Overview

overview

10

Static

static

0112_286068331.doc

windows7_x64

10

0112_286068331.doc

windows10_x64

10

Analysis

  • max time kernel
    143s
  • max time network
    141s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    12-01-2021 20:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0112_286068331.doc

  • Size

    369KB

  • MD5

    90bc76c00a54ec40a5c02680c4ac0adc

  • SHA1

    fd2a43d3e36adbfd2f6d4eb7aa30ff29e7f1ebb8

  • SHA256

    56f1795abf78f798a51b9224a5deb17aedd924629136832b526c93339f525e56

  • SHA512

    455f016727495e7438ea532e9fe25e2508876443ba27193c3b2fe8d2029b061bd8c0ab623a8806496cd65fa1b233a5662372c4a3baf4836a6edc7de1626c69f5

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0112_286068331.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:632
      • C:\Windows\System32\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Templates\W0rd.dll,DllUnregisterServer
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:3924
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Templates\W0rd.dll,DllUnregisterServer
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:2428
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 1344
            4⤵
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1908

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\W0rd.dll
      MD5

      9ad6611f57f355f29b6cb07035d72c6b

      SHA1

      bb9c38db77b96282ee2c9a06b59fb6350730bfc2

      SHA256

      cdcd5ee8b80d3a3863e0c55d4af5384522144011b071d00c9c71ae009305f130

      SHA512

      b371568f23b4e89b4f6cf91b8a42bae917a790a08e0b428b9fc114b902581b3f744521cfdc2dea8ad3a728ba45153c57e821d37e0744d6cb50dcaceea4e6817d

      Download Submit
    • \Users\Admin\AppData\Roaming\Microsoft\Templates\W0rd.dll
      MD5

      9ad6611f57f355f29b6cb07035d72c6b

      SHA1

      bb9c38db77b96282ee2c9a06b59fb6350730bfc2

      SHA256

      cdcd5ee8b80d3a3863e0c55d4af5384522144011b071d00c9c71ae009305f130

      SHA512

      b371568f23b4e89b4f6cf91b8a42bae917a790a08e0b428b9fc114b902581b3f744521cfdc2dea8ad3a728ba45153c57e821d37e0744d6cb50dcaceea4e6817d

      Download Submit
    • memory/632-3-0x0000000000000000-mapping.dmp
      Download
    • memory/632-4-0x0000000002E00000-0x0000000002E01000-memory.dmp
      Filesize

      4KB

      Download
    • memory/880-2-0x00000131E3FE0000-0x00000131E4617000-memory.dmp
      Filesize

      6.2MB

      Download
    • memory/1908-9-0x0000000004300000-0x0000000004301000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2428-7-0x0000000000000000-mapping.dmp
      Download
    • memory/3924-5-0x0000000000000000-mapping.dmp
      Download