Analysis
-
max time kernel
139s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2022 18:17
Behavioral task
behavioral1
Sample
musonic-document-09.26.2022.docm
Resource
win7-20220812-en
General
-
Target
musonic-document-09.26.2022.docm
-
Size
865KB
-
MD5
b055b549a81ce1c75ddd7351354ffa0e
-
SHA1
5f26efbe932c7abf2e5e475fe52ab6f1ec64437e
-
SHA256
7778ec0e63f82e94f18b343c2ebe1950b6057a1dc3067c1aeedc0ed6cbe69355
-
SHA512
f81a29a9a18a0c8dbdb388b53bd0768591f27843f83038454c8af80747b9ba60d3df700b34f0536698377c6e804db5afcd0cea63d0bd3b73469b97a01fd4567e
-
SSDEEP
12288:wZCVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEevh9d/+C6z5Yb1nsmbvDq:wZCV2jUeQRI5wPN/H8X5SsmYi2
Malware Config
Extracted
icedid
742081363
scainznorka.com
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3520 4112 rundll32.exe WINWORD.EXE -
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 32 3520 rundll32.exe 55 3520 rundll32.exe 57 3520 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3520 rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4112 WINWORD.EXE 4112 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3520 rundll32.exe 3520 rundll32.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4112 WINWORD.EXE 4112 WINWORD.EXE 4112 WINWORD.EXE 4112 WINWORD.EXE 4112 WINWORD.EXE 4112 WINWORD.EXE 4112 WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 4112 wrote to memory of 3520 4112 WINWORD.EXE rundll32.exe PID 4112 wrote to memory of 3520 4112 WINWORD.EXE rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\musonic-document-09.26.2022.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SYSTEM32\rundll32.exerundll32 C:\ProgramData\240n1661.191,PluginInit2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3520
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\240n1661.191Filesize
532KB
MD57347fba59175234c43e13c6330b4db84
SHA1b57d3f94b4b5d835ac545a80a985ff899bc55b52
SHA256dc3d82260163e69461849617672c743b2d2b220477d0f18b5b96aa220e470766
SHA51268e283b25b4df6082bbb4419f11eb24a5fffe3a9bd0df4d735aa438c1c9c596121b9b99da70244bca3ef565980b4826b14f9469751950d4a8cae4cf7cda5a8f6
-
C:\ProgramData\240n1661.191Filesize
532KB
MD57347fba59175234c43e13c6330b4db84
SHA1b57d3f94b4b5d835ac545a80a985ff899bc55b52
SHA256dc3d82260163e69461849617672c743b2d2b220477d0f18b5b96aa220e470766
SHA51268e283b25b4df6082bbb4419f11eb24a5fffe3a9bd0df4d735aa438c1c9c596121b9b99da70244bca3ef565980b4826b14f9469751950d4a8cae4cf7cda5a8f6
-
memory/3520-144-0x0000000180000000-0x0000000180009000-memory.dmpFilesize
36KB
-
memory/3520-140-0x0000000000000000-mapping.dmp
-
memory/3520-150-0x000001CB68990000-0x000001CB68996000-memory.dmpFilesize
24KB
-
memory/4112-134-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/4112-138-0x00007FFFBAAF0000-0x00007FFFBAB00000-memory.dmpFilesize
64KB
-
memory/4112-139-0x0000015DA51A3000-0x0000015DA51A5000-memory.dmpFilesize
8KB
-
memory/4112-137-0x00007FFFBAAF0000-0x00007FFFBAB00000-memory.dmpFilesize
64KB
-
memory/4112-135-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/4112-133-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/4112-143-0x0000015DA51A3000-0x0000015DA51A5000-memory.dmpFilesize
8KB
-
memory/4112-132-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/4112-136-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/4112-152-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/4112-153-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/4112-154-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/4112-155-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB