Overview

overview

10

Static

static

0112_3896101931.doc

windows7_x64

10

0112_3896101931.doc

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    12-01-2021 20:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0112_3896101931.doc

  • Size

    369KB

  • MD5

    458a852da334535062f37384f3af4ff8

  • SHA1

    e22096169278426d4d5c049782a9b6469813cd3b

  • SHA256

    99b98b8c7033456ba7840ad99c65347a8026aee62bccbbac6d22ca4b0f5dfa1e

  • SHA512

    ae5dc310abac0d28d10fda06488e3636fb3b88bf56dc5a2cd6b3421c05e3a239e8000baaba73dd5e2c661e165cd9e1e14c476842a2db4073f223873e4bc03a02

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0112_3896101931.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:732
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2900
      • C:\Windows\System32\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Templates\W0rd.dll,DllUnregisterServer
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:1800
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Templates\W0rd.dll,DllUnregisterServer
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:3828
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 1332
            4⤵
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3584

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\W0rd.dll
      MD5

      585224720b1676c84f68ac12b067d7f1

      SHA1

      05a3d3c6dfc0154d33d5f2e656a529d1f71adfbb

      SHA256

      43690eaf47245d69f4bda877c562852e4a9715955c2160345cb6cc84b18ca907

      SHA512

      26371e665374d06ae56ef71a71383180b731013378b342b865b9ae0302eece57c6afb4a525781f37f18571df4a29826a3c5d528db07e86341a718c016cc7b195

      Download Submit
    • \Users\Admin\AppData\Roaming\Microsoft\Templates\W0rd.dll
      MD5

      585224720b1676c84f68ac12b067d7f1

      SHA1

      05a3d3c6dfc0154d33d5f2e656a529d1f71adfbb

      SHA256

      43690eaf47245d69f4bda877c562852e4a9715955c2160345cb6cc84b18ca907

      SHA512

      26371e665374d06ae56ef71a71383180b731013378b342b865b9ae0302eece57c6afb4a525781f37f18571df4a29826a3c5d528db07e86341a718c016cc7b195

      Download Submit
    • memory/732-2-0x00007FF99AE40000-0x00007FF99B477000-memory.dmp
      Filesize

      6.2MB

      Download
    • memory/1800-5-0x0000000000000000-mapping.dmp
      Download
    • memory/2900-3-0x0000000000000000-mapping.dmp
      Download
    • memory/2900-4-0x0000000002FD0000-0x0000000002FD1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3584-9-0x0000000004800000-0x0000000004801000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3828-7-0x0000000000000000-mapping.dmp
      Download