Analysis

  • max time kernel
    144s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    24-07-2022 22:38

General

  • Target

    2db91acf6453d9cd831395586466d7448945f1a8eb440000b725831ef4a24de1.rtf

  • Size

    676KB

  • MD5

    d0bfa920f7237fd0a80c376e35e69987

  • SHA1

    7a49bb30661eb90ad281f0248f7db26ddb4061b8

  • SHA256

    2db91acf6453d9cd831395586466d7448945f1a8eb440000b725831ef4a24de1

  • SHA512

    12d5803715f1f20d42902ef7720f91e716bae51fb6d3adee78706d62ea7a306d8538119dcffa5db23b31ad531763a533f04f437dc4742cffa60e2b3d29c2f1b0

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 4 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 10 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1268
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2db91acf6453d9cd831395586466d7448945f1a8eb440000b725831ef4a24de1.rtf"
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:516
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\apPdata\loCal\teMp\taSk.baT
          3⤵
          • Process spawned unexpected child process
          • Suspicious use of WriteProcessMemory
          PID:2012
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\appdata\local\temp\2nd.bat
            4⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1900
            • C:\Windows\SysWOW64\timeout.exe
              TIMEOUT 1
              5⤵
              • Delays execution with timeout.exe
              PID:980
            • C:\Users\Admin\appdata\local\temp\exe.exe
              C:\Users\Admin\appdata\local\temp\ExE.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              PID:1676
              • C:\Users\Admin\appdata\local\temp\exe.exe
                C:\Users\Admin\appdata\local\temp\ExE.exe
                6⤵
                • Executes dropped EXE
                • Sets file execution options in registry
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Checks processor information in registry
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                PID:1996
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  7⤵
                  • Modifies firewall policy service
                  • Sets file execution options in registry
                  • Checks BIOS information in registry
                  • Adds Run key to start application
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Modifies Internet Explorer Protected Mode
                  • Modifies Internet Explorer Protected Mode Banner
                  • Modifies Internet Explorer settings
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of AdjustPrivilegeToken
                  PID:560
            • C:\Windows\SysWOW64\taskkill.exe
              TASKKILL /F /IM winword.exe
              5⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1868
            • C:\Windows\SysWOW64\reg.exe
              reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\Resiliency /f
              5⤵
                PID:860
              • C:\Windows\SysWOW64\reg.exe
                reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency /f
                5⤵
                  PID:776
                • C:\Windows\SysWOW64\reg.exe
                  reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency /f
                  5⤵
                    PID:1880
                  • C:\Windows\SysWOW64\reg.exe
                    reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\Resiliency /f
                    5⤵
                      PID:1364
                    • C:\Windows\SysWOW64\reg.exe
                      reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Resiliency /f
                      5⤵
                        PID:564
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1256
                        • C:\Windows\SysWOW64\reg.exe
                          REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"
                          6⤵
                            PID:320
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"
                          5⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1540
                          • C:\Windows\SysWOW64\reg.exe
                            REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"
                            6⤵
                              PID:884
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"
                            5⤵
                              PID:1808
                              • C:\Windows\SysWOW64\reg.exe
                                REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"
                                6⤵
                                  PID:1428
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"
                                5⤵
                                  PID:1012
                                  • C:\Windows\SysWOW64\reg.exe
                                    REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"
                                    6⤵
                                      PID:1620
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"
                                    5⤵
                                      PID:1580
                                      • C:\Windows\SysWOW64\reg.exe
                                        REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"
                                        6⤵
                                          PID:1604
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\apPdata\loCal\teMp\taSk.baT
                                    3⤵
                                    • Process spawned unexpected child process
                                    PID:1472
                              • C:\Windows\system32\Dwm.exe
                                "C:\Windows\system32\Dwm.exe"
                                1⤵
                                  PID:1216
                                • C:\Windows\system32\conhost.exe
                                  \??\C:\Windows\system32\conhost.exe "1692346669773449524-928423002-1010073379481641021-804847515-804075916947845424"
                                  1⤵
                                    PID:2032
                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
                                    1⤵
                                    • Launches Equation Editor
                                    • Suspicious use of WriteProcessMemory
                                    PID:1968
                                    • C:\Windows\SysWOW64\cMD.exe
                                      cMD Cmd /c %tmP%\TAsk.Bat  & UUUU c
                                      2⤵
                                        PID:1696
                                    • C:\Windows\system32\DllHost.exe
                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                      1⤵
                                        PID:1016

