Resubmissions

20/11/2020, 19:03

201120-cx5fwpl1we 10

20/11/2020, 18:56

201120-qq16sh22ka 10

Analysis

  • max time kernel
    56s
  • max time network
    13s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    20/11/2020, 19:03

General

  • Target

    Patent_656419797_as-of-27thJune2020.doc

  • Size

    1006KB

  • MD5

    45df50ea19045aa1d48ee962246c8c56

  • SHA1

    86d00261ba88265bdd6b27ca76c44e2769c5088e

  • SHA256

    cf577313173f345525aff5b7efe4c709507da92a9c9211559f6ff6af00db44b2

  • SHA512

    262d148ed613ad6659c9f186537a50c8228182c58616de8b03687389ade4541e2cb829eee99a86b89c69af7e4d854e38813a030b528cb83f1fdefca96beb9bf4

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Patent_656419797_as-of-27thJune2020.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1356
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Documents and Settings\Admin\Exerwa\decode.bat""
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:1876
        • C:\Windows\SysWOW64\certutil.exe
          certutil -f -decode exec.enc exec.exe
          3⤵
            PID:1688
          • C:\Windows\SysWOW64\certutil.exe
            certutil -f -decode script.enc script.ps1
            3⤵
              PID:1624

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1808-1-0x00000000006B1000-0x00000000006D2000-memory.dmp

          Filesize

          132KB