Analysis
-
max time kernel
1128s -
max time network
951s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
-
submitted
26-07-2022 12:00
General
-
Target
d3efe55f0512a66b1412ee005a014e8d80e805d4d751af3e10e86957d522df7f.docm
-
Size
3.4MB
-
MD5
64d38fd28c797ecb7d46a1c3835171f7
-
SHA1
574b7cc63def84abd64d6bbe6db782b07d0513f6
-
SHA256
d3efe55f0512a66b1412ee005a014e8d80e805d4d751af3e10e86957d522df7f
-
SHA512
05049ea252f6622dfc8eda387b777542fb28546f5a68d67333b86715c39ad64597f0056ac1e8fa2697c4385c4247b36b6bcc3e519af847eb2d7526fd566979e3
Malware Config
Signatures
-
Detects SVCReady loader 1 IoCs
-
SVCReady
SVCReady is a malware loader first seen in April 2022.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d3efe55f0512a66b1412ee005a014e8d80e805d4d751af3e10e86957d522df7f.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rD69F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\rD69F.tmp.exe" "C:\Users\Admin\AppData\Local\Temp\yD69E.tmp.dll",DllRegisterServer2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
Filesize
1.3MB
MD5a98caee91a4cabb50f33a618d9f428f3
SHA1f7b4262b784584064e9f7b0054c906a8a646bc52
SHA256ed11700e8eb238f94313fa05abbd10f2055c308111667e916b31b19776e4435f
SHA51270f1e9acbc4453ad4e240cf8851a10876dfab58595cbbfb2ec063903e52350d50c6db9b15e4e13b351a58fcdfd0e791accd620aafe5475669eb366795b6f0396
-
Filesize
1.3MB
MD5a98caee91a4cabb50f33a618d9f428f3
SHA1f7b4262b784584064e9f7b0054c906a8a646bc52
SHA256ed11700e8eb238f94313fa05abbd10f2055c308111667e916b31b19776e4435f
SHA51270f1e9acbc4453ad4e240cf8851a10876dfab58595cbbfb2ec063903e52350d50c6db9b15e4e13b351a58fcdfd0e791accd620aafe5475669eb366795b6f0396
-
Filesize
580KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
984KB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
984KB