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Temp\exe.exe

                                        Filesize

                                        310KB

                                        MD5

                                        0a59cbcabc60f52d931e34bcb2824a47

                                        SHA1

                                        1616283dae6e5b94db9d178c4d4781f8faa184f9

                                        SHA256

                                        641915b9fb3916cf59793f98822506595e085b4b9be0c4a63699c976b9b0bf0a

                                        SHA512

                                        fce4e5a1dd20201bd3a00a0fab0ad1d5f6a537907b90bd7539027e327a5b21e2e82cadd692c3773f9f04310d99649b2e4a3a5f889cc2c796d2820b760a9c2ca2

                                      • C:\Users\Admin\AppData\Local\Temp\exe.exe

                                        Filesize

                                        310KB

                                        MD5

                                        0a59cbcabc60f52d931e34bcb2824a47

                                        SHA1

                                        1616283dae6e5b94db9d178c4d4781f8faa184f9

                                        SHA256

                                        641915b9fb3916cf59793f98822506595e085b4b9be0c4a63699c976b9b0bf0a

                                        SHA512

                                        fce4e5a1dd20201bd3a00a0fab0ad1d5f6a537907b90bd7539027e327a5b21e2e82cadd692c3773f9f04310d99649b2e4a3a5f889cc2c796d2820b760a9c2ca2

                                      • C:\Users\Admin\apPdata\loCal\teMp\TasK.BaT

                                        Filesize

                                        171B

                                        MD5

                                        6dc34de53453f0fa267653a69f34831c

                                        SHA1

                                        7b69e96fd1c5ac9063e973d8214286e8e3fb01e9

                                        SHA256

                                        0b1212179f11b6672a53a67ad42d24cfafc1064b487b1a0cb5b3318df7cbeedf

                                        SHA512

                                        370043219d716f0499bd3e782132a16fff0e331a66960dcbc892e7321160f5d88ed335760f5b29da3437f7c501732d9dd21a3c1b2d8c0d798fc04f1568813532

                                      • C:\Users\Admin\appdata\local\temp\2nd.bat

                                        Filesize

                                        1KB

                                        MD5

                                        6ff10253be7f8323ce4bf62b75e16ffe

                                        SHA1

                                        c5f0a5e8886b142009313330e56aaf208d65daff

                                        SHA256

                                        961cb46c41ef78ed21fbac361e6fe247bee82c03db354007a55fcfab8b5b3b3d

                                        SHA512

                                        c4423cc288cfb46ee50d57ab14295775527f17559f9a20e864eb416028b546632bb49526b508ce7969792e741aa929d54b71472a50bb1876a5d82f5bd2a76ff9

                                      • C:\Users\Admin\appdata\local\temp\exe.exe

                                        Filesize

                                        310KB

                                        MD5

                                        0a59cbcabc60f52d931e34bcb2824a47

                                        SHA1

                                        1616283dae6e5b94db9d178c4d4781f8faa184f9

                                        SHA256

                                        641915b9fb3916cf59793f98822506595e085b4b9be0c4a63699c976b9b0bf0a

                                        SHA512

                                        fce4e5a1dd20201bd3a00a0fab0ad1d5f6a537907b90bd7539027e327a5b21e2e82cadd692c3773f9f04310d99649b2e4a3a5f889cc2c796d2820b760a9c2ca2

                                      • \Users\Admin\AppData\Local\Temp\exe.exe

                                        Filesize

                                        310KB

                                        MD5

                                        0a59cbcabc60f52d931e34bcb2824a47

                                        SHA1

                                        1616283dae6e5b94db9d178c4d4781f8faa184f9

                                        SHA256

                                        641915b9fb3916cf59793f98822506595e085b4b9be0c4a63699c976b9b0bf0a

                                        SHA512

                                        fce4e5a1dd20201bd3a00a0fab0ad1d5f6a537907b90bd7539027e327a5b21e2e82cadd692c3773f9f04310d99649b2e4a3a5f889cc2c796d2820b760a9c2ca2

                                      • \Users\Admin\AppData\Local\Temp\exe.exe

                                        Filesize

                                        310KB

                                        MD5

                                        0a59cbcabc60f52d931e34bcb2824a47

                                        SHA1

                                        1616283dae6e5b94db9d178c4d4781f8faa184f9

                                        SHA256

                                        641915b9fb3916cf59793f98822506595e085b4b9be0c4a63699c976b9b0bf0a

                                        SHA512

                                        fce4e5a1dd20201bd3a00a0fab0ad1d5f6a537907b90bd7539027e327a5b21e2e82cadd692c3773f9f04310d99649b2e4a3a5f889cc2c796d2820b760a9c2ca2

