Analysis
-
max time kernel
139s -
max time network
134s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
29-05-2020 16:09
Static task
static1
Behavioral task
behavioral1
Sample
file.doc
Resource
win7v200430
Behavioral task
behavioral2
Sample
file.doc
Resource
win10v200430
General
-
Target
file.doc
-
Size
73KB
-
MD5
03da3c149defc051b11005c86bcbe599
-
SHA1
f95da4f19e6a289a4719415d24f1d32275761a33
-
SHA256
f7c5c10cee118eddd6c5a20c5a095032324fcb0bd368d7b7015f6646d8b5d411
-
SHA512
2d09399255220372db0e0497f0f0c0957ce5211bbe079b5999caa6a49046086461784f685811728050b992d3c7af9b7a5c9f4069c7f20828a9e38a2136d80db4
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 19 IoCs
Processes:
WINWORD.EXEpid process 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3656 WINWORD.EXE 3656 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
Regsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3952 3656 Regsvr32.exe WINWORD.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
WINWORD.EXERegsvr32.exeregsvr32.exedescription pid process target process PID 3656 wrote to memory of 3952 3656 WINWORD.EXE Regsvr32.exe PID 3656 wrote to memory of 3952 3656 WINWORD.EXE Regsvr32.exe PID 3952 wrote to memory of 3008 3952 Regsvr32.exe regsvr32.exe PID 3952 wrote to memory of 3008 3952 Regsvr32.exe regsvr32.exe PID 3952 wrote to memory of 3008 3952 Regsvr32.exe regsvr32.exe PID 3008 wrote to memory of 1924 3008 regsvr32.exe wscript.exe PID 3008 wrote to memory of 1924 3008 regsvr32.exe wscript.exe PID 3008 wrote to memory of 1924 3008 regsvr32.exe wscript.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 3008 regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\file.doc" /o ""1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SYSTEM32\Regsvr32.exeRegsvr32 c:\programdata\71061557.dat2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exec:\programdata\71061557.dat3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
-
C:\Windows\SysWOW64\wscript.exewscript.exe //E:jscript "C:\Users\Public\xSsGKcUqL.vA_YV4⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\xSsGKcUqL.vA_YV
-
\??\c:\programdata\71061557.dat
-
\ProgramData\71061557.dat
-
memory/3656-0-0x000002241E986000-0x000002241E991000-memory.dmpFilesize
44KB
-
memory/3656-1-0x000002242B4C8000-0x000002242B4CD000-memory.dmpFilesize
20KB
-
memory/3656-2-0x000002242B4C3000-0x000002242B4C8000-memory.dmpFilesize
20KB
-
memory/3656-3-0x000002242B4C8000-0x000002242B4CD000-memory.dmpFilesize
20KB
-
memory/3656-4-0x000002242B4C3000-0x000002242B4C8000-memory.dmpFilesize
20KB
-
memory/3656-5-0x000002242B4C8000-0x000002242B4CD000-memory.dmpFilesize
20KB