Analysis

  • max time kernel
    71s
  • max time network
    21s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    03/03/2021, 14:30

General

  • Target

    0303_7987150656181.doc

  • Size

    775KB

  • MD5

    a6a62c994891464d42307d946f7c770e

  • SHA1

    99d5b3df9e3cc14b7aa46f8da393443f51da743e

  • SHA256

    1cdb6e242c5166d15c994c0472d1d14548ce660e6c1f30c156a944b690b5946c

  • SHA512

    795c408f08797374ebfa692bfb56fd9eb373bc690487c79cf663a6e005713ecabe386ed730fc93b4542a1eaf508bb88023965958431d1b8bfafec90962e346d2

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0303_7987150656181.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1408
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" c:\users\admin\appdata\local\temp\Static.dll,WIOYJIOLYGA
        2⤵
        • Process spawned unexpected child process
        PID:1932

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1408-6-0x000007FEFB811000-0x000007FEFB813000-memory.dmp

            Filesize

            8KB

          • memory/1752-2-0x0000000072311000-0x0000000072314000-memory.dmp

            Filesize

            12KB

          • memory/1752-3-0x000000006FD91000-0x000000006FD93000-memory.dmp

            Filesize

            8KB

          • memory/1752-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/1932-8-0x0000000075EB1000-0x0000000075EB3000-memory.dmp

            Filesize

            8KB