Overview

overview

10

Static

static

8

input.010.21.2021.doc

windows7_x64

10

input.010.21.2021.doc

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    21-10-2021 15:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    input.010.21.2021.doc

  • Size

    34KB

  • MD5

    b9470a968a6edf4b2ce6c52d69610235

  • SHA1

    5219339d196bd7c698f51973c06c1a32370d9f65

  • SHA256

    bdd3eeea2e9c2930f75115dc2bccfef990d6aae5d8b0253c1e0effa0b1911b5b

  • SHA512

    bdbec4af4913e9b87603f3d1c946667782803f32a8d194de4aa9ce7eae0da7c1b16b8bfbc9d467bba1aa5e9a48ff650aaf26c886a2d1c1cb9d7fc5dc732e85ea

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\input.010.21.2021.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2696
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\users\public\kingSeaCaroline.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:3748
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" c:\users\public\carolineLadySea.jpg
        3⤵
          PID:1364
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1752
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:2636
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2872
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:2108
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:1996
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:4304
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:4388

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    System Information Discovery

    3
    T1082

    Query Registry

    2
    T1012

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\users\public\kingSeaCaroline.hta
      MD5

      fc60bfbcfb72c73cf4380e3d69f8ff30

      SHA1

      ec4c91db6a6459c765e90db04294094f264d28c3

      SHA256

      f4c0fdcc5b0a4f27af58e52571b63b121d09ae37f5d9772d68c2912f6c2ae58b

      SHA512

      f21c3e33042434d1bd0a4ff74210a280f5f30b8c36f0b5623f1659e8f0ef7a5c79a643864b1e6032fb69485a8c7dd10d983640784d678b8d04688d4a315f675a

      Download Submit
    • \??\c:\users\public\carolineLadySea.jpg
      MD5

      4007b2db898dbd042f6f62a3e60539ae

      SHA1

      5f926b178fc208723ee165a120f7570a1f1c0dbe

      SHA256

      5a8fb71dcd8a5b56672ffae188baab6370648a2b9ca0dc763add672db2cac0d0

      SHA512

      4ff8b9db8d2271d971369ab15256a7746533f7545d61b85a09edb86297d61206ade0bac69cc726ea8cc819ada9f37d5148cc1c0199ef4e1520815bbaf47e30f6

      Download Submit
    • memory/1364-286-0x0000000000000000-mapping.dmp
      Download
    • memory/2696-115-0x00007FFED4D40000-0x00007FFED4D50000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2696-116-0x00007FFED4D40000-0x00007FFED4D50000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2696-117-0x00007FFED4D40000-0x00007FFED4D50000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2696-118-0x00007FFED4D40000-0x00007FFED4D50000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2696-119-0x00007FFED4D40000-0x00007FFED4D50000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2696-120-0x00000221AF3E0000-0x00000221AF3E2000-memory.dmp
      Filesize

      8KB

      Download
    • memory/2696-121-0x00000221AF3E0000-0x00000221AF3E2000-memory.dmp
      Filesize

      8KB

      Download
    • memory/2696-122-0x00000221AF3E0000-0x00000221AF3E2000-memory.dmp
      Filesize

      8KB

      Download
    • memory/3748-256-0x0000000000000000-mapping.dmp
      Download