Analysis
- max time kernel
147s - max time network
133s - platform
windows10_x64 - resource
win10v20210410 - submitted
05/05/2021, 14:07
Static task
static1
Behavioral task
behavioral1
Sample
cb1ae1de_by_Libranalysis.doc
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cb1ae1de_by_Libranalysis.doc
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target cb1ae1de_by_Libranalysis.doc
- Size 1.4MB
- Sample210505-e6xpxj58re
- SHA256 e6dff9a5f74fff3a95e2dcb48b81b05af5cf5be73823d56c10eee80c8f17c845
- MD5 cb1ae1de9487edd65c2201f1f4a36e3c
- SHA1 80cb89663d148dd302301e9f66b37d1c3de91a59
- SHA512 0b08cfac486dc87256ddbe467bc185ba96e71b3a6865a9fe1ad3390290166e528147e705267f02a8903dce28da3f99674c3d24d4d628d1ff5db7a9656f080fe6
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Process spawned unexpected child process 5 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3836 3172 cmd.exe 68 Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 1592 3172 cmd.exe 68 Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 2736 3172 cmd.exe 68 Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3740 3172 cmd.exe 68 Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3996 3172 cmd.exe 68 - Executes dropped EXE 2 IoCs
pid Process 2272 DriverUpdateFx.exe 3052 Explorer.EXE - Deletes itself 1 IoCs
pid Process 3172 WINWORD.EXE - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\~WRD0000.tmp\:Zone.Identifier:$DATA WINWORD.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3172 WINWORD.EXE 3172 WINWORD.EXE - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3052 Explorer.EXE - Suspicious behavior: RenamesItself 1 IoCs
pid Process 3172 WINWORD.EXE - Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3052 Explorer.EXE - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3052 Explorer.EXE - Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE 3172 WINWORD.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3052 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3172 wrote to memory of 3836 3172 WINWORD.EXE 76 PID 3172 wrote to memory of 3836 3172 WINWORD.EXE 76 PID 3172 wrote to memory of 1592 3172 WINWORD.EXE 78 PID 3172 wrote to memory of 1592 3172 WINWORD.EXE 78 PID 3172 wrote to memory of 2736 3172 WINWORD.EXE 80 PID 3172 wrote to memory of 2736 3172 WINWORD.EXE 80 PID 3172 wrote to memory of 3740 3172 WINWORD.EXE 83 PID 3172 wrote to memory of 3740 3172 WINWORD.EXE 83 PID 3740 wrote to memory of 2272 3740 cmd.exe 86 PID 3740 wrote to memory of 2272 3740 cmd.exe 86 PID 3172 wrote to memory of 3996 3172 WINWORD.EXE 88 PID 3172 wrote to memory of 3996 3172 WINWORD.EXE 88 PID 3996 wrote to memory of 192 3996 cmd.exe 90 PID 3996 wrote to memory of 192 3996 cmd.exe 90 PID 192 wrote to memory of 3052 192 mavinject.exe 9
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
PID:3052 -
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\cb1ae1de_by_Libranalysis.doc" /o ""2⤵
- Deletes itself
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c md c:\Drivers3⤵
- Process spawned unexpected child process
PID:3836
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /b C:\Windows\system32\certut*.exe c:\Drivers\DriverUpdateFx.exe3⤵
- Process spawned unexpected child process
PID:1592
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /b c:\Drivers\DriverGFE.tmp+c:\Drivers\DriverGFXCoin.tmp c:\Drivers\DriverCPHS.tmp & del c:\Drivers\DriverGFE.tmp & del c:\Drivers\DriverGFXCoin.tmp3⤵
- Process spawned unexpected child process
PID:2736
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c c:\Drivers\DriverUpdateFx.exe -decode c:\Drivers\DriverCPHS.tmp c:\Drivers\DriverGFX.tmp & del c:\Drivers\DriverCPHS.tmp & del c:\Drivers\DriverUpdateFx.exe3⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\Drivers\DriverUpdateFx.exec:\Drivers\DriverUpdateFx.exe -decode c:\Drivers\DriverCPHS.tmp c:\Drivers\DriverGFX.tmp4⤵
- Executes dropped EXE
PID:2272
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c mavinject.exe 3052 /injectrunning c:\Drivers\DriverGFX.tmp3⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\system32\mavinject.exemavinject.exe 3052 /injectrunning c:\Drivers\DriverGFX.tmp4⤵
- Suspicious use of WriteProcessMemory
PID:192
-
-
-