Resubmissions
06-05-2021 11:48
210506-t228k9s662 10Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
06-05-2021 11:48
Static task
static1
Behavioral task
behavioral1
Sample
Users/valdershof/AppData/Local/Temp/1/Temp1_request (2).zip/statistics.05.05.21.doc
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Users/valdershof/AppData/Local/Temp/1/Temp1_request (2).zip/statistics.05.05.21.doc
Resource
win10v20210410
General
-
Target
Users/valdershof/AppData/Local/Temp/1/Temp1_request (2).zip/statistics.05.05.21.doc
-
Size
79KB
-
MD5
5b1f0547ccf84dcbff593f7c8f5942d8
-
SHA1
3e5a4257f797363211724a83b40b42c84396bf47
-
SHA256
643ead4ad454664576dd55236b4d924a91294d155315ec8860af96a6157263d4
-
SHA512
a149e6d4bf6093b3af4fffc14824335a72cff53cea28d27a103f98a450439768ab29f0a532a512364e5b5b726fccb2bc051aaebb145b5ca05680c01c088c7ab6
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
explorer.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3904 3840 explorer.exe WINWORD.EXE -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 4076 created 4032 4076 WerFault.exe mshta.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4056 4032 WerFault.exe mshta.exe 4076 4032 WerFault.exe mshta.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Modifies registry class 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3840 WINWORD.EXE 3840 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
WerFault.exepid process 4056 WerFault.exe 4056 WerFault.exe 4056 WerFault.exe 4056 WerFault.exe 4056 WerFault.exe 4056 WerFault.exe 4056 WerFault.exe 4056 WerFault.exe 4056 WerFault.exe 4056 WerFault.exe 4056 WerFault.exe 4056 WerFault.exe 4056 WerFault.exe 4056 WerFault.exe 4056 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 4056 WerFault.exe Token: SeBackupPrivilege 4056 WerFault.exe Token: SeDebugPrivilege 4056 WerFault.exe -
Suspicious use of SetWindowsHookEx 19 IoCs
Processes:
WINWORD.EXEpid process 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
WINWORD.EXEexplorer.exedescription pid process target process PID 3840 wrote to memory of 3904 3840 WINWORD.EXE explorer.exe PID 3840 wrote to memory of 3904 3840 WINWORD.EXE explorer.exe PID 2932 wrote to memory of 4032 2932 explorer.exe mshta.exe PID 2932 wrote to memory of 4032 2932 explorer.exe mshta.exe PID 2932 wrote to memory of 4032 2932 explorer.exe mshta.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Users\valdershof\AppData\Local\Temp\1\Temp1_request (2).zip\statistics.05.05.21.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\explorer.exeexplorer c:\users\public\dataTrustRequest.hta2⤵
- Process spawned unexpected child process
PID:3904
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Public\dataTrustRequest.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:4032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 13683⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 16283⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:4076
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\dataTrustRequest.htaMD5
8ec163e76fce1f25578d1c05a795b4bc
SHA108a476eeb1cd6eae7e17331bbbcd1adc44168fc3
SHA2561444d45a93a63b2d305ef991e9e78b05405bfdc5e572e735d4c9a8bf9470dcb1
SHA512c1c481c931dc2f4aa8a17be7dd265b82297ae6641057908581fa1fb09aa5c794335f941833e8f1cbbe0b01e18e07dd614c0a5689cd89d632cb42400799d8cb8a
-
memory/3840-114-0x00007FFDF5C60000-0x00007FFDF5C70000-memory.dmpFilesize
64KB
-
memory/3840-115-0x00007FFDF5C60000-0x00007FFDF5C70000-memory.dmpFilesize
64KB
-
memory/3840-116-0x00007FFDF5C60000-0x00007FFDF5C70000-memory.dmpFilesize
64KB
-
memory/3840-117-0x00007FFDF5C60000-0x00007FFDF5C70000-memory.dmpFilesize
64KB
-
memory/3840-119-0x00007FFDF5C60000-0x00007FFDF5C70000-memory.dmpFilesize
64KB
-
memory/3840-118-0x00007FFE16700000-0x00007FFE19223000-memory.dmpFilesize
43.1MB
-
memory/3840-122-0x00007FFE124F0000-0x00007FFE135DE000-memory.dmpFilesize
16.9MB
-
memory/3840-123-0x00007FFE0EEB0000-0x00007FFE10DA5000-memory.dmpFilesize
31.0MB
-
memory/3840-180-0x000001DDEBA50000-0x000001DDEBA54000-memory.dmpFilesize
16KB
-
memory/3904-179-0x0000000000000000-mapping.dmp
-
memory/4032-182-0x0000000000000000-mapping.dmp