Analysis
-
max time kernel
141s -
max time network
21s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
03-02-2021 20:21
General
-
Target
certificate 02.21.doc
-
Size
96KB
-
MD5
615b4a33d5ee7d3833430c54acec1a2a
-
SHA1
fdc6f96cf299966b467052a37d548caa4e7428c6
-
SHA256
dd68914c1082dc3a17171c8e6f81330058db042bba3b6dc78da3d304bc78bcd2
-
SHA512
f6dca8c6f8ffc6e7c119ea057f008c6913c304612b3900e18ea9c70decebc8c9966b71ddb7c8a6d1f2c25c6b17bb893792d2a7269ace4092d4463f99a8ae553b
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 9 IoCs
-
Modifies registry class 280 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 40 IoCs
-
Suspicious use of SetWindowsHookEx 17 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\certificate 02.21.doc"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\programdata\xml.com"C:\programdata\xml.com" process list /format : ".xsl"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 c:\programdata\24251.jpg3⤵
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\xml.comMD5
a03cf3838775e0801a0894c8bacd2e56
SHA14368dbd172224ec9461364be1ac9dffc5d9224a8
SHA256132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81
SHA512b9e2467157139cc288e027d34865034eaf441dd69981a91df18d60e6b6a7cc53f8102230d18e4c6de2f3ad3ab413d755663bfc82d3033e52faf38509a7cdfcdc
-
C:\Users\Admin\AppData\Local\Temp\.xslMD5
0d2c37a5e112e48aff1683b6864fedbd
SHA121980bd3fe9c66f8e102a1dacb7dc5a7e833b256
SHA2566251fdc6ba89ebebc8a6a97737658cb800693810c9a341dc0531f9880ec0e07e
SHA512c85f9dadfc75161240e33e7611fbdebb441fdb09f50a650bac7a619e7d8cc7c9a35f19ee0be867c5b7860b6a73777396cb19c701bb0440f77222886afa269b55
-
\??\c:\programdata\24251.jpgMD5
f348de7f7a1559a450569e6bf0819f7f
SHA13a84851ad9ef5cb5e48362c2d70cbe99f4b0b41f
SHA2560cfdcc3e915f21a5cec559204e39fb95fda11aecd744ac94cd57aeb11a1f95c1
SHA5126db5c4695c4727da86cc18a58bba76614d39599ddc15a67be4ba0ab3078434ecff1fa6247b612d57500b6baaba657623287b16ba1dadada17c69c12a11ebfb2e
-
\ProgramData\xml.comMD5
a03cf3838775e0801a0894c8bacd2e56
SHA14368dbd172224ec9461364be1ac9dffc5d9224a8
SHA256132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81
SHA512b9e2467157139cc288e027d34865034eaf441dd69981a91df18d60e6b6a7cc53f8102230d18e4c6de2f3ad3ab413d755663bfc82d3033e52faf38509a7cdfcdc
-
\ProgramData\xml.comMD5
a03cf3838775e0801a0894c8bacd2e56
SHA14368dbd172224ec9461364be1ac9dffc5d9224a8
SHA256132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81
SHA512b9e2467157139cc288e027d34865034eaf441dd69981a91df18d60e6b6a7cc53f8102230d18e4c6de2f3ad3ab413d755663bfc82d3033e52faf38509a7cdfcdc
-
\ProgramData\xml.comMD5
a03cf3838775e0801a0894c8bacd2e56
SHA14368dbd172224ec9461364be1ac9dffc5d9224a8
SHA256132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81
SHA512b9e2467157139cc288e027d34865034eaf441dd69981a91df18d60e6b6a7cc53f8102230d18e4c6de2f3ad3ab413d755663bfc82d3033e52faf38509a7cdfcdc
-
\ProgramData\xml.comMD5
a03cf3838775e0801a0894c8bacd2e56
SHA14368dbd172224ec9461364be1ac9dffc5d9224a8
SHA256132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81
SHA512b9e2467157139cc288e027d34865034eaf441dd69981a91df18d60e6b6a7cc53f8102230d18e4c6de2f3ad3ab413d755663bfc82d3033e52faf38509a7cdfcdc
-
memory/324-6-0x00000000062E0000-0x00000000062E2000-memory.dmpFilesize
8KB
-
memory/324-2-0x0000000072F91000-0x0000000072F94000-memory.dmpFilesize
12KB
-
memory/324-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/324-3-0x0000000070A11000-0x0000000070A13000-memory.dmpFilesize
8KB
-
memory/828-12-0x0000000000000000-mapping.dmp
-
memory/828-13-0x000007FEFC3E1000-0x000007FEFC3E3000-memory.dmpFilesize
8KB
-
memory/1156-16-0x0000000000000000-mapping.dmp
-
memory/1156-17-0x00000000766C1000-0x00000000766C3000-memory.dmpFilesize
8KB
-
memory/1156-19-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1252-15-0x000007FEF7D30000-0x000007FEF7FAA000-memory.dmpFilesize
2.5MB
-
memory/1980-10-0x0000000000000000-mapping.dmp
