivirus-test-files/eicar-excel-macro-powershell-echo.xlsm
Size

11KB
MD5

9bfbd61f017780a547de363a670c2fa0
SHA1

98c2d4049f283d2a78e10f685fc8849ede58b2eb
SHA256

75a444008d2ec38b2de7dc35e5da389c266c5fb689b6f3dc639a869a1c3f0a5b
SHA512

824766f425b90fb9191e12011e4d407ee50d1d5a0daab7c92ed8c63b0b85aae8ad1bf3c6ab3238b4a4a1991d856f2453eb1ebe38f85413f0851afedf6760f941
SSDEEP

192:HeoDZW59dm88DfieY63G4lV8f2UVw0QxizT3W7+p+1iTvflLIn:HeoavpAiXkz8f2UVvQITMaTu

Score

10^/10

defense_evasion discovery

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	2780	3028	powershell.exe	29

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Office loads VBA resources, possible macro or embedded object present

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3028	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2780	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3028	EXCEL.EXE
3028	EXCEL.EXE
3028	EXCEL.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2780	3028	EXCEL.EXE	30
PID 3028 wrote to memory of 2780	3028	EXCEL.EXE	30
PID 3028 wrote to memory of 2780	3028	EXCEL.EXE	30
PID 3028 wrote to memory of 2780	3028	EXCEL.EXE	30

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\eicar-standard-antivirus-test-files\eicar-excel-macro-powershell-echo.xlsm
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoExit -EncodedCommand ZQBjAGgAbwAgACIAWAA1AE8AIQBQACUAQABBAFAAWwA0AFwAUABaAFgANQA0ACgAUABeACkANwBDAEMAKQA3AH0AYAAkAEUASQBDAEEAUgAtAFMAVABBAE4ARABBAFIARAAtAEEATgBUAEkAVgBJAFIAVQBTAC0AVABFAFMAVAAtAEYASQBMAEUAIQBgACQASAArAEgAKgAiAA==
  2⤵
  - Process spawned unexpected child process
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3028-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/3028-1-0x0000000071E8D000-0x0000000071E98000-memory.dmp

Filesize
44KB

Download
memory/3028-4-0x0000000006A50000-0x0000000006B50000-memory.dmp

Filesize
1024KB

Download
memory/3028-7-0x0000000071E8D000-0x0000000071E98000-memory.dmp

Filesize
44KB

Download
memory/3028-8-0x0000000006A50000-0x0000000006B50000-memory.dmp

Filesize
1024KB

Download