Analysis
-
max time kernel
51s -
max time network
56s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
23-06-2022 11:18
General
-
Target
tst.docm
-
Size
2.6MB
-
MD5
47a9a2a519731faa421cf0a0f4ab9a8d
-
SHA1
54d9286231811e3fd38e179b9202a59ef4bd651d
-
SHA256
7a5ef2562d7e5c7bdf582fc65b3b9e29eeee1acbfd7679070baf22fd88e18cfc
-
SHA512
39a54d3cd397ebe5230323a68b114bc19511cba5d6a10aeddff47b24c1414b3de4cf003f35bb7e419c782d6637dbe9766bf664e21be139ed67361456e70d124c
Malware Config
Signatures
-
Detects SVCReady loader 1 IoCs
-
SVCReady
SVCReady is a malware loader first seen in April 2022.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\tst.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\r7F86.tmp.exe"C:\Users\Admin\AppData\Local\Temp\r7F86.tmp.exe" "C:\Users\Admin\AppData\Local\Temp\y7F85.tmp.dll",DllRegisterServer2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5f57886ace1ab4972b0308f69b1a0029c
SHA1519b2a981cb522ed2b0901f9871f9aa9781a6cd5
SHA2562be981b3686ee5e725583f5936f5f0a0992723cad784457f91d9d1d5a15a0852
SHA512c2b3f016a8c3993771cd5709e469c9dedfa1dd35047691de5e853e2ad0ac025ec210fc6cb662c82d08f62e2c889e5060e796414a4eaf6a6c1719cdd7e5debdf8
-
Filesize
59KB
MD5f57886ace1ab4972b0308f69b1a0029c
SHA1519b2a981cb522ed2b0901f9871f9aa9781a6cd5
SHA2562be981b3686ee5e725583f5936f5f0a0992723cad784457f91d9d1d5a15a0852
SHA512c2b3f016a8c3993771cd5709e469c9dedfa1dd35047691de5e853e2ad0ac025ec210fc6cb662c82d08f62e2c889e5060e796414a4eaf6a6c1719cdd7e5debdf8
-
Filesize
820KB
MD5e9334bc1f6db1fe8db13e17c47299c74
SHA1da12f863b1c4f437efc8a5faa8e04e32439eb479
SHA256a7628a09046bc9f9144ecf506ef5a399befb8a985b028db8032a40ae0f96cf86
SHA512b2e10ccb89dc2ec23a824cf9c39d76c698f3f1f4a3498c1fcc7b68a73a9a15e28aac512a010c769582b965d544ee558cfdc2e59a672dd7e782826e9776640d95
-
Filesize
820KB
MD5e9334bc1f6db1fe8db13e17c47299c74
SHA1da12f863b1c4f437efc8a5faa8e04e32439eb479
SHA256a7628a09046bc9f9144ecf506ef5a399befb8a985b028db8032a40ae0f96cf86
SHA512b2e10ccb89dc2ec23a824cf9c39d76c698f3f1f4a3498c1fcc7b68a73a9a15e28aac512a010c769582b965d544ee558cfdc2e59a672dd7e782826e9776640d95
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
24KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
-
Filesize
1.6MB
-
Filesize
832KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
824KB
-
Filesize
984KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
984KB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB