Overview

overview

10

Static

static

figures 07.21.doc

windows7_x64

4

figures 07.21.doc

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    22-07-2021 11:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    figures 07.21.doc

  • Size

    55KB

  • MD5

    9a412628585242c2fd670a1f014c829c

  • SHA1

    cebe9944eb0920f40328328882825b35705db4ea

  • SHA256

    a500778d298b461bfcb674459951cf37d64c32cc036617c3fe1fcea153bbf1f4

  • SHA512

    c877996419988d0a3dd3f23053cbb3d6e7d51c90cd2568dd58d5a0a734ace283b6a3fdf1c3e1c8cb9d67b09d2183ba92d330a03b523024b0ce9cc894248d14d2

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\figures 07.21.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:656
    • C:\Windows\SYSTEM32\scriptrunner.exe
      scriptrunner.exe -appvscript c:\programdata\deleteLeft.wsf
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:204
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\programdata\deleteLeft.wsf"
        3⤵
        • Blocklisted process makes network request
        PID:4024
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2892
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:752
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1332
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:4104
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:4428
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:4592
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:4676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\programdata\deleteLeft.wsf
    MD5

    0596e82721f6201b33c86aeb613d6529

    SHA1

    0aa4fc5229a4c97388e3a46d00626154f132dd2e

    SHA256

    1d922d3284d05fbfe1630d4f608a4fdddea5ead3a8a115f39bc4b0e5fda077a7

    SHA512

    c9ad238028b4d7f946730e08fc234105373b5e399cd5fc178ef47e502a4fee7f03c297e2930c31c2d045142a37e4cefc2a2c14d13ab2faeec3b6a430a137b03b

    Download Submit
  • memory/204-259-0x0000000000000000-mapping.dmp
    Download
  • memory/204-260-0x0000024BADB80000-0x0000024BADB81000-memory.dmp
    Filesize

    4KB

    Download
  • memory/656-114-0x00007FFDB5990000-0x00007FFDB59A0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/656-115-0x00007FFDB5990000-0x00007FFDB59A0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/656-116-0x00007FFDB5990000-0x00007FFDB59A0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/656-117-0x00007FFDB5990000-0x00007FFDB59A0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/656-119-0x00007FFDB5990000-0x00007FFDB59A0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/656-118-0x00007FFDD6D30000-0x00007FFDD9853000-memory.dmp
    Filesize

    43.1MB

    Download
  • memory/656-122-0x00007FFDD0620000-0x00007FFDD170E000-memory.dmp
    Filesize

    16.9MB

    Download
  • memory/656-123-0x00007FFDCE720000-0x00007FFDD0615000-memory.dmp
    Filesize

    31.0MB

    Download
  • memory/4024-262-0x0000000000000000-mapping.dmp
    Download