17f73a5cd04ca12f2a9b359d2871fc6bf198c4952dc715b57970eea0bd78471c

Resubmissions

14/02/2020, 12:41

200214-c8mbcdxx2n8

14/02/2020, 08:55

200214-nwlkaf1l7j8

14/02/2020, 05:56

200214-v1sx1y43kx8

Analysis

max time kernel
283s
max time network
47s
platform
windows7_x64
resource
win7v200213
submitted
14/02/2020, 12:41

Sharing

Copy URL Twitter E-mail

General

Target
malware.docx
Size 455KB
Sample200214-c8mbcdxx2n
SHA256 17f73a5cd04ca12f2a9b359d2871fc6bf198c4952dc715b57970eea0bd78471c
MD5 ab284dccb09484ff6a3a116152edcb75
SHA1 68bfb664e9712195e83d401b5775c475842cb72d
SHA512 5f58a93d32bedfa5d2aaef8ab27ed7a6e264f529295bbc8daadf8b2b8d85732ccfee3ae8d3b7e22f8c9d61f49cd61a098e8415e85b79674e977b0c0cc5b4e5f2
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
992	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
992	WINWORD.EXE
992	WINWORD.EXE
1704	salesforce_Report.exe
1752	커пе피&هوةпиթեյо;;ուրճг;;зedコーчВыーр咖啡.exe
992	WINWORD.EXE
992	WINWORD.EXE
992	WINWORD.EXE
992	WINWORD.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 1704	992	WINWORD.EXE	25
PID 992 wrote to memory of 1704	992	WINWORD.EXE	25
PID 992 wrote to memory of 1704	992	WINWORD.EXE	25
PID 992 wrote to memory of 1704	992	WINWORD.EXE	25
PID 1704 wrote to memory of 1752	1704	salesforce_Report.exe	26
PID 1704 wrote to memory of 1752	1704	salesforce_Report.exe	26
PID 1704 wrote to memory of 1752	1704	salesforce_Report.exe	26
PID 1704 wrote to memory of 1752	1704	salesforce_Report.exe	26
PID 1752 wrote to memory of 1756	1752	커пе피&هوةпиթեյо;;ուրճг;;зedコーчВыーр咖啡.exe	27
PID 1752 wrote to memory of 1756	1752	커пе피&هوةпиթեյо;;ուրճг;;зedコーчВыーр咖啡.exe	27
PID 1752 wrote to memory of 1756	1752	커пе피&هوةпиթեյо;;ուրճг;;зedコーчВыーр咖啡.exe	27
PID 1752 wrote to memory of 1756	1752	커пе피&هوةпиթեյо;;ուրճг;;зedコーчВыーр咖啡.exe	27
PID 1752 wrote to memory of 1756	1752	커пе피&هوةпиթեյо;;ուրճг;;зedコーчВыーр咖啡.exe	27
PID 1752 wrote to memory of 1756	1752	커пе피&هوةпиթեյо;;ուրճг;;зedコーчВыーр咖啡.exe	27

Executes dropped EXE 2 IoCs

pid	Process
1704	salesforce_Report.exe
1752	커пе피&هوةпиթեյо;;ուրճг;;зedコーчВыーр咖啡.exe

Loads dropped DLL 2 IoCs

pid	Process
1704	salesforce_Report.exe
1704	salesforce_Report.exe

Office loads VBA resources, possible macro or embedded object present

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\malware.docx"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992
- C:\Users\Admin\AppData\Local\Temp\salesforce_Report.exe
  "C:\Users\Admin\AppData\Local\Temp\salesforce_Report.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1704
- - C:\ProgramData\커пе피&هوةпиթեյо;;ուրճг;;зedコーчВыーр咖啡.exe
    "C:\ProgramData\커пе피&هوةпиթեյо;;ուրճг;;зedコーчВыーр咖啡.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - Executes dropped EXE
    PID:1752
  - - C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      PID:1756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-0-0x0000000005A70000-0x0000000005A74000-memory.dmp

Download

memory/1704-6-0x00000000004C0000-0x00000000004F4000-memory.dmp

Download

memory/1752-11-0x00000000005C0000-0x00000000005F4000-memory.dmp

Download

memory/1752-13-0x0000000000800000-0x0000000000831000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads