Analysis

  • max time kernel
    112s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    26-07-2022 15:29

General

  • Target

    alhena-doc-26.07.2022.docm

  • Size

    3.4MB

  • MD5

    02e8dc5942c0297296002e768920f664

  • SHA1

    712158ab3e3dd213d47a59d4ace3e9253af9d576

  • SHA256

    02521909209f8e6aaebccdb1b5e18bd6ac1801bb648899effccf8caabe0475ca

  • SHA512

    69fc6b1d45648b1cd88a541a27574c70a365803471063c6125d29ebc49d09efbd2888cc6bf87fcc5a4daec2f66b90b427e584d60a52d8fa957dd6e9a04e439e1

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\alhena-doc-26.07.2022.docm"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:844
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1804
      • C:\Users\Admin\AppData\Local\Temp\rCE4A.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\rCE4A.tmp.exe" "C:\Users\Admin\AppData\Local\Temp\yCE39.tmp.dll",DllRegisterServer
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:740

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\rCE4A.tmp.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • C:\Users\Admin\AppData\Local\Temp\rCE4A.tmp.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • C:\Users\Admin\AppData\Local\Temp\yCE39.tmp.dll

      Filesize

      1.3MB

      MD5

      783b72341561f3b469d0852b9ada0a32

      SHA1

      aa89e2d78a8f76d2c4b7abff09626d005a350cba

      SHA256

      7dd3bb874a6d2beba2edfe5aa64b8b971a89648ba4d499a9db360d7c408c8e3e

      SHA512

      604757dc21a10db699dd0d83dd7936d4b25d52ea729c8cd280fe362fdeccd55bed4acc53d23b21f9559b35efe3ce7f692a3919ff389de5c6333ac9e253d5df2f

    • \Users\Admin\AppData\Local\Temp\rCE4A.tmp.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • \Users\Admin\AppData\Local\Temp\yCE39.tmp.dll

      Filesize

      1.3MB

      MD5

      783b72341561f3b469d0852b9ada0a32

      SHA1

      aa89e2d78a8f76d2c4b7abff09626d005a350cba

      SHA256

      7dd3bb874a6d2beba2edfe5aa64b8b971a89648ba4d499a9db360d7c408c8e3e

      SHA512

      604757dc21a10db699dd0d83dd7936d4b25d52ea729c8cd280fe362fdeccd55bed4acc53d23b21f9559b35efe3ce7f692a3919ff389de5c6333ac9e253d5df2f

    • \Users\Admin\AppData\Local\Temp\yCE39.tmp.dll

      Filesize

      1.3MB

      MD5

      783b72341561f3b469d0852b9ada0a32

      SHA1

      aa89e2d78a8f76d2c4b7abff09626d005a350cba

      SHA256

      7dd3bb874a6d2beba2edfe5aa64b8b971a89648ba4d499a9db360d7c408c8e3e

      SHA512

      604757dc21a10db699dd0d83dd7936d4b25d52ea729c8cd280fe362fdeccd55bed4acc53d23b21f9559b35efe3ce7f692a3919ff389de5c6333ac9e253d5df2f

    • \Users\Admin\AppData\Local\Temp\yCE39.tmp.dll

      Filesize

      1.3MB

      MD5

      783b72341561f3b469d0852b9ada0a32

      SHA1

      aa89e2d78a8f76d2c4b7abff09626d005a350cba

      SHA256

      7dd3bb874a6d2beba2edfe5aa64b8b971a89648ba4d499a9db360d7c408c8e3e

      SHA512

      604757dc21a10db699dd0d83dd7936d4b25d52ea729c8cd280fe362fdeccd55bed4acc53d23b21f9559b35efe3ce7f692a3919ff389de5c6333ac9e253d5df2f

    • \Users\Admin\AppData\Local\Temp\yCE39.tmp.dll

      Filesize

      1.3MB

      MD5

      783b72341561f3b469d0852b9ada0a32

      SHA1

      aa89e2d78a8f76d2c4b7abff09626d005a350cba

      SHA256

      7dd3bb874a6d2beba2edfe5aa64b8b971a89648ba4d499a9db360d7c408c8e3e

      SHA512

      604757dc21a10db699dd0d83dd7936d4b25d52ea729c8cd280fe362fdeccd55bed4acc53d23b21f9559b35efe3ce7f692a3919ff389de5c6333ac9e253d5df2f

    • memory/844-96-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-90-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-61-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-63-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-62-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-64-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-67-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-68-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-66-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-65-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-71-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-72-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-70-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-69-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-73-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-101-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-75-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-76-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-77-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-78-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-79-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-80-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-81-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-82-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-84-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-83-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-85-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-86-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-87-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-88-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-89-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-91-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-99-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-92-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-95-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-59-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-94-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-93-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-100-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-98-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-97-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-60-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-74-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-103-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-104-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-102-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-105-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-107-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-106-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-108-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-109-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-110-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-112-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-111-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-113-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-114-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-115-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-117-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-116-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-118-0x0000000000413000-0x0000000000477000-memory.dmp

      Filesize

      400KB

    • memory/844-432-0x0000000000471000-0x0000000000473000-memory.dmp

      Filesize

      8KB

    • memory/844-437-0x0000000000471000-0x0000000000473000-memory.dmp

      Filesize

      8KB

    • memory/844-441-0x0000000000471000-0x0000000000473000-memory.dmp

      Filesize

      8KB

    • memory/844-439-0x0000000000471000-0x0000000000473000-memory.dmp

      Filesize

      8KB

    • memory/844-435-0x0000000000471000-0x0000000000473000-memory.dmp

      Filesize

      8KB

    • memory/844-58-0x0000000070E8D000-0x0000000070E98000-memory.dmp

      Filesize

      44KB

    • memory/844-57-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

      Filesize

      8KB

    • memory/844-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/844-55-0x000000006FEA1000-0x000000006FEA3000-memory.dmp

      Filesize

      8KB

    • memory/844-54-0x0000000072421000-0x0000000072424000-memory.dmp

      Filesize

      12KB

    • memory/844-734-0x0000000000471000-0x0000000000473000-memory.dmp

      Filesize

      8KB

    • memory/844-822-0x0000000000471000-0x0000000000473000-memory.dmp

      Filesize

      8KB

    • memory/844-882-0x0000000000471000-0x0000000000473000-memory.dmp

      Filesize

      8KB

    • memory/844-884-0x0000000070E8D000-0x0000000070E98000-memory.dmp

      Filesize

      44KB

    • memory/844-894-0x0000000005AE0000-0x0000000005C40000-memory.dmp

      Filesize

      1.4MB

    • memory/844-895-0x0000000002420000-0x00000000024D3000-memory.dmp

      Filesize

      716KB

    • memory/844-896-0x0000000007F40000-0x0000000008085000-memory.dmp

      Filesize

      1.3MB

    • memory/844-902-0x0000000000471000-0x0000000000473000-memory.dmp

      Filesize

      8KB

    • memory/844-903-0x0000000002420000-0x00000000024D3000-memory.dmp

      Filesize

      716KB

    • memory/844-905-0x0000000070E8D000-0x0000000070E98000-memory.dmp

      Filesize

      44KB