Analysis
-
max time kernel
147s -
max time network
133s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
05-05-2021 14:07
Static task
static1
Behavioral task
behavioral1
Sample
cb1ae1de_by_Libranalysis.doc
Resource
win7v20210408
Behavioral task
behavioral2
Sample
cb1ae1de_by_Libranalysis.doc
Resource
win10v20210410
General
-
Target
cb1ae1de_by_Libranalysis.doc
-
Size
1.4MB
-
MD5
cb1ae1de9487edd65c2201f1f4a36e3c
-
SHA1
80cb89663d148dd302301e9f66b37d1c3de91a59
-
SHA256
e6dff9a5f74fff3a95e2dcb48b81b05af5cf5be73823d56c10eee80c8f17c845
-
SHA512
0b08cfac486dc87256ddbe467bc185ba96e71b3a6865a9fe1ad3390290166e528147e705267f02a8903dce28da3f99674c3d24d4d628d1ff5db7a9656f080fe6
Malware Config
Signatures
-
Process spawned unexpected child process 5 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.execmd.execmd.execmd.execmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3836 3172 cmd.exe WINWORD.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 1592 3172 cmd.exe WINWORD.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 2736 3172 cmd.exe WINWORD.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3740 3172 cmd.exe WINWORD.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3996 3172 cmd.exe WINWORD.EXE -
Executes dropped EXE 2 IoCs
Processes:
DriverUpdateFx.exeExplorer.EXEpid process 2272 DriverUpdateFx.exe 3052 Explorer.EXE -
Deletes itself 1 IoCs
Processes:
WINWORD.EXEpid process 3172 WINWORD.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
NTFS ADS 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File created C:\Users\Admin\AppData\Local\Temp\~WRD0000.tmp\:Zone.Identifier:$DATA WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3172 WINWORD.EXE 3172 WINWORD.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3052 Explorer.EXE -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
WINWORD.EXEpid process 3172 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 38 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Explorer.EXEpid process 3052 Explorer.EXE -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Explorer.EXEpid process 3052 Explorer.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
WINWORD.EXEpid process 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3052 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
WINWORD.EXEcmd.execmd.exemavinject.exedescription pid process target process PID 3172 wrote to memory of 3836 3172 WINWORD.EXE cmd.exe PID 3172 wrote to memory of 3836 3172 WINWORD.EXE cmd.exe PID 3172 wrote to memory of 1592 3172 WINWORD.EXE cmd.exe PID 3172 wrote to memory of 1592 3172 WINWORD.EXE cmd.exe PID 3172 wrote to memory of 2736 3172 WINWORD.EXE cmd.exe PID 3172 wrote to memory of 2736 3172 WINWORD.EXE cmd.exe PID 3172 wrote to memory of 3740 3172 WINWORD.EXE cmd.exe PID 3172 wrote to memory of 3740 3172 WINWORD.EXE cmd.exe PID 3740 wrote to memory of 2272 3740 cmd.exe DriverUpdateFx.exe PID 3740 wrote to memory of 2272 3740 cmd.exe DriverUpdateFx.exe PID 3172 wrote to memory of 3996 3172 WINWORD.EXE cmd.exe PID 3172 wrote to memory of 3996 3172 WINWORD.EXE cmd.exe PID 3996 wrote to memory of 192 3996 cmd.exe mavinject.exe PID 3996 wrote to memory of 192 3996 cmd.exe mavinject.exe PID 192 wrote to memory of 3052 192 mavinject.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\cb1ae1de_by_Libranalysis.doc" /o ""2⤵
- Deletes itself
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c md c:\Drivers3⤵
- Process spawned unexpected child process
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /b C:\Windows\system32\certut*.exe c:\Drivers\DriverUpdateFx.exe3⤵
- Process spawned unexpected child process
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /b c:\Drivers\DriverGFE.tmp+c:\Drivers\DriverGFXCoin.tmp c:\Drivers\DriverCPHS.tmp & del c:\Drivers\DriverGFE.tmp & del c:\Drivers\DriverGFXCoin.tmp3⤵
- Process spawned unexpected child process
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c c:\Drivers\DriverUpdateFx.exe -decode c:\Drivers\DriverCPHS.tmp c:\Drivers\DriverGFX.tmp & del c:\Drivers\DriverCPHS.tmp & del c:\Drivers\DriverUpdateFx.exe3⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
