Analysis
-
max time kernel
108s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
22-07-2021 12:38
Static task
static1
Behavioral task
behavioral1
Sample
figures-07.21.doc
Resource
win7v20210408
Behavioral task
behavioral2
Sample
figures-07.21.doc
Resource
win10v20210410
General
-
Target
figures-07.21.doc
-
Size
68KB
-
MD5
770a8bde63b2e589403e5ee9f3e4cc1a
-
SHA1
6e52cb2ffebde22b9a9870a8ea8b4e26922f9f22
-
SHA256
164f30f3849b54f2e3c1aef75cfc9a9f4c6f39df382656ef3eac9d7d3b1d0f52
-
SHA512
df95e8d07a4eef860653a9a9ab3272201ccbcba0a67a3ba918880da79df9dbece4ffac7b38ecfca33cf15bb6b2d1a42e93fd9692bbef5af05a40f2664d17e3a3
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3964 3908 cmd.exe WINWORD.EXE -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 3636 created 2072 3636 WerFault.exe mshta.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1228 2072 WerFault.exe mshta.exe 3636 2072 WerFault.exe mshta.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3908 WINWORD.EXE 3908 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
WerFault.exepid process 1228 WerFault.exe 1228 WerFault.exe 1228 WerFault.exe 1228 WerFault.exe 1228 WerFault.exe 1228 WerFault.exe 1228 WerFault.exe 1228 WerFault.exe 1228 WerFault.exe 1228 WerFault.exe 1228 WerFault.exe 1228 WerFault.exe 1228 WerFault.exe 1228 WerFault.exe 1228 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 1228 WerFault.exe Token: SeBackupPrivilege 1228 WerFault.exe Token: SeDebugPrivilege 1228 WerFault.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
WINWORD.EXEpid process 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
WINWORD.EXEcmd.exedescription pid process target process PID 3908 wrote to memory of 3964 3908 WINWORD.EXE cmd.exe PID 3908 wrote to memory of 3964 3908 WINWORD.EXE cmd.exe PID 3964 wrote to memory of 2072 3964 cmd.exe mshta.exe PID 3964 wrote to memory of 2072 3964 cmd.exe mshta.exe PID 3964 wrote to memory of 2072 3964 cmd.exe mshta.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\figures-07.21.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c c:\programdata\brI.hta2⤵
- Process spawned unexpected child process
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\programdata\brI.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 13884⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 5644⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\programdata\brI.htaMD5
8fcd0dbd0852a211a5e97560a3249f94
SHA1608b8a74563be8a71d6f8b151fbce12a489cab79
SHA2566b93a32417bedf141d0dc6488ce1a42f21ae06470eca19983c003a6a3901996f
SHA51205ccb7739bee5b5563c8f1fb8fd1fe5e2c59dc1cd2a77f54809a27da81cfd6d964462f7da7e7817295ca12dd864b41549330d7d083b205eb19b6fb0fb9f7b757
-
memory/2072-252-0x0000000000000000-mapping.dmp
-
memory/3908-117-0x00007FF824490000-0x00007FF8244A0000-memory.dmpFilesize
64KB
-
memory/3908-114-0x00007FF824490000-0x00007FF8244A0000-memory.dmpFilesize
64KB
-
memory/3908-119-0x00007FF824490000-0x00007FF8244A0000-memory.dmpFilesize
64KB
-
memory/3908-118-0x00007FF8458D0000-0x00007FF8483F3000-memory.dmpFilesize
43.1MB
-
memory/3908-122-0x00007FF83F100000-0x00007FF8401EE000-memory.dmpFilesize
16.9MB
-
memory/3908-123-0x00007FF83D200000-0x00007FF83F0F5000-memory.dmpFilesize
31.0MB
-
memory/3908-116-0x00007FF824490000-0x00007FF8244A0000-memory.dmpFilesize
64KB
-
memory/3908-115-0x00007FF824490000-0x00007FF8244A0000-memory.dmpFilesize
64KB
-
memory/3908-345-0x00007FF824490000-0x00007FF8244A0000-memory.dmpFilesize
64KB
-
memory/3908-346-0x00007FF824490000-0x00007FF8244A0000-memory.dmpFilesize
64KB
-
memory/3908-348-0x00007FF824490000-0x00007FF8244A0000-memory.dmpFilesize
64KB
-
memory/3908-347-0x00007FF824490000-0x00007FF8244A0000-memory.dmpFilesize
64KB
-
memory/3964-226-0x0000000000000000-mapping.dmp