Analysis

  • max time kernel
    199s
  • max time network
    190s
  • platform
    windows7_x64
  • resource
    win7-20220718-en
  • resource tags

    arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
  • submitted
    31-07-2022 05:01

General

  • Target

    328b29b940554b497693b7dc4b1f74dc58dceb0619a33ed4aeeafa09b95af290.rtf

  • Size

    734KB

  • MD5

    6d36c15327846d69d6c0687a6275613e

  • SHA1

    a4be38a5f4c266c132d7cf132d6064036b2fc6aa

  • SHA256

    328b29b940554b497693b7dc4b1f74dc58dceb0619a33ed4aeeafa09b95af290

  • SHA512

    901fdffb78e418a8a58c23cbe0fe6aef833edcdedc1c3b0b02c48762ee9fa1dc2466d908930b03ab37c346bedf76f99c6876fa67c49a4f90a1d5cfaa31f64a70

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 4 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 8 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • NTFS ADS 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1280
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\328b29b940554b497693b7dc4b1f74dc58dceb0619a33ed4aeeafa09b95af290.rtf"
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:1172
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1184
      • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
        "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
        1⤵
        • Launches Equation Editor
        • Suspicious use of WriteProcessMemory
        PID:844
        • C:\Windows\SysWOW64\cMd.exe
          cMd /k %tEmP%\dqfm.cmd ? aaaa c
          2⤵
          • NTFS ADS
          • Suspicious use of WriteProcessMemory
          PID:1304
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\hondi.cmD
            3⤵
            • Loads dropped DLL
            • NTFS ADS
            • Suspicious use of WriteProcessMemory
            PID:332
            • C:\Windows\SysWOW64\timeout.exe
              TIMEOUT 1
              4⤵
              • Delays execution with timeout.exe
              PID:1888
            • C:\Users\Admin\AppData\Local\Temp\mondi.exe
              C:\Users\Admin\AppData\Local\Temp\mondi.eXe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              PID:1108
              • C:\Users\Admin\AppData\Local\Temp\mondi.eXe
                C:\Users\Admin\AppData\Local\Temp\mondi.eXe
                5⤵
                • Executes dropped EXE
                • Sets file execution options in registry
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Checks processor information in registry
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                PID:980
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  6⤵
                  • Modifies firewall policy service
                  • Sets file execution options in registry
                  • Checks BIOS information in registry
                  • Adds Run key to start application
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Modifies Internet Explorer Protected Mode
                  • Modifies Internet Explorer Protected Mode Banner
                  • Modifies Internet Explorer settings
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1476
            • C:\Windows\SysWOW64\taskkill.exe
              TASkKILL /F /IM winword.exe
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1224
            • C:\Windows\SysWOW64\reg.exe
              reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\Resiliency /f
              4⤵
                PID:1964
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1956
                • C:\Windows\SysWOW64\reg.exe
                  REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"
                  5⤵
                    PID:2016
                • C:\Windows\SysWOW64\reg.exe
                  reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\Resiliency /f
                  4⤵
                    PID:1060
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:540
                    • C:\Windows\SysWOW64\reg.exe
                      REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"
                      5⤵
                        PID:284
                    • C:\Windows\SysWOW64\reg.exe
                      reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\13.0\Word\Resiliency /f
                      4⤵
                        PID:772
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\13.0\Word\File MRU" /v "Item 1"
                        4⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1896
                        • C:\Windows\SysWOW64\reg.exe
                          REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\13.0\Word\File MRU" /v "Item 1"
                          5⤵
                            PID:1864
                        • C:\Windows\SysWOW64\reg.exe
                          reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\Resiliency /f
                          4⤵
                            PID:1424
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"
                            4⤵
                              PID:2020
                              • C:\Windows\SysWOW64\reg.exe
                                REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"
                                5⤵
                                  PID:1004
                              • C:\Windows\SysWOW64\reg.exe
                                reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\Resiliency /f
                                4⤵
                                  PID:1472
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"
                                  4⤵
                                    PID:576
                                    • C:\Windows\SysWOW64\reg.exe
                                      REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"
                                      5⤵
                                        PID:1976
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency /f
                                      4⤵
                                        PID:756
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"
                                        4⤵
                                          PID:1940
                                          • C:\Windows\SysWOW64\reg.exe
                                            REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"
                                            5⤵
                                              PID:1872
                                    • C:\Windows\system32\conhost.exe
                                      \??\C:\Windows\system32\conhost.exe "-1906132391-389951473-14306924981615920992-2112124796-992308298799363397-99359662"
                                      1⤵
                                        PID:1944

