Overview

overview

10

Static

static

8

inquiry.05.17.21.doc

windows7_x64

8

inquiry.05.17.21.doc

windows10_x64

10

Resubmissions

05-07-2021 08:44

210705-zn2djalaha 10

17-05-2021 18:21

210517-j2ekvjz9y6 10

17-05-2021 18:12

210517-fgl1pmhee2 10

Analysis

  • max time kernel
    141s
  • max time network
    154s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    05-07-2021 08:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    inquiry.05.17.21.doc

  • Size

    65KB

  • MD5

    e0452e225acb088de11d6517db7479ac

  • SHA1

    298ea7b0e1035975e024876665aa13f2a15ea8f7

  • SHA256

    7215e503b77bdd7fd48b5f63cbce288bf0caa00ed5688bc9b810cb51ed3a765a

  • SHA512

    376a1bb04cfc540f2e7ddc3c7a9d69dce0126dd94b6a13c073c556c82a9eb9857437bb3aa90e2964bf89e8036cca7a32d193bdc67f44218560825c6770ea85f8

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\inquiry.05.17.21.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3744
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
    1⤵
      PID:3152
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
      1⤵
        PID:1224
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Public\vbProcedureLink.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        1⤵
          PID:2448
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 1360
            2⤵
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2880
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 1628
            2⤵
            • Suspicious use of NtCreateProcessExOtherParentProcess
            • Program crash
            PID:3240
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
          1⤵
          • Drops file in Windows directory
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:3268
        • C:\Windows\system32\browser_broker.exe
          C:\Windows\system32\browser_broker.exe -Embedding
          1⤵
          • Modifies Internet Explorer settings
          PID:2060
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4352
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:4416

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Privilege Escalation

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        Query Registry

        2
        T1012

        System Information Discovery

        2
        T1082

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Public\vbProcedureLink.hta
          MD5

          bea16a989551cdedf9c8ef40f6658a1b

          SHA1

          89adc9e9a64e175e19fa67ed5ea60235f259b702

          SHA256

          1ba01f2fd5abd26077787c276bdd317ba634efb1611a58ff36379e5db10f5ddb

          SHA512

          6fa296cda8cf2cdbb59cf7c7255cd957d968b80f74e409ac8f16ebc838dd61be0960bbd5b46a2f207d8527bfce2ce1d810cb4165bd5996dc5b4834f906a6a2b1

          Download Submit
        • memory/3744-114-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3744-115-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3744-116-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3744-117-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3744-119-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3744-118-0x00007FF9DA4A0000-0x00007FF9DCFC3000-memory.dmp
          Filesize

          43.1MB

          Download
        • memory/3744-122-0x00007FF9D2F40000-0x00007FF9D402E000-memory.dmp
          Filesize

          16.9MB

          Download
        • memory/3744-123-0x00007FF9D1040000-0x00007FF9D2F35000-memory.dmp
          Filesize

          31.0MB

          Download