Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 19:52
General
-
Target
name-document-07.01.22.docm
-
Size
2.8MB
-
MD5
09aecad99bb54ed3aeff7c49dcdcf451
-
SHA1
e0d7860edf2d0e61b99a7b8e09154c06ee87d673
-
SHA256
ab23bcdd3dc4a891b3d2ca1d54888a72b70619a019de3ffb8889cbaff0c52155
-
SHA512
42666dfd240f2deac5fc08df779830821e1093ddc75ae74295fc5c91308e2ce3f617af799a6210e10e6b9fd29aa75ed90066cb2fca9e4ccffeb2dc1551ddfdef
Malware Config
Signatures
-
Detects SVCReady loader 1 IoCs
-
SVCReady
SVCReady is a malware loader first seen in April 2022.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\name-document-07.01.22.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\r796C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\r796C.tmp.exe" "C:\Users\Admin\AppData\Local\Temp\y796B.tmp.dll",DllRegisterServer2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
Filesize
872KB
MD5a84fc1d210de76f4b5e4434bacfc6d84
SHA1e44c9e081bb49e9b52f49d621a183eed0b2be02f
SHA25664583aa980ff5d3e903c5fc00f835d1043bc5c2d2d41fd098275280fdddc21a1
SHA512c44a9fc2dd1f8d897a71ad4bb4d0801ec328c2ca046de92da3e4b61bf254e8b879925f9b62f963d34578956ef8374ac6f320b51819c23c648c78e920dfbc7a12
-
Filesize
872KB
MD5a84fc1d210de76f4b5e4434bacfc6d84
SHA1e44c9e081bb49e9b52f49d621a183eed0b2be02f
SHA25664583aa980ff5d3e903c5fc00f835d1043bc5c2d2d41fd098275280fdddc21a1
SHA512c44a9fc2dd1f8d897a71ad4bb4d0801ec328c2ca046de92da3e4b61bf254e8b879925f9b62f963d34578956ef8374ac6f320b51819c23c648c78e920dfbc7a12
-
Filesize
872KB
MD5a84fc1d210de76f4b5e4434bacfc6d84
SHA1e44c9e081bb49e9b52f49d621a183eed0b2be02f
SHA25664583aa980ff5d3e903c5fc00f835d1043bc5c2d2d41fd098275280fdddc21a1
SHA512c44a9fc2dd1f8d897a71ad4bb4d0801ec328c2ca046de92da3e4b61bf254e8b879925f9b62f963d34578956ef8374ac6f320b51819c23c648c78e920dfbc7a12
-
Filesize
36KB
-
Filesize
8KB
-
Filesize
36KB
-
Filesize
8KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
8KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
8KB
-
Filesize
36KB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
36KB
-
Filesize
8KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
8KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
1.9MB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
36KB
-
Filesize
876KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
888KB
-
Filesize
24KB
-
Filesize
888KB
-