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Temp\dqfm.cmd

                                        Filesize

                                        186B

                                        MD5

                                        29324996d120283c617a7a142b5ba980

                                        SHA1

                                        43aa940b29713a6e75f30a6b614352c3bba24d6c

                                        SHA256

                                        2ab6f8f8b4f358a0f821de0710c3227dcbd1a3fa31172fda39ab44052a6cf021

                                        SHA512

                                        21c4d36887c72d01f9d2913c61e9d443169351a1c97b81a503712f0a224d50484100493dc971121ab71343b372440c0633fb062bb4930d1e6f53d455c9352b48

                                      • C:\Users\Admin\AppData\Local\Temp\gondi.doc:Zone.Identifier

                                        MD5

                                        d41d8cd98f00b204e9800998ecf8427e

                                        SHA1

                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                        SHA256

                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        SHA512

                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                      • C:\Users\Admin\AppData\Local\Temp\hondi.cmd:Zone.Identifier

                                        MD5

                                        d41d8cd98f00b204e9800998ecf8427e

                                        SHA1

                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                        SHA256

                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        SHA512

                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                      • C:\Users\Admin\AppData\Local\Temp\mondi.eXe:Zone.Identifier

                                        MD5

                                        d41d8cd98f00b204e9800998ecf8427e

                                        SHA1

                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                        SHA256

                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        SHA512

                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                      • C:\Users\Admin\AppData\Local\Temp\mondi.exe

                                        Filesize

                                        328KB

                                        MD5

                                        f807bc3379e9020ea229c1757c8bc257

                                        SHA1

                                        1749d613fe4159efcd3fdc3c4dfb621bd447be5e

                                        SHA256

                                        df48b77715079cb66cd32cd56cd59367ebabfa81210919cfcb45795e928b2198

                                        SHA512

                                        b2f8ef3024c7af57239b2e5f769a8d018fb284361aab333abc8277d87420cd4830bc20de2fb4913c0cd4bfe3660ba458c9b7656ce6d13a6e12fac5d1d84cc93c

                                      • C:\Users\Admin\AppData\Local\Temp\mondi.exe

                                        Filesize

                                        328KB

                                        MD5

                                        f807bc3379e9020ea229c1757c8bc257

                                        SHA1

                                        1749d613fe4159efcd3fdc3c4dfb621bd447be5e

                                        SHA256

                                        df48b77715079cb66cd32cd56cd59367ebabfa81210919cfcb45795e928b2198

                                        SHA512

                                        b2f8ef3024c7af57239b2e5f769a8d018fb284361aab333abc8277d87420cd4830bc20de2fb4913c0cd4bfe3660ba458c9b7656ce6d13a6e12fac5d1d84cc93c

                                      • \Users\Admin\AppData\Local\Temp\mondi.exe

                                        Filesize

                                        328KB

                                        MD5

                                        f807bc3379e9020ea229c1757c8bc257

                                        SHA1

                                        1749d613fe4159efcd3fdc3c4dfb621bd447be5e

                                        SHA256

                                        df48b77715079cb66cd32cd56cd59367ebabfa81210919cfcb45795e928b2198

                                        SHA512

                                        b2f8ef3024c7af57239b2e5f769a8d018fb284361aab333abc8277d87420cd4830bc20de2fb4913c0cd4bfe3660ba458c9b7656ce6d13a6e12fac5d1d84cc93c

                                      • \Users\Admin\AppData\Local\Temp\mondi.exe

                                        Filesize

                                        328KB

                                        MD5

                                        f807bc3379e9020ea229c1757c8bc257

                                        SHA1

                                        1749d613fe4159efcd3fdc3c4dfb621bd447be5e

                                        SHA256

                                        df48b77715079cb66cd32cd56cd59367ebabfa81210919cfcb45795e928b2198

                                        SHA512

                                        b2f8ef3024c7af57239b2e5f769a8d018fb284361aab333abc8277d87420cd4830bc20de2fb4913c0cd4bfe3660ba458c9b7656ce6d13a6e12fac5d1d84cc93c

                                      • \Users\Admin\AppData\Local\Temp\nsuA97B.tmp\System.dll

                                        Filesize

                                        11KB

                                        MD5

                                        b0c77267f13b2f87c084fd86ef51ccfc

                                        SHA1

                                        f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

                                        SHA256

                                        a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

                                        SHA512

                                        f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

                                      • \Users\Admin\AppData\Local\Temp\teasels.dll

                                        Filesize

                                        12KB

                                        MD5

                                        2bca48f9681de2a01180e3e3a4170238

                                        SHA1

                                        e097d8f8c9c51c777e7e1f720624ca9a0961b821

                                        SHA256

                                        5f2d209fb93640bf6c81cbddaa00d1c2e120228e7fa34161ad2786e3f0f8b1cb

                                        SHA512

                                        5860b0d09cb0393efb8ea11d34de4a78a24adcb779c516ff7657cf44e5c54fbaeb343c9d005275d5915733ac149981cdc2af2f7d3f5db5d51cbd953cae073165

