Analysis
-
max time kernel
144s -
max time network
142s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
18-06-2021 14:05
Static task
static1
Behavioral task
behavioral1
Sample
fd18a646bd32938babf115e7b5eacb30e39630779520f6df26924b7c6513995c.bin.doc
Resource
win7v20210410
Behavioral task
behavioral2
Sample
fd18a646bd32938babf115e7b5eacb30e39630779520f6df26924b7c6513995c.bin.doc
Resource
win10v20210410
General
-
Target
fd18a646bd32938babf115e7b5eacb30e39630779520f6df26924b7c6513995c.bin.doc
-
Size
45KB
-
MD5
cf6d17f7df9d3702c297b9f54bb5c571
-
SHA1
d554fe56cf733ccb72cf3581b53ec2fcb60106a8
-
SHA256
fd18a646bd32938babf115e7b5eacb30e39630779520f6df26924b7c6513995c
-
SHA512
f7f069e30042ac9e4334d0279517bd7b24ba982d38a216405ad58762888c6bd9037eaa8ce69333b1fd7638eb77f6b66df45bcad4d407361e22001b5f64045534
Malware Config
Extracted
gozi_ifsb
6000
authd.feronok.com
app.bighomegl.at
-
build
250204
-
exe_type
loader
-
server_id
580
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 1940 1884 regsvr32.exe WINWORD.EXE -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1940 regsvr32.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Processes:
iexplore.exeWINWORD.EXEIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F843A41-D03F-11EB-BF60-7A40C1B3078F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 2004 WINWORD.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1608 iexplore.exe -
Suspicious use of SetWindowsHookEx 22 IoCs
Processes:
WINWORD.EXEWINWORD.EXEiexplore.exeIEXPLORE.EXEpid process 2004 WINWORD.EXE 2004 WINWORD.EXE 2004 WINWORD.EXE 2004 WINWORD.EXE 2004 WINWORD.EXE 2004 WINWORD.EXE 2004 WINWORD.EXE 2004 WINWORD.EXE 2004 WINWORD.EXE 2004 WINWORD.EXE 2004 WINWORD.EXE 2004 WINWORD.EXE 2004 WINWORD.EXE 2004 WINWORD.EXE 2004 WINWORD.EXE 2004 WINWORD.EXE 1884 WINWORD.EXE 1884 WINWORD.EXE 1608 iexplore.exe 1608 iexplore.exe 1076 IEXPLORE.EXE 1076 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
WINWORD.EXEWINWORD.EXEiexplore.exedescription pid process target process PID 1884 wrote to memory of 1940 1884 WINWORD.EXE regsvr32.exe PID 1884 wrote to memory of 1940 1884 WINWORD.EXE regsvr32.exe PID 1884 wrote to memory of 1940 1884 WINWORD.EXE regsvr32.exe PID 1884 wrote to memory of 1940 1884 WINWORD.EXE regsvr32.exe PID 1884 wrote to memory of 1940 1884 WINWORD.EXE regsvr32.exe PID 1884 wrote to memory of 1940 1884 WINWORD.EXE regsvr32.exe PID 1884 wrote to memory of 1940 1884 WINWORD.EXE regsvr32.exe PID 2004 wrote to memory of 276 2004 WINWORD.EXE splwow64.exe PID 2004 wrote to memory of 276 2004 WINWORD.EXE splwow64.exe PID 2004 wrote to memory of 276 2004 WINWORD.EXE splwow64.exe PID 2004 wrote to memory of 276 2004 WINWORD.EXE splwow64.exe PID 1608 wrote to memory of 1076 1608 iexplore.exe IEXPLORE.EXE PID 1608 wrote to memory of 1076 1608 iexplore.exe IEXPLORE.EXE PID 1608 wrote to memory of 1076 1608 iexplore.exe IEXPLORE.EXE PID 1608 wrote to memory of 1076 1608 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\fd18a646bd32938babf115e7b5eacb30e39630779520f6df26924b7c6513995c.bin.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 c:\programdata\constException.jpg2⤵
- Process spawned unexpected child process
- Loads dropped DLL
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1608 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\MSO1033.aclMD5
83201d20b08c9bad0e9e964388b1cb11
SHA12d3a5ff7db2250c32a3e842ee78653fc36979f2c
SHA256fd1f02669dcaa3230ffbf20d2b4fc164a18ea3e0d644e6a270ccffdec39505f3
SHA5128ee2525e9cf9b9cd82bdf6080f1505b132a2601ea942fd59586c5c7276bbf0e660e58d2a9cab345adb23b04d6f7ef314fa3d8a64f09bee0b75eb774e2538b03d
-
\??\c:\programdata\constException.jpgMD5
e5298c1b6b1895dd0854ea94a5c53179
SHA1714d24b47b89f5e66f077078a77337468bff0a55
SHA2566dfb5864e069974b512e70f844fb51f21aaf3b69a3a1d686365dc46d00056e13
SHA512f41c76273ff764ed14a7635682e98995caf6b7da0fb61868e45462ffeeae665012fbed9f77483ceef82a58d812d1482a837f4c36d1bbc3d985322e57b28f847a
-
\ProgramData\constException.jpgMD5
e5298c1b6b1895dd0854ea94a5c53179
SHA1714d24b47b89f5e66f077078a77337468bff0a55
SHA2566dfb5864e069974b512e70f844fb51f21aaf3b69a3a1d686365dc46d00056e13
SHA512f41c76273ff764ed14a7635682e98995caf6b7da0fb61868e45462ffeeae665012fbed9f77483ceef82a58d812d1482a837f4c36d1bbc3d985322e57b28f847a
-
memory/276-74-0x000007FEFC411000-0x000007FEFC413000-memory.dmpFilesize
8KB
-
memory/276-73-0x0000000000000000-mapping.dmp
-
memory/1076-78-0x0000000000000000-mapping.dmp
-
memory/1884-72-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1940-68-0x00000000765F1000-0x00000000765F3000-memory.dmpFilesize
8KB
-
memory/1940-71-0x00000000001E0000-0x0000000000270000-memory.dmpFilesize
576KB
-
memory/1940-67-0x0000000000000000-mapping.dmp
-
memory/1940-75-0x00000000001E0000-0x00000000001ED000-memory.dmpFilesize
52KB
-
memory/1940-76-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/2004-60-0x0000000072FC1000-0x0000000072FC4000-memory.dmpFilesize
12KB
-
memory/2004-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2004-61-0x0000000070A41000-0x0000000070A43000-memory.dmpFilesize
8KB