Resubmissions
09-06-2020 22:21
200609-59aaj585qn 10Analysis
-
max time kernel
138s -
max time network
135s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09-06-2020 22:21
Static task
static1
Behavioral task
behavioral1
Sample
bid 06.09.2020.doc
Resource
win7v200430
0 signatures
0 seconds
General
-
Target
bid 06.09.2020.doc
-
Size
117KB
-
MD5
604ffddf9b128893501e078cf20614b4
-
SHA1
00ab48b309631ea1420542e84792619fef594b0f
-
SHA256
ecd83bffe02f85d61cebfd27c78e305e427ff5ad30c3cf6c03db5b59a5dc7997
-
SHA512
f5437529f735bbbbdc36891d49375eaaa2fe03b48b802dbc6826ede3e55ea337e7a61dc09249fb92c5da32717b58fc242ee80433bc473e8ddd49ad65c00512fb
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
Processes:
WINWORD.EXEpid process 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3656 WINWORD.EXE 3656 WINWORD.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
WINWORD.EXEregsvr32.exeregsvr32.exedescription pid process target process PID 3656 wrote to memory of 3944 3656 WINWORD.EXE regsvr32.exe PID 3656 wrote to memory of 3944 3656 WINWORD.EXE regsvr32.exe PID 3944 wrote to memory of 3896 3944 regsvr32.exe regsvr32.exe PID 3944 wrote to memory of 3896 3944 regsvr32.exe regsvr32.exe PID 3944 wrote to memory of 3896 3944 regsvr32.exe regsvr32.exe PID 3896 wrote to memory of 1896 3896 regsvr32.exe wscript.exe PID 3896 wrote to memory of 1896 3896 regsvr32.exe wscript.exe PID 3896 wrote to memory of 1896 3896 regsvr32.exe wscript.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 3896 regsvr32.exe -
Valak JavaScript Loader 1 IoCs
Processes:
resource yara_rule C:\Users\Public\CCGYPWTwr.iySAE valak -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3944 3656 regsvr32.exe WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\bid 06.09.2020.doc" /o ""1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Checks processor information in registry
PID:3656 -
C:\Windows\SYSTEM32\regsvr32.exeregsvr32 c:\programdata\76497199.dat2⤵
- Suspicious use of WriteProcessMemory
- Process spawned unexpected child process
PID:3944 -
C:\Windows\SysWOW64\regsvr32.exec:\programdata\76497199.dat3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:3896 -
C:\Windows\SysWOW64\wscript.exewscript.exe //E:jscript "C:\Users\Public\CCGYPWTwr.iySAE4⤵PID:1896
-
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1664