                                      • memory/284-79-0x0000000000000000-mapping.dmp

                                      • memory/332-63-0x0000000000000000-mapping.dmp

                                      • memory/540-78-0x0000000000000000-mapping.dmp

                                      • memory/576-87-0x0000000000000000-mapping.dmp

                                      • memory/756-89-0x0000000000000000-mapping.dmp

                                      • memory/772-80-0x0000000000000000-mapping.dmp

                                      • memory/980-100-0x0000000000400000-0x0000000000435000-memory.dmp

                                        Filesize

                                        212KB

                                      • memory/980-110-0x0000000000440000-0x00000000004A6000-memory.dmp

                                        Filesize

                                        408KB

                                      • memory/980-116-0x0000000000440000-0x00000000004A6000-memory.dmp

                                        Filesize

                                        408KB

                                      • memory/980-112-0x0000000001FE0000-0x0000000001FEC000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/980-111-0x0000000000290000-0x000000000029D000-memory.dmp

                                        Filesize

                                        52KB

                                      • memory/980-109-0x0000000000400000-0x0000000000435000-memory.dmp

                                        Filesize

                                        212KB

                                      • memory/980-107-0x0000000000440000-0x00000000004A6000-memory.dmp

                                        Filesize

                                        408KB

                                      • memory/980-106-0x0000000000400000-0x0000000000435000-memory.dmp

                                        Filesize

                                        212KB

                                      • memory/980-104-0x0000000000400000-0x0000000000435000-memory.dmp

                                        Filesize

                                        212KB

                                      • memory/980-101-0x00000000004015C6-mapping.dmp

                                      • memory/980-98-0x0000000000400000-0x0000000000435000-memory.dmp

                                        Filesize

                                        212KB

                                      • memory/980-99-0x0000000000400000-0x0000000000435000-memory.dmp

                                        Filesize

                                        212KB

                                      • memory/980-97-0x0000000000400000-0x0000000000435000-memory.dmp

                                        Filesize

                                        212KB

                                      • memory/980-93-0x0000000000400000-0x0000000000435000-memory.dmp

                                        Filesize

                                        212KB

                                      • memory/980-94-0x0000000000400000-0x0000000000435000-memory.dmp

                                        Filesize

                                        212KB

                                      • memory/980-95-0x0000000000400000-0x0000000000435000-memory.dmp

                                        Filesize

                                        212KB

                                      • memory/1004-85-0x0000000000000000-mapping.dmp

                                      • memory/1060-77-0x0000000000000000-mapping.dmp

                                      • memory/1108-68-0x0000000000000000-mapping.dmp

                                      • memory/1172-55-0x0000000070841000-0x0000000070843000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1172-57-0x0000000075CB1000-0x0000000075CB3000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1172-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1172-58-0x000000007182D000-0x0000000071838000-memory.dmp

                                        Filesize

                                        44KB

                                      • memory/1172-54-0x0000000072DC1000-0x0000000072DC4000-memory.dmp

                                        Filesize

                                        12KB

                                      • memory/1224-71-0x0000000000000000-mapping.dmp

                                      • memory/1280-123-0x00000000022E0000-0x00000000022E6000-memory.dmp

                                        Filesize

                                        24KB

                                      • memory/1304-60-0x0000000000000000-mapping.dmp

                                      • memory/1424-83-0x0000000000000000-mapping.dmp

                                      • memory/1472-86-0x0000000000000000-mapping.dmp

                                      • memory/1476-119-0x00000000002A0000-0x00000000002AD000-memory.dmp

                                        Filesize

                                        52KB

                                      • memory/1476-115-0x0000000077B80000-0x0000000077D00000-memory.dmp

                                        Filesize

                                        1.5MB

                                      • memory/1476-122-0x0000000000090000-0x000000000014C000-memory.dmp

                                        Filesize

                                        752KB

                                      • memory/1476-121-0x0000000077B80000-0x0000000077D00000-memory.dmp

                                        Filesize

                                        1.5MB

                                      • memory/1476-120-0x0000000000390000-0x000000000039C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/1476-118-0x0000000000090000-0x000000000014C000-memory.dmp

                                        Filesize

                                        752KB

                                      • memory/1476-117-0x0000000075111000-0x0000000075113000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1476-113-0x0000000000000000-mapping.dmp

                                      • memory/1864-82-0x0000000000000000-mapping.dmp

                                      • memory/1872-91-0x0000000000000000-mapping.dmp

                                      • memory/1888-64-0x0000000000000000-mapping.dmp

                                      • memory/1896-81-0x0000000000000000-mapping.dmp

                                      • memory/1940-90-0x0000000000000000-mapping.dmp

                                      • memory/1956-75-0x0000000000000000-mapping.dmp

                                      • memory/1964-74-0x0000000000000000-mapping.dmp

                                      • memory/1976-88-0x0000000000000000-mapping.dmp

                                      • memory/2016-76-0x0000000000000000-mapping.dmp

                                      • memory/2020-84-0x0000000000000000-mapping.dmp