Analysis

  • max time kernel
    133s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    04-05-2021 15:01

General

  • Target

    718ace8dedfa4d43286f7749d11096f65e18fd48581c7e274d96fd958eb3ffda.doc

  • Size

    75KB

  • MD5

    b946e5876bfe78898077a1af8f623ef7

  • SHA1

    8c7e0eed137eaa082dfe0d8b3f7429cc10e35da2

  • SHA256

    718ace8dedfa4d43286f7749d11096f65e18fd48581c7e274d96fd958eb3ffda

  • SHA512

    8596a28d549d6fe6997aebdd73b7afdf63a67a15dd8d3ff27b4e7ed439f61d3afd92f718f782466be00b140bd4849f963fb3adc086cefa3dd35afbaed4968e07

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 28 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\718ace8dedfa4d43286f7749d11096f65e18fd48581c7e274d96fd958eb3ffda.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1032
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe c:\programdata\pasteBorder.jpg,PluginInit
      2⤵
      • Process spawned unexpected child process
      PID:3888

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868
    MD5

    ba91a6f9d2d9fb3667180033d3bab028

    SHA1

    facbabf8f1ebc12cd4edb36499d3ad999426c1f7

    SHA256

    104d61c059ebff161fa8f3f637d04015697e3001928e0520e46359434dff8632

    SHA512

    ff3fa0b01b91ba7431c52924d2f8086d079f1c84ddb5c0cf1e2bc382f05ae59b6c3e58240e3312d737511133137e837b39a77def6e1084df1a94167ef3d79a03

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868
    MD5

    f9429ca4c3505c5dd3e505333317055b

    SHA1

    d6e0a39cdc3c8e12296666cc1a1c099f510b8bfb

    SHA256

    a93519949cfed935a7d753e3e66b41b53c18640d6900a7d472bb6dbc6d6b056b

    SHA512

    4e1b661d5fbe01d4a3794e2d6d6e81b16f1e5dc62b1129036531eac0580d07170759368599e867f8b0906d027b11482821a66359d748d3a414aa9ebc2bce36d2

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json
    MD5

    f1b59332b953b3c99b3c95a44249c0d2

    SHA1

    1b16a2ca32bf8481e18ff8b7365229b598908991

    SHA256

    138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c

    SHA512

    3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.GovernedChannelStates.json
    MD5

    c56ff60fbd601e84edd5a0ff1010d584

    SHA1

    342abb130dabeacde1d8ced806d67a3aef00a749

    SHA256

    200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c

    SHA512

    acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.json
    MD5

    e4e83f8123e9740b8aa3c3dfa77c1c04

    SHA1

    5281eae96efde7b0e16a1d977f005f0d3bd7aad0

    SHA256

    6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31

    SHA512

    bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyEventActivityStats.json
    MD5

    6ca4960355e4951c72aa5f6364e459d5

    SHA1

    2fd90b4ec32804dff7a41b6e63c8b0a40b592113

    SHA256

    88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

    SHA512

    8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyHistoryStats.json
    MD5

    6ca4960355e4951c72aa5f6364e459d5

    SHA1

    2fd90b4ec32804dff7a41b6e63c8b0a40b592113

    SHA256

    88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

    SHA512

    8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

  • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db-wal
    MD5

    b6b0edb61bf60c5f6042dee8b4fd4f27

    SHA1

    c590f959c9ea720cbd1a7c7ee971689121e7825f

    SHA256

    d329f13ef6293ac7cb4fc96285f9f5da587c3755aa1bdd8e7842d619c635b864

    SHA512

    17143bd20f4fc6c64d9480fcc273216a25897a1826689338a5e8a5ebeb79735e164fd82f2f5e02eee3236e4501a9e667ca07b0e2c81622c7ba935ea071adb2fc

  • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db-wal
    MD5

    b6b0edb61bf60c5f6042dee8b4fd4f27

    SHA1

    c590f959c9ea720cbd1a7c7ee971689121e7825f

    SHA256

    d329f13ef6293ac7cb4fc96285f9f5da587c3755aa1bdd8e7842d619c635b864

    SHA512

    17143bd20f4fc6c64d9480fcc273216a25897a1826689338a5e8a5ebeb79735e164fd82f2f5e02eee3236e4501a9e667ca07b0e2c81622c7ba935ea071adb2fc

  • \??\c:\programdata\pasteBorder.jpg
    MD5

    459e62519cbe8a2ff22c46d8f4ad8626

    SHA1

    7d50be0558089a9757657ef9225fb9d933f265e9

    SHA256

    2e1272bc5af3a5f5928b4b7647d621a96fe9365dbfd0f4db84097a1ccdf041cd

    SHA512

    2d64d2286b1b596b04a9b5f06859a7da98a458b2275db556d79e1b137185d0c26ba04d650f47e9f9fb706d35ff0c2f2a8c6eeaaae6cff43e57fbd104d46b4fa8

  • memory/1032-114-0x00007FFC3AEC0000-0x00007FFC3AED0000-memory.dmp
    Filesize

    64KB

  • memory/1032-179-0x0000024FA0800000-0x0000024FA0804000-memory.dmp
    Filesize

    16KB

  • memory/1032-123-0x00007FFC548A0000-0x00007FFC56795000-memory.dmp
    Filesize

    31.0MB

  • memory/1032-122-0x00007FFC567A0000-0x00007FFC5788E000-memory.dmp
    Filesize

    16.9MB

  • memory/1032-118-0x00007FFC5BF40000-0x00007FFC5EA63000-memory.dmp
    Filesize

    43.1MB

  • memory/1032-119-0x00007FFC3AEC0000-0x00007FFC3AED0000-memory.dmp
    Filesize

    64KB

  • memory/1032-117-0x00007FFC3AEC0000-0x00007FFC3AED0000-memory.dmp
    Filesize

    64KB

  • memory/1032-116-0x00007FFC3AEC0000-0x00007FFC3AED0000-memory.dmp
    Filesize

    64KB

  • memory/1032-115-0x00007FFC3AEC0000-0x00007FFC3AED0000-memory.dmp
    Filesize

    64KB

  • memory/3888-181-0x0000000000000000-mapping.dmp