Analysis
-
max time kernel
7s -
max time network
12s -
platform
windows10_x64 -
resource
win10-ja-20210920 -
submitted
18-10-2021 13:41
Behavioral task
behavioral1
Sample
ordain_09.21.doc
Resource
win10-ja-20210920
General
-
Target
ordain_09.21.doc
-
Size
69KB
-
MD5
2d7fb9d466c3209e6e16cf769e604a9a
-
SHA1
c6f80b1ea7d6eb0926510f5ab954c36213c71058
-
SHA256
928d361233bd981716eb4396cd617d004b394fd2705ef6f43c86c9f2611063d6
-
SHA512
ed7a03c6b8d3b4636ff1b6ee8a53b39484c626036f9f060032899643da9b02045c9d671d1bdeccc3708c6d2d314f4c8599b3f9526f29d43798484e2e476c3880
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
explorer.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 2788 3908 explorer.exe WINWORD.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3908 WINWORD.EXE 3908 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
WINWORD.EXEexplorer.exedescription pid process target process PID 3908 wrote to memory of 2788 3908 WINWORD.EXE explorer.exe PID 3908 wrote to memory of 2788 3908 WINWORD.EXE explorer.exe PID 4796 wrote to memory of 4480 4796 explorer.exe mshta.exe PID 4796 wrote to memory of 4480 4796 explorer.exe mshta.exe PID 4796 wrote to memory of 4480 4796 explorer.exe mshta.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ordain_09.21.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeC:\Windows\explorer.exe currDeDt.hta2⤵
- Process spawned unexpected child process
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\currDeDt.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" c:\users\public\currDeDt.jpg3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\currDeDt.htaMD5
12fe4e43c39a8d9b18fb657efa0232fe
SHA1947cfea72cef5ab60a3c60919b95b583f77095c9
SHA2564d20a250cebb434199d4d6c5b81fc7b7c8c18f090a283d1a77bc67b8f3881b21
SHA512863a6d4a78c237d23d58fe9ea4b9be41788550b90fb2eedeb87e82f9a30b15c386335e9410508139ce91ae37200ca1be47087b560aaf45613fb531de850c36ee
-
memory/2364-278-0x0000000000000000-mapping.dmp
-
memory/2788-253-0x0000000000000000-mapping.dmp
-
memory/3908-115-0x00007FF8DEDA0000-0x00007FF8DEDB0000-memory.dmpFilesize
64KB
-
memory/3908-116-0x00007FF8DEDA0000-0x00007FF8DEDB0000-memory.dmpFilesize
64KB
-
memory/3908-117-0x00007FF8DEDA0000-0x00007FF8DEDB0000-memory.dmpFilesize
64KB
-
memory/3908-118-0x00007FF8DEDA0000-0x00007FF8DEDB0000-memory.dmpFilesize
64KB
-
memory/3908-120-0x0000021BBEB70000-0x0000021BBEB72000-memory.dmpFilesize
8KB
-
memory/3908-119-0x0000021BBEB70000-0x0000021BBEB72000-memory.dmpFilesize
8KB
-
memory/3908-121-0x00007FF8DEDA0000-0x00007FF8DEDB0000-memory.dmpFilesize
64KB
-
memory/3908-122-0x0000021BBEB70000-0x0000021BBEB72000-memory.dmpFilesize
8KB
-
memory/4480-255-0x0000000000000000-mapping.dmp