Overview

overview

6

Static

static

test.dotm

windows7_x64

6

test.dotm

windows10_x64

1

Analysis

  • max time kernel
    147s
  • max time network
    105s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    10-07-2020 19:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    test.dotm

  • Size

    568KB

  • MD5

    11d4bf7dcc7c74fe607b87c3760f7fc2

  • SHA1

    27899cc8fadfab2aca1549a438abff8827301a33

  • SHA256

    03f37cc6e13f1f176ddeb40b6b53c6722c9b06d4c27f93d3af7863b782933aac

  • SHA512

    f683c5931b9e1fc36d182617823f5fb8e1e03abbb3ecc954bff1a7cd70bbd478c74b6127336f408dac614c24f20d5cfaedab39a4bba84ce02e68be1c474e3391

Score
6/10
evasionspywaretrojan

Malware Config

Signatures

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • js 2 IoCs
  • Checks whether UAC is enabled 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Modifies registry class 280 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    evasionspywaretrojan
  • Modifies Internet Explorer settings 1 TTPs 78 IoCs
    adwarespyware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\test.dotm"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • Modifies registry class
    • Modifies system certificate store
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    PID:1456
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://gregmaxey.com/word_tip_pages/installing_employing_macros.html
      2⤵
      • Suspicious use of FindShellTrayWindow
      • Checks whether UAC is enabled
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • Modifies Internet Explorer settings
      PID:1888
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:2
        3⤵
        • Checks whether UAC is enabled
        • Suspicious use of SetWindowsHookEx
        • Modifies system certificate store
        • Modifies Internet Explorer settings
        PID:820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\j8hu3ld\imagestore.dat
    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YZK7YJGT\installing_employing_macros[1].htm
    Download Submit
  • memory/820-9-0x0000000000000000-mapping.dmp
    Download
  • memory/820-26-0x000000007EF50000-0x000000007EF60000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1456-0-0x00000000061A0000-0x00000000061A4000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1456-8-0x000000000B920000-0x000000000B924000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1456-7-0x000000000A070000-0x000000000A074000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1456-4-0x0000000007260000-0x0000000007460000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1456-3-0x0000000007260000-0x0000000007460000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1456-2-0x0000000000557000-0x000000000055B000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1888-6-0x0000000000000000-mapping.dmp
    Download