Overview

overview

10

Static

static

policeTemplate7.dotm

windows7_x64

10

policeTemplate7.dotm

windows10-2004_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220331-en
  • submitted
    05/04/2022, 06:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    policeTemplate7.dotm
  • Size 54KB
  • Sample220405-hgb2fsecgn
  • SHA256 cbd6f89dae3b013f598664bb004eeea0a45c8bf31ae2197adab1b8907b65dc12
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\policeTemplate7.dotm" /o ""
    1⤵
    • Enumerates connected drives
    • Suspicious use of SetThreadContext
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3584
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4996
      • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"
        2⤵
          PID:4960
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 4960 -s 320
            3⤵
            • Process spawned unexpected child process
            • Program crash
            PID:220
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -pss -s 428 -p 4960 -ip 4960
        1⤵
          PID:4148

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              memory/3584-124-0x00007FF95DED0000-0x00007FF95DEE0000-memory.dmp
              Download

              memory/3584-125-0x00007FF95DED0000-0x00007FF95DEE0000-memory.dmp
              Download

              memory/3584-126-0x00007FF95DED0000-0x00007FF95DEE0000-memory.dmp
              Download

              memory/3584-127-0x00007FF95DED0000-0x00007FF95DEE0000-memory.dmp
              Download

              memory/3584-128-0x00007FF95DED0000-0x00007FF95DEE0000-memory.dmp
              Download

              memory/3584-134-0x000001B46AEA1000-0x000001B46AEA3000-memory.dmp
              Download

              memory/4960-130-0x0000000140000000-0x0000000140021000-memory.dmp
              Download

              memory/4960-132-0x0000000140000000-0x0000000140021000-memory.dmp
              Download

              memory/4960-133-0x0000000140000000-0x0000000140021000-memory.dmp
              Download