Overview

overview

10

Static

static

statistics.12.20.doc

windows7_x64

10

statistics.12.20.doc

windows10_x64

10

Analysis

  • max time kernel
    139s
  • max time network
    134s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    11-12-2020 18:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    statistics.12.20.doc

  • Size

    83KB

  • MD5

    3132824fb649bb9358abffdc67542593

  • SHA1

    a1bd53255b81a3dc7d3be1a2ca87522cbd758431

  • SHA256

    785e7a1f4e7d48efff95dd5d5574d7326845e67ccf3dc9b4dd228d25246ba933

  • SHA512

    04a8970679c9dc7d9732278cbb1f722c52ac2576c3b949a44e76d57cdc46068466fa2f5e1498dfbe1474bc7d036120459a4096bb69615657e3df9b20f55dfd5f

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 8 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\statistics.12.20.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:576
    • C:\Windows\SYSTEM32\rundll32.exe
      rundll32 c:\programdata\iwqOx.pdf,ShowDialogA -r
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1532
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32 c:\programdata\iwqOx.pdf,ShowDialogA -r
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:2204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • \??\c:\programdata\iwqOx.pdf
    MD5

    8f346905de2448acdaa852abe048edf4

    SHA1

    ec05425496016bc337b671ec682c2780fdd8f8d8

    SHA256

    8a18bfcc126278cc95b6859c1557018d3c979be08c460a8099b33a847713d414

    SHA512

    9ed34388b3223a38157b1a789279b25f8e11a17f5e45373f42268de7018285c6ca15ed798d11ab0b06d0924191462b2b3e4edfdcb3d824a4d41104dfc422f390

    Download Submit
  • \ProgramData\iwqOx.pdf
    MD5

    8f346905de2448acdaa852abe048edf4

    SHA1

    ec05425496016bc337b671ec682c2780fdd8f8d8

    SHA256

    8a18bfcc126278cc95b6859c1557018d3c979be08c460a8099b33a847713d414

    SHA512

    9ed34388b3223a38157b1a789279b25f8e11a17f5e45373f42268de7018285c6ca15ed798d11ab0b06d0924191462b2b3e4edfdcb3d824a4d41104dfc422f390

    Download Submit
  • memory/576-2-0x00007FFE95D50000-0x00007FFE96387000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/1532-9-0x0000000000000000-mapping.dmp
    Download
  • memory/2204-11-0x0000000000000000-mapping.dmp
    Download