Overview

overview

10

Static

static

1cam.doc

windows7_x64

10

1cam.doc

windows10_x64

1

Analysis

  • max time kernel
    144s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    07/12/2021, 12:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1cam.doc
  • Size 501KB
  • Sample211207-p4mvsshcem
  • SHA256 0fef64eab9583e653f02f7fc28af21b9cc14265f8a6bbae518e2325d417994cd
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://91.92.109.142/roben.png
  • exe.dropper

    http://192.99.255.33/images/roben.png
  • exe.dropper

    http://185.183.98.15/roben.png
  • exe.dropper

    http://83.138.53.103/images/roben.png
  • exe.dropper

    http://172.96.189.216/images/roben.png

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 11 IoCs
  • Drops file in Windows directory 4 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1cam.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1868
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1152
    • C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:484
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Public\Documents\1.mstsc, dpi360ntW
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:984
        • C:\Windows\SysWOW64\cmd.exe
          /c C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy bypass -noprofile -file C:\Users\Admin\AppData\Local\Temp\2.ps1
          3⤵
            PID:1440
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy bypass -noprofile -file C:\Users\Admin\AppData\Local\Temp\2.ps1
              4⤵
              • Blocklisted process makes network request
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1588

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/1152-60-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp
            Download

            memory/1588-86-0x0000000001FF0000-0x0000000001FF1000-memory.dmp
            Download

            memory/1588-88-0x0000000001FF2000-0x0000000001FF4000-memory.dmp
            Download

            memory/1588-87-0x0000000001FF1000-0x0000000001FF2000-memory.dmp
            Download

            memory/1868-57-0x000000005FFF0000-0x0000000060000000-memory.dmp
            Download

            memory/1868-69-0x00000000006B2000-0x00000000006B6000-memory.dmp
            Download

            memory/1868-62-0x00000000006B2000-0x00000000006B6000-memory.dmp
            Download

            memory/1868-73-0x00000000006B2000-0x00000000006B6000-memory.dmp
            Download

            memory/1868-58-0x0000000076A21000-0x0000000076A23000-memory.dmp
            Download

            memory/1868-61-0x00000000006B2000-0x00000000006B6000-memory.dmp
            Download

            memory/1868-83-0x000000005FFF0000-0x0000000060000000-memory.dmp
            Download

            memory/1868-55-0x0000000072EB1000-0x0000000072EB4000-memory.dmp
            Download

            memory/1868-65-0x00000000006B2000-0x00000000006B6000-memory.dmp
            Download

            memory/1868-63-0x00000000006B2000-0x00000000006B6000-memory.dmp
            Download

            memory/1868-64-0x00000000006B2000-0x00000000006B6000-memory.dmp
            Download

            memory/1868-56-0x0000000070931000-0x0000000070933000-memory.dmp
            Download