Overview

overview

8

Static

static

8

HRCComplai...7).doc

windows7_x64

8

HRCComplai...7).doc

windows10_x64

4

Resubmissions

07-09-2020 14:49

200907-6g4j1lsg4a 8

07-09-2020 14:46

200907-621166mbea 8

07-09-2020 14:43

200907-arlway4y22 8

07-09-2020 14:40

200907-2gfycfzzsn 8

07-09-2020 14:37

200907-48ed1pf1qa 8

07-09-2020 14:30

200907-nrhrd8w9xa 8

07-09-2020 14:27

200907-7xkbfnkxne 8

07-09-2020 13:24

200907-hmxpvsyqqx 8

07-09-2020 13:22

200907-y2l4q28146 8

07-09-2020 13:19

200907-snqv561r56 8

Analysis

  • max time kernel
    148s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    07-09-2020 13:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    HRCComplaintProcedureForm (7).doc

  • Size

    80KB

  • MD5

    a411bb05ee4192202c88efdbd54552db

  • SHA1

    6b0acf8175d39a1008bf9fb0d3c45bb63a3361e9

  • SHA256

    33a24ad4b225880bee5c9d40527022ea020daf2f6d7643269f4f739b3271f5de

  • SHA512

    6e424b2c2a7881d4969ddfaef595822f3d987e8fc49f578118c6d4ba25461ef53613405394f4ac366606ecfda08ede4d22f436f182aaee82ba9b5f7962cce6f4

Score
8/10
stealeradwarepersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 32 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs
  • Installs/modifies Browser Helper Object 2 TTPs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • JavaScript code in executable 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Modifies service 2 TTPs 285 IoCs
    persistence
  • Drops file in Program Files directory 275 IoCs
  • Drops file in Windows directory 53 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 150 IoCs
  • Modifies registry class 659 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 725 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\HRCComplaintProcedureForm (7).doc"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1080
  • C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2036
  • C:\Program Files\Microsoft Office\Office14\SELFCERT.EXE
    "C:\Program Files\Microsoft Office\Office14\SELFCERT.EXE"
    1⤵
      PID:1408
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
        PID:1500
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Modifies service
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1556
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding C156A40354461BD0990E5E5FEDF19FF8
          2⤵
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          PID:736
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 57D0DF2783ADC481B62429DCA585DF0F M Global\MSI0000
          2⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:896
          • C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe
            "C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe" -AU_LAUNCH_MODE=5
            3⤵
            • Executes dropped EXE
            PID:1108
        • C:\Windows\syswow64\MsiExec.exe
          "C:\Windows\syswow64\MsiExec.exe" /Z "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\authplay.dll"
          2⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:820
        • C:\Windows\system32\MsiExec.exe
          C:\Windows\system32\MsiExec.exe -Embedding A398FC38C0DBEA1942D0ECE7E1F3DCAA
          2⤵
          • Loads dropped DLL
          PID:1176
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Modifies service
        • Suspicious use of AdjustPrivilegeToken
        PID:796
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12" "" "" "6d110b0a3" "0000000000000000" "0000000000000540" "00000000000003DC"
        1⤵
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:1072
      • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe
        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
        1⤵
        • Loads dropped DLL
        • Modifies service
        PID:1092
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot13" "" "" "66d15495b" "0000000000000000" "0000000000000540" "0000000000000588"
        1⤵
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        PID:1504

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Browser Extensions

      1
      T1176

      Modify Existing Service

      1
      T1031

      Privilege Escalation

      Defense Evasion

      Modify Registry

      4
      T1112

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      Peripheral Device Discovery

      1
      T1120

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads