Analysis
-
max time kernel
139s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-12-2020 00:00
Static task
static1
Behavioral task
behavioral1
Sample
specifics,12.16.2020.doc
Resource
win7v20201028
General
-
Target
specifics,12.16.2020.doc
-
Size
92KB
-
MD5
ddf0d9e3d86f7542de8f619f00a7725a
-
SHA1
082ba5b236a3b9a0ae5d8d6a070c3e764792e7f2
-
SHA256
7561a0f5134bf3dbaa34d09f2a20dc01057626e74d7df42072bef06d6bd6ee95
-
SHA512
7daf04c544334ba04c7f0e2b6654fee58ecf85cc4dabd42d9237a72d4d0beb833c4d72dfff9cc2f957b8eb6c68d18dcf4b24d919ca11ee88e24224619301c3d7
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 396 936 rundll32.exe WINWORD.EXE -
Blocklisted process makes network request 8 IoCs
Processes:
mshta.exerundll32.exeflow pid process 22 3576 mshta.exe 27 3260 rundll32.exe 29 3260 rundll32.exe 31 3260 rundll32.exe 33 3260 rundll32.exe 35 3260 rundll32.exe 37 3260 rundll32.exe 38 3260 rundll32.exe -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3260 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 1 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 936 WINWORD.EXE 936 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3260 rundll32.exe 3260 rundll32.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
WINWORD.EXEpid process 936 WINWORD.EXE 936 WINWORD.EXE 936 WINWORD.EXE 936 WINWORD.EXE 936 WINWORD.EXE 936 WINWORD.EXE 936 WINWORD.EXE 936 WINWORD.EXE 936 WINWORD.EXE 936 WINWORD.EXE 936 WINWORD.EXE 936 WINWORD.EXE 936 WINWORD.EXE 936 WINWORD.EXE 936 WINWORD.EXE 936 WINWORD.EXE 936 WINWORD.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
WINWORD.EXErundll32.exemshta.exedescription pid process target process PID 936 wrote to memory of 396 936 WINWORD.EXE rundll32.exe PID 936 wrote to memory of 396 936 WINWORD.EXE rundll32.exe PID 396 wrote to memory of 3576 396 rundll32.exe mshta.exe PID 396 wrote to memory of 3576 396 rundll32.exe mshta.exe PID 396 wrote to memory of 3576 396 rundll32.exe mshta.exe PID 3576 wrote to memory of 3260 3576 mshta.exe rundll32.exe PID 3576 wrote to memory of 3260 3576 mshta.exe rundll32.exe PID 3576 wrote to memory of 3260 3576 mshta.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\specifics,12.16.2020.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" url.dll,OpenURL c:\users\public\index.hta2⤵
- Process spawned unexpected child process
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\index.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" c:\programdata\ah6Q0.pdf,ShowDialogA -r4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\users\public\index.htaMD5
40c7509a0ef4fd0ef94508819d1d29ac
SHA14842a4ed5b75a445035fc6f800f9166a4e277928
SHA25619349c14b4633c5d1f18d7cafb375e71c7a32862620245bec6b41836fe24aa5a
SHA512539967b7839370d5505eeabb347052e3abd013c44b62c6a0eed81cddb8124acb87576251d43b1fd23f2b4b6e17b0700da76ad80087980ea316d7c33b3f0bc402
-
\??\c:\programdata\ah6Q0.pdfMD5
bff30c762b160a79e2f4356e1a605694
SHA1d72529431ae4eaea21288a5564ae1adb11938fc5
SHA256adb85cdfe36c9f27d90b727f3dd4a59fe097dafb177208fc5951370cdb8fdb0f
SHA51251841cc47d00db14d314c9d60dc41eafc25f82e4dfe9ab5feb54b303da1d4e01514e4613ff17656bc15682366a709741e463bb2cd0af6818fa1521cef40d7140
-
\ProgramData\ah6Q0.pdfMD5
bff30c762b160a79e2f4356e1a605694
SHA1d72529431ae4eaea21288a5564ae1adb11938fc5
SHA256adb85cdfe36c9f27d90b727f3dd4a59fe097dafb177208fc5951370cdb8fdb0f
SHA51251841cc47d00db14d314c9d60dc41eafc25f82e4dfe9ab5feb54b303da1d4e01514e4613ff17656bc15682366a709741e463bb2cd0af6818fa1521cef40d7140
-
memory/396-6-0x0000000000000000-mapping.dmp
-
memory/936-2-0x00000181ECFB0000-0x00000181ED5E7000-memory.dmpFilesize
6.2MB
-
memory/3260-9-0x0000000000000000-mapping.dmp
-
memory/3576-8-0x0000000000000000-mapping.dmp