Analysis
- max time kernel
149s - max time network
150s - platform
windows10_x64 - resource
win10v20210408 - submitted
19/07/2021, 17:34
General
- Target PO for ART IMPEX GROUP LLP.doc
- Size 1.0MB
- Sample210719-e2q3d2693a
- SHA256 f415487e104efb2d80000858f7942cd9db73526601066eca5e63d99a50926298
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 10 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\PO for ART IMPEX GROUP LLP.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/632-122-0x00007FFAE06B0000-0x00007FFAE179E000-memory.dmp
memory/632-116-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp
memory/632-117-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp
memory/632-119-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp
memory/632-118-0x00007FFAE5F50000-0x00007FFAE8A73000-memory.dmp
memory/632-114-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp
memory/632-123-0x00007FFADE7B0000-0x00007FFAE06A5000-memory.dmp
memory/632-115-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp
memory/1296-362-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp
memory/1296-363-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp
memory/1296-364-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp
memory/1296-366-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp