33a24ad4b225880bee5c9d40527022ea020daf2f6d7643269f4f739b3271f5de | Triage

Resubmissions

07-09-2020 14:49

200907-6g4j1lsg4a 8

07-09-2020 14:46

200907-621166mbea 8

07-09-2020 14:43

200907-arlway4y22 8

07-09-2020 14:40

200907-2gfycfzzsn 8

07-09-2020 14:37

200907-48ed1pf1qa 8

07-09-2020 14:30

200907-nrhrd8w9xa 8

07-09-2020 14:27

200907-7xkbfnkxne 8

07-09-2020 13:24

200907-hmxpvsyqqx 8

07-09-2020 13:22

200907-y2l4q28146 8

07-09-2020 13:19

200907-snqv561r56 8

Analysis

max time kernel
114s
max time network
18s
platform
windows7_x64
resource
win7
submitted
07-09-2020 13:19

Sharing

Report Analysis Logs

General

Target

HRCComplaintProcedureForm (7).doc
Size

80KB
MD5

a411bb05ee4192202c88efdbd54552db
SHA1

6b0acf8175d39a1008bf9fb0d3c45bb63a3361e9
SHA256

33a24ad4b225880bee5c9d40527022ea020daf2f6d7643269f4f739b3271f5de
SHA512

6e424b2c2a7881d4969ddfaef595822f3d987e8fc49f578118c6d4ba25461ef53613405394f4ac366606ecfda08ede4d22f436f182aaee82ba9b5f7962cce6f4

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

Processes:

mmc.exe

description ioc process

File opened for modification C:\Windows\system32\devmgmt.msc mmc.exe

Drops file in Windows directory 2 IoCs

Processes:

mmc.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.app.log	mmc.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	mmc.exe

Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

912 WINWORD.EXE
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

mmc.exe

pid process

284 mmc.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

mmc.exe

description	pid	process
Token: 33	284	mmc.exe
Token: SeIncBasePriorityPrivilege	284	mmc.exe
Token: 33	284	mmc.exe
Token: SeIncBasePriorityPrivilege	284	mmc.exe
Token: SeRestorePrivilege	284	mmc.exe
Token: SeRestorePrivilege	284	mmc.exe
Token: SeRestorePrivilege	284	mmc.exe
Token: SeRestorePrivilege	284	mmc.exe
Token: SeRestorePrivilege	284	mmc.exe
Token: SeRestorePrivilege	284	mmc.exe
Token: SeRestorePrivilege	284	mmc.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

WINWORD.EXEmmc.exe

pid process

912 WINWORD.EXE
912 WINWORD.EXE
284 mmc.exe
284 mmc.exe
284 mmc.exe
284 mmc.exe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\HRCComplaintProcedureForm (7).doc"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:912

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1268

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:284

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...