Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
21-10-2021 13:33
Static task
static1
Behavioral task
behavioral1
Sample
statistics.010.21.21.doc
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
statistics.010.21.21.doc
Resource
win10-en-20211014
General
-
Target
statistics.010.21.21.doc
-
Size
34KB
-
MD5
81a0f5b3638ae19f39850639ca26323a
-
SHA1
c5079a46f9391690ecb2023c54c8022b375e507e
-
SHA256
c39abbf3cd7a0a4055f7b36f73c1b3bce6b02a74d6fd700a46c3993e37544ee6
-
SHA512
b317a4bce70605eb5ea6be5818be274454d56a202c5c652682291c574bd5a1a63a8ae0646d09771ccdfaca08d1ee7c069c6fb236d257a78de32bacf65743e872
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
mshta.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3296 4056 mshta.exe WINWORD.EXE -
Bazar/Team9 Loader payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3688-292-0x0000000002060000-0x0000000002286000-memory.dmp BazarLoaderVar5 -
Blocklisted process makes network request 1 IoCs
Processes:
mshta.exeflow pid process 38 3296 mshta.exe -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 3936 regsvr32.exe 3688 regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4056 WINWORD.EXE 4056 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
Processes:
WINWORD.EXEpid process 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
WINWORD.EXEmshta.exeregsvr32.exedescription pid process target process PID 4056 wrote to memory of 3296 4056 WINWORD.EXE mshta.exe PID 4056 wrote to memory of 3296 4056 WINWORD.EXE mshta.exe PID 4056 wrote to memory of 3296 4056 WINWORD.EXE mshta.exe PID 3296 wrote to memory of 3936 3296 mshta.exe regsvr32.exe PID 3296 wrote to memory of 3936 3296 mshta.exe regsvr32.exe PID 3296 wrote to memory of 3936 3296 mshta.exe regsvr32.exe PID 3936 wrote to memory of 3688 3936 regsvr32.exe regsvr32.exe PID 3936 wrote to memory of 3688 3936 regsvr32.exe regsvr32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\statistics.010.21.21.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\lineMyCaroline.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" c:\users\public\lineYou.jpg3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exec:\users\public\lineYou.jpg4⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\users\public\lineMyCaroline.htaMD5
4ee98889de12d1ca3c1ca877d6279168
SHA1539c1f07e86a1dabec305cb89992b948f70edb55
SHA256a3fe2af0e6b795d7a998ef2479e4fc7af361057e4d2831a7ec9492fed89cb599
SHA5126f00ea415d55913bbf6a12d30dde7ff59a911d908519797711b3e7163d83c53b3446d75151f366856f8e9887f175c6128aa03fe6cc701b43451e9de1d5c0a2c8
-
\??\c:\users\public\lineYou.jpgMD5
86f7e1efba2afd4d2c071d87317388b7
SHA18892705d4df071307ad7faa960c2b8abaa8aaea4
SHA2560d5ee6a999dab96bfa9db3464f197934d6aba840c116883cb1cbc9030bbcc7a8
SHA5124ffa1681d4b02b20ca823be4e3ac1bc34ab864bcb13aedbc06586c2511ec30e77d4ac29a4ac97f40223ac0f95847a9c6df9d44666d90bd6098d1ff5f2b80b02c
-
\Users\Public\lineYou.jpgMD5
86f7e1efba2afd4d2c071d87317388b7
SHA18892705d4df071307ad7faa960c2b8abaa8aaea4
SHA2560d5ee6a999dab96bfa9db3464f197934d6aba840c116883cb1cbc9030bbcc7a8
SHA5124ffa1681d4b02b20ca823be4e3ac1bc34ab864bcb13aedbc06586c2511ec30e77d4ac29a4ac97f40223ac0f95847a9c6df9d44666d90bd6098d1ff5f2b80b02c
-
\Users\Public\lineYou.jpgMD5
86f7e1efba2afd4d2c071d87317388b7
SHA18892705d4df071307ad7faa960c2b8abaa8aaea4
SHA2560d5ee6a999dab96bfa9db3464f197934d6aba840c116883cb1cbc9030bbcc7a8
SHA5124ffa1681d4b02b20ca823be4e3ac1bc34ab864bcb13aedbc06586c2511ec30e77d4ac29a4ac97f40223ac0f95847a9c6df9d44666d90bd6098d1ff5f2b80b02c
-
memory/3296-256-0x0000000000000000-mapping.dmp
-
memory/3688-290-0x0000000000000000-mapping.dmp
-
memory/3688-292-0x0000000002060000-0x0000000002286000-memory.dmpFilesize
2.1MB
-
memory/3936-287-0x0000000000000000-mapping.dmp
-
memory/4056-120-0x000001F3482D0000-0x000001F3482D2000-memory.dmpFilesize
8KB
-
memory/4056-121-0x000001F3482D0000-0x000001F3482D2000-memory.dmpFilesize
8KB
-
memory/4056-122-0x000001F3482D0000-0x000001F3482D2000-memory.dmpFilesize
8KB
-
memory/4056-115-0x00007FF86EA30000-0x00007FF86EA40000-memory.dmpFilesize
64KB
-
memory/4056-119-0x00007FF86EA30000-0x00007FF86EA40000-memory.dmpFilesize
64KB
-
memory/4056-118-0x00007FF86EA30000-0x00007FF86EA40000-memory.dmpFilesize
64KB
-
memory/4056-117-0x00007FF86EA30000-0x00007FF86EA40000-memory.dmpFilesize
64KB
-
memory/4056-116-0x00007FF86EA30000-0x00007FF86EA40000-memory.dmpFilesize
64KB