Overview

overview

10

Static

static

8

order-01.21.doc

windows7_x64

10

order-01.21.doc

windows10_x64

10

Analysis

  • max time kernel
    138s
  • max time network
    132s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    04-02-2021 19:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    order-01.21.doc

  • Size

    76KB

  • MD5

    26b0cb677aca95ebdb0de2f0642cdf50

  • SHA1

    fb55654ff3a64118c2abf1aa53eabebf100a1156

  • SHA256

    e896fde31c7ac2d9beadc62b21e9828eb4be9df8fad76be1f1a77049232b7af6

  • SHA512

    bf34348aec1e81cc4a1d8a0443c35f5787a67a96d0faf6a967d14a84b956af248d96ab939fa53f7ebcea4d1220567e148f10b1d1e5ce2442abc639f1d3e210ca

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Drops file in Windows directory 1 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 163 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\order-01.21.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:412
    • C:\Windows\explorer.exe
      explorer c:\programdata\aZmqL.hta
      2⤵
      • Process spawned unexpected child process
      PID:1640
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:188
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\aZmqL.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      2⤵
        PID:976
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 1312
          3⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:1772
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3416
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:1244
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2896
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:4028

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\aZmqL.hta
      MD5

      5050ab030cad77071b848d900adb1524

      SHA1

      64ae91d58e6a014f3a2b812d2ffd6e78725f7caf

      SHA256

      b9228d88616a1afef3744410666e04a701180ca107f478d2718d43a195a708a6

      SHA512

      e66e91f0823c0f15f5bf42ec778a6b05a9934439dc075f4fc594020251ebd4eaaf0c75812e18be262d1b9d7511a2a99b9df5ab91921348b4264584feeb874f5b

      Download Submit
    • memory/412-2-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/412-3-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/412-4-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/412-5-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/412-6-0x00007FFFFF1F0000-0x00007FFFFF827000-memory.dmp
      Filesize

      6.2MB

      Download
    • memory/976-9-0x0000000000000000-mapping.dmp
      Download
    • memory/1640-7-0x0000000000000000-mapping.dmp
      Download
    • memory/1772-10-0x0000000004650000-0x0000000004651000-memory.dmp
      Filesize

      4KB

      Download