\??\c:\Drivers\DriverUpdateFx.exec:\Drivers\DriverUpdateFx.exe -decode c:\Drivers\DriverCPHS.tmp c:\Drivers\DriverGFX.tmp4⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c mavinject.exe 3052 /injectrunning c:\Drivers\DriverGFX.tmp3⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mavinject.exemavinject.exe 3052 /injectrunning c:\Drivers\DriverGFX.tmp4⤵
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Drivers\DriverUpdateFx.exeMD5
056c7d065f4622da9cc2848f47e2bae2
SHA16c6f18b0ec53dc63488961c4240ec584ac71c25f
SHA256e09a2d7ecac1a10c89e27750a18790da06ddd7311965dbc9ab6096f636dae61c
SHA512db158c9b669a2668149caf30df32595a488dcc831d7518ca2e793eac0885492a2eaee838914e706a585b7f3f1c801e299c697b2cec509204561bb098e16253d5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-msMD5
94dd92c631ff6cdab4d68169342baf3e
SHA1d8b3f0feb1e44d0dbe18de815e252454c404e1dc
SHA2561ba2615fa0c16024b23b34b7f14e596397dde9686a47454a5d317af83d755e9a
SHA512975f5576ca97c83ecf34d7c0c3b7c01afa635c726cc9c8b182e1e1ec9c6b6bc6d5db2f807e88dca126a324b609b669ac0dd21f25c5bed5b3787bbc666c429c19
-
\??\c:\Drivers\DriverCPHS.tmpMD5
4d8ea25779a892048e02c716c8742758
SHA112ff47a0d2c60535ec77ff08222cae1064ac4c7d
SHA2568f20bd7ac51caeca497981db33a9a660616f7358af4fdbd132a7e6f6349d5567
SHA51222faa91fcefce8c3031f2c39505192789e22be0dc56180e1fdea6ddcd943fe550ae899a4cb2524f7695f4579bc48c9f0fcf8db5df790f439959b29994cde3052
-
\??\c:\Drivers\DriverGFE.tmpMD5
271ddf829afeece44d8732757fba1a66
SHA156ab49a5c68f11cc45c651da6a3f339eff2853f8
SHA256ca62d5e073f52f3ceb83f72d4d70d4fcd8b1ed041cddfb02ccfbbe1f90134f05
SHA512b61c7b5a882f363569058106c96d43856e6ab71587c4426ca48ae4979b7c12cf55faca0b09c2db500521cc0814bfcc022d5f16ed7090327b83865dfa8801baed
-
\??\c:\Drivers\DriverGFX.tmpMD5
1417f890248f193bb241f6b458ae4a97
SHA1b2dfcbd8c3966ebed9275db7b14e359412db9963
SHA2565c206b4dc2d3a25205176da9a1129c9f814c030a7bac245e3aaf7dd5d3ca4fbe
SHA512384d7b43c9732c4f159266d0b2fa0956e304ba1efff1ac7a89ecc7baf5833bf08cdce713f474a9c0850a01d3e076f0deb96fcb857b106e4a994c0c600f586a2e
-
\??\c:\Drivers\DriverGFXCoin.tmpMD5
76e0da32c9363d0df0614641dcfe555c
SHA196056fde433b03372e5dd75d5cd1eafbe54a8174
SHA256b063ee39c58d04210dddcdf4824f4658a5d47181ddaef01f5a3c82c89d2ce849
SHA512be120b13ee68de5bbf7d4e8ff9d582c73510d6288705c42e1d4b74062790643ea253c6a927ae00b5b6c36b1aa7cd177b4972c59bccdc647afe716a5bd92d6433
-
\??\c:\Drivers\DriverUpdateFx.exeMD5
056c7d065f4622da9cc2848f47e2bae2
SHA16c6f18b0ec53dc63488961c4240ec584ac71c25f
SHA256e09a2d7ecac1a10c89e27750a18790da06ddd7311965dbc9ab6096f636dae61c
SHA512db158c9b669a2668149caf30df32595a488dcc831d7518ca2e793eac0885492a2eaee838914e706a585b7f3f1c801e299c697b2cec509204561bb098e16253d5
-
\Drivers\DriverGFX.tmpMD5
1417f890248f193bb241f6b458ae4a97
SHA1b2dfcbd8c3966ebed9275db7b14e359412db9963
SHA2565c206b4dc2d3a25205176da9a1129c9f814c030a7bac245e3aaf7dd5d3ca4fbe
SHA512384d7b43c9732c4f159266d0b2fa0956e304ba1efff1ac7a89ecc7baf5833bf08cdce713f474a9c0850a01d3e076f0deb96fcb857b106e4a994c0c600f586a2e
-
memory/192-190-0x0000000000000000-mapping.dmp
-
memory/1592-180-0x0000000000000000-mapping.dmp
-
memory/2272-185-0x0000000000000000-mapping.dmp
-
memory/2736-181-0x0000000000000000-mapping.dmp
-
memory/3172-114-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmpFilesize
64KB
-
memory/3172-123-0x00007FF9D1040000-0x00007FF9D2F35000-memory.dmpFilesize
31.0MB
-
memory/3172-122-0x00007FF9D2F40000-0x00007FF9D402E000-memory.dmpFilesize
16.9MB
-
memory/3172-118-0x00007FF9DA230000-0x00007FF9DCD53000-memory.dmpFilesize
43.1MB
-
memory/3172-119-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmpFilesize
64KB
-
memory/3172-117-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmpFilesize
64KB
-
memory/3172-116-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmpFilesize
64KB
-
memory/3172-115-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmpFilesize
64KB
-
memory/3740-184-0x0000000000000000-mapping.dmp
-
memory/3836-179-0x0000000000000000-mapping.dmp
-
memory/3996-189-0x0000000000000000-mapping.dmp