a8eed171fdcb2a872865620fc2234e0b07201d927abcb65344846f6d4a7b75f5

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
26/04/2022, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
libero note 26.04.2022.docm
Size 1.3MB
Sample220426-mdm2rscae4
SHA256 a8eed171fdcb2a872865620fc2234e0b07201d927abcb65344846f6d4a7b75f5
MD5 3000ec9114870e174d544c11a240b5d7
SHA1 191e499388d72bd5eb1b441bb11d61e7d1a42578
SHA512 e5f70424652cf22edc86567ef00e0a158f66ca16d367eaf52ba0b8bc4840b4a37017109037a938865a1ebee9f5aad3ac55b630aca735427257accf240342d718
MD5 SHA1 SHA512

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000700000002316c-139.dat	acprotect
behavioral2/files/0x000700000002316c-140.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
5020	r6F1B.tmp.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002316c-139.dat	upx
behavioral2/files/0x000700000002316c-140.dat	upx

Loads dropped DLL 1 IoCs

pid	Process
5020	r6F1B.tmp.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4912	WINWORD.EXE
4912	WINWORD.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4912	WINWORD.EXE
4912	WINWORD.EXE
4912	WINWORD.EXE
4912	WINWORD.EXE
4912	WINWORD.EXE
4912	WINWORD.EXE
4912	WINWORD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 5020	4912	WINWORD.EXE	86
PID 4912 wrote to memory of 5020	4912	WINWORD.EXE	86
PID 4912 wrote to memory of 5020	4912	WINWORD.EXE	86

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\libero note 26.04.2022.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\r6F1B.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\r6F1B.tmp.exe" "C:\Users\Admin\AppData\Local\Temp\y6F0A.tmp.dll",LoadLibraryC
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

r6F1B.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\r6F1B.tmp.exe
Size 60KB
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
MD5 SHA1 SHA512 SSDEEP

Submit Download

y6F0A.tmp.dll

Path C:\Users\Admin\AppData\Local\Temp\y6F0A.tmp.dll
Size 302KB
SHA256 d3e69a33913507c80742a2d7a59c889efe7aa8f52beef8d172764e049e03ead5
MD5 85a0fa3cc64d1072d885438fbe470b10
SHA1 3e85293c49c7fc9d470a41e6c40dfd521c1aa109
SHA512 bed65be63fa46fa6fd2d4e2482689565aecfa4ea68c2f5d3066206b0203b033c53d27fda09abec75fd5f119d0c33eb7904558bf190b21e153e403c884c2761ae
SSDEEP 6144:yApdVgVVmc6DgJJyIHULQgvuQwDEub+zKimXfJd5B5J2mz0TR:DmVIc6DMJ6Lb2TDEY+zYXfTviR
MD5 SHA1 SHA512 SSDEEP

Submit Download

y6F0A.tmp.dll

Path C:\Users\Admin\AppData\Local\Temp\y6F0A.tmp.dll
Size 302KB
SHA256 d3e69a33913507c80742a2d7a59c889efe7aa8f52beef8d172764e049e03ead5
MD5 85a0fa3cc64d1072d885438fbe470b10
SHA1 3e85293c49c7fc9d470a41e6c40dfd521c1aa109
SHA512 bed65be63fa46fa6fd2d4e2482689565aecfa4ea68c2f5d3066206b0203b033c53d27fda09abec75fd5f119d0c33eb7904558bf190b21e153e403c884c2761ae
SSDEEP 6144:yApdVgVVmc6DgJJyIHULQgvuQwDEub+zKimXfJd5B5J2mz0TR:DmVIc6DMJ6Lb2TDEY+zYXfTviR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4912-130-0x00007FF9E2AF0000-0x00007FF9E2B00000-memory.dmp

Download

memory/4912-132-0x00007FF9E2AF0000-0x00007FF9E2B00000-memory.dmp

Download

memory/4912-131-0x00007FF9E2AF0000-0x00007FF9E2B00000-memory.dmp

Download

memory/4912-133-0x00007FF9E2AF0000-0x00007FF9E2B00000-memory.dmp

Download

memory/4912-134-0x00007FF9E2AF0000-0x00007FF9E2B00000-memory.dmp

Download

memory/4912-136-0x000001E811B38000-0x000001E811CE1000-memory.dmp

Download

memory/4912-138-0x000001E810D90000-0x000001E810E6A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads