Analysis

  • max time kernel
    134s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 22:37

General

  • Target

    25aa7d7bd388d56e4c9100db78d3c45f7cd044c3250a042529b5add584e63f08.doc

  • Size

    92KB

  • MD5

    75400d47d7e8dcf4f3fef505a4ed9ed2

  • SHA1

    a4e6d4bd058fc5bd6d5d7641328a728f72e13fe2

  • SHA256

    25aa7d7bd388d56e4c9100db78d3c45f7cd044c3250a042529b5add584e63f08

  • SHA512

    e79ade66409e0629f7184c450f8b541d30d839b03766d95e633491c05c341fa7623e9cd112bb1ac312975af6d0c3eb509dd02bbb26d26c9b5cd04a6af958b5a9

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\25aa7d7bd388d56e4c9100db78d3c45f7cd044c3250a042529b5add584e63f08.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1412
    • C:\Windows\system32\rundll32.exe
      rundll32 zipfldr.dll,RouteTheCall c:\wordpress\about1.vbs
      1⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1076
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\wordpress\about1.vbs"
        2⤵
          PID:1796

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Defense Evasion

      Modify Registry

      1
      T1112

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\wordpress\about1.vbs
        Filesize

        13KB

        MD5

        fd9239c1fc37ea979492a5d3d3e827bf

        SHA1

        7bb9eed56b5191a337084afac415d0cecc5adcdc

        SHA256

        931e3ec9d8765e3d79909c83ac87e3ff7ed58088d161d431c19951083d50f5b6

        SHA512

        c411ccc0ee7fadbb6f677c1c275d4235a7c7006f2f4e0bfc94a2e4cd382b85e8e2784c111d72dac71e6fe22c968aa7bd251a0dabf670aed776da627bebb6f514

      • memory/1412-63-0x0000000000000000-mapping.dmp
      • memory/1412-64-0x000007FEFC041000-0x000007FEFC043000-memory.dmp
        Filesize

        8KB

      • memory/1684-61-0x0000000000461000-0x0000000000465000-memory.dmp
        Filesize

        16KB

      • memory/1684-58-0x000000007159D000-0x00000000715A8000-memory.dmp
        Filesize

        44KB

      • memory/1684-60-0x0000000000461000-0x0000000000465000-memory.dmp
        Filesize

        16KB

      • memory/1684-59-0x0000000000461000-0x0000000000465000-memory.dmp
        Filesize

        16KB

      • memory/1684-62-0x0000000000461000-0x0000000000465000-memory.dmp
        Filesize

        16KB

      • memory/1684-54-0x0000000072B31000-0x0000000072B34000-memory.dmp
        Filesize

        12KB

      • memory/1684-57-0x0000000075DF1000-0x0000000075DF3000-memory.dmp
        Filesize

        8KB

      • memory/1684-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

      • memory/1684-66-0x0000000000461000-0x0000000000465000-memory.dmp
        Filesize

        16KB

      • memory/1684-65-0x0000000000461000-0x0000000000465000-memory.dmp
        Filesize

        16KB

      • memory/1684-55-0x00000000705B1000-0x00000000705B3000-memory.dmp
        Filesize

        8KB

      • memory/1684-70-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

      • memory/1796-69-0x0000000000000000-mapping.dmp