Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    13-01-2021 15:30

General

  • Target

    0113_35727287.doc

  • Size

    633KB

  • MD5

    e688ebdab6916fc89610c89ccb94ce16

  • SHA1

    a91447a728148e321fc576c6b55b3e9ba886bb8a

  • SHA256

    772c897ffdfb824b31d70ea360224714ab9bb83659bd431897cc74dd2defc2f3

  • SHA512

    7ec1f08fff2ae185421ddf6e1089349b1e9a0c0123c75d147b80c5ae0fc18938c2f781fc44d84e8abe0c4e251dbdfe3ea9499087345c39291fa96b9d18a39bf2

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0113_35727287.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1248
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Templates\W0rd.dll,DllUnregisterServer
        2⤵
        • Process spawned unexpected child process
        PID:1776

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1248-2-0x0000000000000000-mapping.dmp
    • memory/1776-3-0x0000000000000000-mapping.dmp