Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
24-02-2021 16:12
Static task
static1
Behavioral task
behavioral1
Sample
0224_13930141056302.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
0224_13930141056302.doc
Resource
win10v20201028
General
-
Target
0224_13930141056302.doc
-
Size
342KB
-
MD5
b6ede47bc6f6d0585ae4f49b05a1bcbd
-
SHA1
a7517e6165c427719dfe680a4aaf7640859070dc
-
SHA256
5da3261145ee75979a781985d628d66637b0552e4fe0a52b4875ac21717a212f
-
SHA512
6259858805166b9506d56db0cbd1e3891a6c41377cdc1b629a4376298bc0bdc4cdacac00820ffa77e476c2e175c07f630f03623670e5af56958c4d5cd8110221
Malware Config
Extracted
hancitor
2202_pro23
http://aftereand.com/8/forum.php
http://nevemicies.ru/8/forum.php
http://froplivernat.ru/8/forum.php
Signatures
-
Hancitor
Hancitor is downloader used to deliver other malware families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3992 4704 rundll32.exe WINWORD.EXE -
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 33 3092 rundll32.exe 35 3092 rundll32.exe 37 3092 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3092 rundll32.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 32 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 3092 set thread context of 988 3092 rundll32.exe svchost.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
NTFS ADS 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\{016343E2-A59B-4C13-A7FB-8BF9DB712657}\Hs52qascx.t0mp:Zone.Identifier WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4704 WINWORD.EXE 4704 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3092 rundll32.exe 3092 rundll32.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4704 WINWORD.EXE 4704 WINWORD.EXE 4704 WINWORD.EXE 4704 WINWORD.EXE 4704 WINWORD.EXE 4704 WINWORD.EXE 4704 WINWORD.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
WINWORD.EXErundll32.exerundll32.exedescription pid process target process PID 4704 wrote to memory of 3224 4704 WINWORD.EXE splwow64.exe PID 4704 wrote to memory of 3224 4704 WINWORD.EXE splwow64.exe PID 4704 wrote to memory of 3992 4704 WINWORD.EXE rundll32.exe PID 4704 wrote to memory of 3992 4704 WINWORD.EXE rundll32.exe PID 3992 wrote to memory of 3092 3992 rundll32.exe rundll32.exe PID 3992 wrote to memory of 3092 3992 rundll32.exe rundll32.exe PID 3992 wrote to memory of 3092 3992 rundll32.exe rundll32.exe PID 3092 wrote to memory of 988 3092 rundll32.exe svchost.exe PID 3092 wrote to memory of 988 3092 rundll32.exe svchost.exe PID 3092 wrote to memory of 988 3092 rundll32.exe svchost.exe PID 3092 wrote to memory of 988 3092 rundll32.exe svchost.exe PID 3092 wrote to memory of 988 3092 rundll32.exe svchost.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0224_13930141056302.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Static.dll,SSRRBCMYEIL2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Static.dll,SSRRBCMYEIL3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Static.dllMD5
db4c7bcda5020103dec0b78f9b18d8f8
SHA1bfa243215cad48f9f698768a7b81efae9dc6628e
SHA256e809ee9659ec59397d6b81bd7e630c921877f4d3b8fbbb19c13c12e3cf9c84f0
SHA512df9d72d1450bfdff89ef87ee40743a817b75fba3cfcc7c4a2e13047cbfb0675df5495e2f7d0d3b747bde694de8307823ad29056b200caf0563699419f48ebac4
-
\Users\Admin\AppData\Roaming\Microsoft\Templates\Static.dllMD5
db4c7bcda5020103dec0b78f9b18d8f8
SHA1bfa243215cad48f9f698768a7b81efae9dc6628e
SHA256e809ee9659ec59397d6b81bd7e630c921877f4d3b8fbbb19c13c12e3cf9c84f0
SHA512df9d72d1450bfdff89ef87ee40743a817b75fba3cfcc7c4a2e13047cbfb0675df5495e2f7d0d3b747bde694de8307823ad29056b200caf0563699419f48ebac4
-
memory/988-17-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/988-16-0x0000000000401480-mapping.dmp
-
memory/988-15-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/3092-14-0x0000000003030000-0x0000000003031000-memory.dmpFilesize
4KB
-
memory/3092-11-0x0000000000000000-mapping.dmp
-
memory/3092-13-0x0000000074140000-0x000000007414A000-memory.dmpFilesize
40KB
-
memory/3224-8-0x0000000002CC0000-0x0000000002DC1000-memory.dmpFilesize
1.0MB
-
memory/3224-7-0x0000000000000000-mapping.dmp
-
memory/3992-9-0x0000000000000000-mapping.dmp
-
memory/4704-6-0x00007FF82F820000-0x00007FF82F830000-memory.dmpFilesize
64KB
-
memory/4704-2-0x00007FF82F820000-0x00007FF82F830000-memory.dmpFilesize
64KB
-
memory/4704-5-0x00007FF855270000-0x00007FF8558A7000-memory.dmpFilesize
6.2MB
-
memory/4704-4-0x00007FF82F820000-0x00007FF82F830000-memory.dmpFilesize
64KB
-
memory/4704-3-0x00007FF82F820000-0x00007FF82F830000-memory.dmpFilesize
64KB