Analysis
-
max time kernel
119s -
max time network
15s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-03-2021 18:02
General
-
Target
commerce _03.09.2021.doc
-
Size
91KB
-
MD5
0aa86c039d3fbad067749edf8a4ce659
-
SHA1
15c9d4ba5557b47dbdde61831296c2d67ede7357
-
SHA256
0c8704fd49a85bec94233219640e3bae68aa4030b3ae6e582d502dbef38b6707
-
SHA512
bb41673650c28b4ebfd884f539f1be549124d70912278302dbe8781cf7e051a693b20c9a1d399a4789f0420841c26960cb1e381dede9cd107d433c352d56b9d1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 9 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 40 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\commerce _03.09.2021.doc"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\programdata\xml.com"C:\programdata\xml.com" process list /format : "c:\programdata\i.xsl"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 c:\programdata\58886.jpg3⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\xml.comMD5
a03cf3838775e0801a0894c8bacd2e56
SHA14368dbd172224ec9461364be1ac9dffc5d9224a8
SHA256132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81
SHA512b9e2467157139cc288e027d34865034eaf441dd69981a91df18d60e6b6a7cc53f8102230d18e4c6de2f3ad3ab413d755663bfc82d3033e52faf38509a7cdfcdc
-
\??\c:\programdata\58886.jpgMD5
b18464c857c9c64a46d56b9e2c9bc3e2
SHA1fff3bb292728adb87e5485db79c95887d79c651e
SHA256d0f8d44e5662843be0fde27fe1c05f4cfd4efaeeddb34bd59bbf033135e6f0d6
SHA512b95fb6742db488577f907cfb14d00aaecb8f5e5b84b5912eb81a04215ffa9c095cf6e05a8e8c1c5d360b79760dcc9f1ac27eeb40a59983a9e8d4ef35ea756bf0
-
\??\c:\programdata\i.xslMD5
019bf95cfa8bd8cef5ccbe11a17d5b4a
SHA19617ac6e29d86217d54609d37d79bf7dcef986ae
SHA2562b9c7426ad5db95c7924ea37084742b3af34cdcafad397584b28cf8ea343e774
SHA5124a267d89006648a046f18565abeb9fe29b9a4cade415f4dfffb167e400e02eebeaca9c9a49dc73bec614f8faafeb5db772978a40cd17b9f74b14df4a11e07f6b
-
\ProgramData\xml.comMD5
a03cf3838775e0801a0894c8bacd2e56
SHA14368dbd172224ec9461364be1ac9dffc5d9224a8
SHA256132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81
SHA512b9e2467157139cc288e027d34865034eaf441dd69981a91df18d60e6b6a7cc53f8102230d18e4c6de2f3ad3ab413d755663bfc82d3033e52faf38509a7cdfcdc
-
\ProgramData\xml.comMD5
a03cf3838775e0801a0894c8bacd2e56
SHA14368dbd172224ec9461364be1ac9dffc5d9224a8
SHA256132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81
SHA512b9e2467157139cc288e027d34865034eaf441dd69981a91df18d60e6b6a7cc53f8102230d18e4c6de2f3ad3ab413d755663bfc82d3033e52faf38509a7cdfcdc
-
\ProgramData\xml.comMD5
a03cf3838775e0801a0894c8bacd2e56
SHA14368dbd172224ec9461364be1ac9dffc5d9224a8
SHA256132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81
SHA512b9e2467157139cc288e027d34865034eaf441dd69981a91df18d60e6b6a7cc53f8102230d18e4c6de2f3ad3ab413d755663bfc82d3033e52faf38509a7cdfcdc
-
\ProgramData\xml.comMD5
a03cf3838775e0801a0894c8bacd2e56
SHA14368dbd172224ec9461364be1ac9dffc5d9224a8
SHA256132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81
SHA512b9e2467157139cc288e027d34865034eaf441dd69981a91df18d60e6b6a7cc53f8102230d18e4c6de2f3ad3ab413d755663bfc82d3033e52faf38509a7cdfcdc
-
memory/440-15-0x000007FEF7D90000-0x000007FEF800A000-memory.dmpFilesize
2.5MB
-
memory/1168-9-0x0000000000000000-mapping.dmp
-
memory/1724-3-0x00000000709E1000-0x00000000709E3000-memory.dmpFilesize
8KB
-
memory/1724-12-0x00000000060B0000-0x00000000060B2000-memory.dmpFilesize
8KB
-
memory/1724-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1724-2-0x0000000072F61000-0x0000000072F64000-memory.dmpFilesize
12KB
-
memory/1832-13-0x000007FEFC601000-0x000007FEFC603000-memory.dmpFilesize
8KB
-
memory/1832-11-0x0000000000000000-mapping.dmp
-
memory/1980-16-0x0000000000000000-mapping.dmp
-
memory/1980-17-0x00000000761E1000-0x00000000761E3000-memory.dmpFilesize
8KB
-
memory/1980-19-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
