Analysis
-
max time kernel
107s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-10-2021 22:45
Behavioral task
behavioral1
Sample
f9e93efc4b1327a0d22b6666af3f3b2e0c91c460c2c75c6a76380779cfebd972.doc
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
f9e93efc4b1327a0d22b6666af3f3b2e0c91c460c2c75c6a76380779cfebd972.doc
Resource
win10v20210408
General
-
Target
f9e93efc4b1327a0d22b6666af3f3b2e0c91c460c2c75c6a76380779cfebd972.doc
-
Size
69KB
-
MD5
6b4e49172557753be4a506d1647d45d8
-
SHA1
63da363f5ab6eae78b9305a0b077250226860bca
-
SHA256
f9e93efc4b1327a0d22b6666af3f3b2e0c91c460c2c75c6a76380779cfebd972
-
SHA512
247fad1b2e3f09b13100796b98547c4bac457b05f5ea84ab66be0c3c8a1104c2dfb1263ea31b9e64b342cabf6be9a3d19604bc3e6c84086b9cc2048bf03768d2
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
mshta.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 1700 4060 mshta.exe WINWORD.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
mshta.exeflow pid process 49 1700 mshta.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4060 WINWORD.EXE 4060 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 19 IoCs
Processes:
WINWORD.EXEpid process 4060 WINWORD.EXE 4060 WINWORD.EXE 4060 WINWORD.EXE 4060 WINWORD.EXE 4060 WINWORD.EXE 4060 WINWORD.EXE 4060 WINWORD.EXE 4060 WINWORD.EXE 4060 WINWORD.EXE 4060 WINWORD.EXE 4060 WINWORD.EXE 4060 WINWORD.EXE 4060 WINWORD.EXE 4060 WINWORD.EXE 4060 WINWORD.EXE 4060 WINWORD.EXE 4060 WINWORD.EXE 4060 WINWORD.EXE 4060 WINWORD.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 4060 wrote to memory of 1700 4060 WINWORD.EXE mshta.exe PID 4060 wrote to memory of 1700 4060 WINWORD.EXE mshta.exe PID 4060 wrote to memory of 1700 4060 WINWORD.EXE mshta.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f9e93efc4b1327a0d22b6666af3f3b2e0c91c460c2c75c6a76380779cfebd972.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\carolineKingSea.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\users\public\carolineKingSea.htaMD5
576937bce3977cbd2848ef21f1898110
SHA11eb843c2e4005c6333162bd1fa79dd0ca1fb9045
SHA2569887099e16955ec40cfbb1ba4f07e0458d4688adb8111e40009965b6b95da1a7
SHA512a925ebc2f04e29918c42f6d38fec35189742dcf60c6756b1a214a823032e50fc525d05d9915758d201f62332b187eb40d9b98754d7aade1e376c099d3c78e474
-
memory/1700-269-0x0000000000000000-mapping.dmp
-
memory/4060-120-0x0000029746350000-0x0000029746352000-memory.dmpFilesize
8KB
-
memory/4060-117-0x00007FFA70CE0000-0x00007FFA70CF0000-memory.dmpFilesize
64KB
-
memory/4060-118-0x00007FFA70CE0000-0x00007FFA70CF0000-memory.dmpFilesize
64KB
-
memory/4060-119-0x0000029746350000-0x0000029746352000-memory.dmpFilesize
8KB
-
memory/4060-114-0x00007FFA70CE0000-0x00007FFA70CF0000-memory.dmpFilesize
64KB
-
memory/4060-121-0x0000029746350000-0x0000029746352000-memory.dmpFilesize
8KB
-
memory/4060-129-0x0000029746350000-0x0000029746352000-memory.dmpFilesize
8KB
-
memory/4060-130-0x0000029746350000-0x0000029746352000-memory.dmpFilesize
8KB
-
memory/4060-131-0x0000029746350000-0x0000029746352000-memory.dmpFilesize
8KB
-
memory/4060-132-0x0000029746350000-0x0000029746352000-memory.dmpFilesize
8KB
-
memory/4060-133-0x0000029746350000-0x0000029746352000-memory.dmpFilesize
8KB
-
memory/4060-116-0x00007FFA70CE0000-0x00007FFA70CF0000-memory.dmpFilesize
64KB
-
memory/4060-115-0x00007FFA70CE0000-0x00007FFA70CF0000-memory.dmpFilesize
64KB