                                      • \Users\Admin\AppData\Local\Temp\nsy1FA3.tmp\System.dll

                                        Filesize

                                        11KB

                                        MD5

                                        3f176d1ee13b0d7d6bd92e1c7a0b9bae

                                        SHA1

                                        fe582246792774c2c9dd15639ffa0aca90d6fd0b

                                        SHA256

                                        fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

                                        SHA512

                                        0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

                                      • memory/320-81-0x0000000000000000-mapping.dmp

                                      • memory/516-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/516-54-0x0000000072981000-0x0000000072984000-memory.dmp

                                        Filesize

                                        12KB

                                      • memory/516-58-0x00000000713ED000-0x00000000713F8000-memory.dmp

                                        Filesize

                                        44KB

                                      • memory/516-55-0x0000000070401000-0x0000000070403000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/516-74-0x00000000713ED000-0x00000000713F8000-memory.dmp

                                        Filesize

                                        44KB

                                      • memory/516-57-0x0000000076031000-0x0000000076033000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/560-107-0x00000000004B0000-0x0000000000567000-memory.dmp

                                        Filesize

                                        732KB

                                      • memory/560-103-0x0000000000000000-mapping.dmp

                                      • memory/560-105-0x0000000074C81000-0x0000000074C83000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/560-106-0x00000000777F0000-0x0000000077970000-memory.dmp

                                        Filesize

                                        1.5MB

                                      • memory/560-111-0x00000000004B0000-0x0000000000567000-memory.dmp

                                        Filesize

                                        732KB

                                      • memory/560-108-0x0000000000620000-0x000000000062C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/560-110-0x00000000777F0000-0x0000000077970000-memory.dmp

                                        Filesize

                                        1.5MB

                                      • memory/564-79-0x0000000000000000-mapping.dmp

                                      • memory/776-76-0x0000000000000000-mapping.dmp

                                      • memory/860-75-0x0000000000000000-mapping.dmp

                                      • memory/884-83-0x0000000000000000-mapping.dmp

                                      • memory/980-64-0x0000000000000000-mapping.dmp

                                      • memory/1012-86-0x0000000000000000-mapping.dmp

                                      • memory/1256-80-0x0000000000000000-mapping.dmp

                                      • memory/1268-112-0x0000000002980000-0x0000000002986000-memory.dmp

                                        Filesize

                                        24KB

                                      • memory/1364-78-0x0000000000000000-mapping.dmp

                                      • memory/1428-85-0x0000000000000000-mapping.dmp

                                      • memory/1472-63-0x0000000000000000-mapping.dmp

                                      • memory/1540-82-0x0000000000000000-mapping.dmp

                                      • memory/1580-89-0x0000000000000000-mapping.dmp

                                      • memory/1604-90-0x0000000000000000-mapping.dmp

                                      • memory/1620-87-0x0000000000000000-mapping.dmp

                                      • memory/1676-88-0x00000000021F0000-0x0000000002E3A000-memory.dmp

                                        Filesize

                                        12.3MB

                                      • memory/1676-69-0x0000000000000000-mapping.dmp

                                      • memory/1676-91-0x00000000021F0000-0x0000000002E3A000-memory.dmp

                                        Filesize

                                        12.3MB

                                      • memory/1696-66-0x0000000000000000-mapping.dmp

                                      • memory/1808-84-0x0000000000000000-mapping.dmp

                                      • memory/1868-72-0x0000000000000000-mapping.dmp

                                      • memory/1880-77-0x0000000000000000-mapping.dmp

                                      • memory/1900-61-0x0000000000000000-mapping.dmp

                                      • memory/1996-96-0x0000000000400000-0x0000000000435000-memory.dmp

                                        Filesize

                                        212KB

                                      • memory/1996-97-0x0000000001CC0000-0x0000000001D26000-memory.dmp

                                        Filesize

                                        408KB

                                      • memory/1996-98-0x0000000000400000-0x0000000000435000-memory.dmp

                                        Filesize

                                        212KB

                                      • memory/1996-102-0x0000000000650000-0x000000000065C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/1996-93-0x00000000004015C6-mapping.dmp

                                      • memory/1996-109-0x0000000001CC0000-0x0000000001D26000-memory.dmp

                                        Filesize

                                        408KB

                                      • memory/1996-100-0x0000000001CC0000-0x0000000001D26000-memory.dmp

                                        Filesize

                                        408KB

                                      • memory/1996-99-0x00000000001E0000-0x00000000001ED000-memory.dmp

                                        Filesize

                                        52KB

                                      • memory/2012-59-0x0000000000000000-mapping.dmp