Analysis
-
max time kernel
103s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-06-2021 13:00
Static task
static1
Behavioral task
behavioral1
Sample
certificate.06.21.doc
Resource
win7v20210410
Behavioral task
behavioral2
Sample
certificate.06.21.doc
Resource
win10v20210410
General
-
Target
certificate.06.21.doc
-
Size
50KB
-
MD5
778c7f21764d2fc338a5abfa2becfb35
-
SHA1
39dfa04561018e6dc4590bb6530ca2b2d5351183
-
SHA256
cc70447b7be5068a55ad34baa92ebd524a00e0a4a210b69fa16d4bf84f48e239
-
SHA512
2f3c868240b63c3e179006c9919e91f1330fc9e6bfc06e65d2484e2e10418d3dd3094c903747cfe5e2035b31850059c5bb046f8791554341fe29756b68fa8d6a
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
explorer.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 2088 3176 explorer.exe WINWORD.EXE -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2988 created 2428 2988 WerFault.exe mshta.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2472 2428 WerFault.exe mshta.exe 2988 2428 WerFault.exe mshta.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Modifies registry class 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3176 WINWORD.EXE 3176 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
WerFault.exepid process 2472 WerFault.exe 2472 WerFault.exe 2472 WerFault.exe 2472 WerFault.exe 2472 WerFault.exe 2472 WerFault.exe 2472 WerFault.exe 2472 WerFault.exe 2472 WerFault.exe 2472 WerFault.exe 2472 WerFault.exe 2472 WerFault.exe 2472 WerFault.exe 2472 WerFault.exe 2472 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 2472 WerFault.exe Token: SeBackupPrivilege 2472 WerFault.exe Token: SeDebugPrivilege 2472 WerFault.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
Processes:
WINWORD.EXEpid process 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
WINWORD.EXEexplorer.exedescription pid process target process PID 3176 wrote to memory of 2088 3176 WINWORD.EXE explorer.exe PID 3176 wrote to memory of 2088 3176 WINWORD.EXE explorer.exe PID 1256 wrote to memory of 2428 1256 explorer.exe mshta.exe PID 1256 wrote to memory of 2428 1256 explorer.exe mshta.exe PID 1256 wrote to memory of 2428 1256 explorer.exe mshta.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\certificate.06.21.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer c:\programdata\vbaQueryCount.hta2⤵
- Process spawned unexpected child process
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\vbaQueryCount.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 13603⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 16323⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\vbaQueryCount.htaMD5
8333d57a044a01797f6e120b4c1b1dc2
SHA1e726e247c84dda75df1963d5899c22093291062c
SHA256dddcc267ce697c5ec06aacdaf884d2eced853e987aef4767472d491db9903258
SHA512af1223a529ff5bea9c4ff18068aa83cb55e0b6fea2076672cbd8e6c633ebe76e3fd75b1275710eaf36e3991916645b3b4b3f5877f88dae339ec1a60923b26393
-
memory/2088-179-0x0000000000000000-mapping.dmp
-
memory/2428-181-0x0000000000000000-mapping.dmp
-
memory/3176-114-0x00007FF800890000-0x00007FF8008A0000-memory.dmpFilesize
64KB
-
memory/3176-115-0x00007FF800890000-0x00007FF8008A0000-memory.dmpFilesize
64KB
-
memory/3176-116-0x00007FF800890000-0x00007FF8008A0000-memory.dmpFilesize
64KB
-
memory/3176-117-0x00007FF800890000-0x00007FF8008A0000-memory.dmpFilesize
64KB
-
memory/3176-119-0x00007FF800890000-0x00007FF8008A0000-memory.dmpFilesize
64KB
-
memory/3176-118-0x00007FF821D40000-0x00007FF824863000-memory.dmpFilesize
43.1MB
-
memory/3176-122-0x00007FF81C2B0000-0x00007FF81D39E000-memory.dmpFilesize
16.9MB
-
memory/3176-123-0x00007FF81A3B0000-0x00007FF81C2A5000-memory.dmpFilesize
31.0MB