Resubmissions

16-08-2022 05:07

220816-fr7j1afce7 4

15-08-2022 15:36

220815-s1x35scecn 10

Analysis

  • max time kernel
    1148s
  • max time network
    900s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    16-08-2022 05:07

General

  • Target

    tagdesign,file,15.08.docm

  • Size

    3.2MB

  • MD5

    91b066f33f508ab4d3ba9bada41b0f55

  • SHA1

    000c8f4decf6cf18db53211420a7636bbbea6d5f

  • SHA256

    d98270a5b134ece0839044be9d7779e43a1ba45a446a477106c2ab1261b3c04d

  • SHA512

    f7c9d975124cf8b9326b6ef8e9bbe0b68dee4db1bb21fc4da40df4786adadadd4edc471ccccba1cb250deb66748ab2cb997701bc00a4fa48167f09f0f49f636f

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\tagdesign,file,15.08.docm"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1904

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1904-596-0x0000000000000000-mapping.dmp

    • memory/1972-54-0x0000000072431000-0x0000000072434000-memory.dmp

      Filesize

      12KB

    • memory/1972-55-0x000000006FEB1000-0x000000006FEB3000-memory.dmp

      Filesize

      8KB

    • memory/1972-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1972-57-0x00000000761A1000-0x00000000761A3000-memory.dmp

      Filesize

      8KB

    • memory/1972-58-0x0000000070E9D000-0x0000000070EA8000-memory.dmp

      Filesize

      44KB

    • memory/1972-59-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-60-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-62-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-61-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-63-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-64-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-66-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-65-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-67-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-69-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-68-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-70-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-71-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-72-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-73-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-75-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-74-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-76-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-77-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-79-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-78-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-80-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-81-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-82-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-83-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-84-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-85-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-86-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-87-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-88-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-90-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-89-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-91-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-92-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-93-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-94-0x00000000007CB000-0x00000000007CF000-memory.dmp

      Filesize

      16KB

    • memory/1972-95-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-96-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-97-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-98-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-99-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-100-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-101-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-102-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-104-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-103-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-105-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-106-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-107-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-109-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-108-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-110-0x00000000007F9000-0x0000000000860000-memory.dmp

      Filesize

      412KB

    • memory/1972-567-0x000000000083B000-0x000000000083D000-memory.dmp

      Filesize

      8KB

    • memory/1972-592-0x000000000083B000-0x000000000083D000-memory.dmp

      Filesize

      8KB

    • memory/1972-593-0x0000000005B80000-0x0000000005CE0000-memory.dmp

      Filesize

      1.4MB

    • memory/1972-594-0x0000000005CE0000-0x0000000005D93000-memory.dmp

      Filesize

      716KB

    • memory/1972-595-0x0000000070E9D000-0x0000000070EA8000-memory.dmp

      Filesize

      44KB

    • memory/1972-598-0x000000000083B000-0x000000000083D000-memory.dmp

      Filesize

      8KB

    • memory/1972-599-0x0000000005B80000-0x0000000005CE0000-memory.dmp

      Filesize

      1.4MB

    • memory/1972-600-0x0000000005CE0000-0x0000000005D93000-memory.dmp

      Filesize

      716KB