Analysis

  • max time kernel
    145s
  • max time network
    166s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03-10-2022 02:01

General

  • Target

    682e7f4053a133c8fe08dfede3962d5af96f01dff69a72ac0b0f0ba8afc57191.rtf

  • Size

    1.2MB

  • MD5

    6e752a28a3d4f61fb158099beab88f90

  • SHA1

    d8c18216e718401d37a81674d4f4bb95f16742c6

  • SHA256

    682e7f4053a133c8fe08dfede3962d5af96f01dff69a72ac0b0f0ba8afc57191

  • SHA512

    66bad4bab339a255cded95b6a03df4c149c486deceb23c3fd55080b16d48251bc7ad4db5e5e74c95ad46deebbdbb70fa05ee6fa26ae01e56fa9a89d9ad32e1eb

  • SSDEEP

    24576:ko+0Kiy8TOWMRIHjVK+v8GhCXjyx5VqJKnMbYbor+CzzGxp:x

Malware Config

Signatures

  • NetWire RAT payload 3 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\682e7f4053a133c8fe08dfede3962d5af96f01dff69a72ac0b0f0ba8afc57191.rtf"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1312
    • C:\Users\Admin\AppData\Local\Microsoft\Windows\spoolsv.exe
      C:\Users\Admin\AppData\Local\Temp\..\Microsoft\Windows\spoolsv.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:660
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\spoolsv.exe
        C:\Users\Admin\AppData\Local\Microsoft\Windows\spoolsv.exe
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1396
        • C:\Users\Admin\AppData\Roaming\Install\svchost.exe
          "C:\Users\Admin\AppData\Roaming\Install\svchost.exe" -m C:\Users\Admin\AppData\Local\Microsoft\Windows\spoolsv.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1100
          • C:\Users\Admin\AppData\Roaming\Install\svchost.exe
            C:\Users\Admin\AppData\Roaming\Install\svchost.exe
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            PID:1264

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\spoolsv.exe

      Filesize

      376KB

      MD5

      cf826a47f5f402a2b37884ee0a99a7d4

      SHA1

      ece848503b24f6c365044a406b917f8e87131445

      SHA256

      3f115ff4f7372b1371bcc4bf1f6d167a6755a4610165b8c4eefce110c7df66c3

      SHA512

      9974d53496124d3e1a709147612263e9555c40f5aee1809d08beba2fdfd2bfdd0f8336c4b829e0fb170edcb8dbd0321c2c86d94272c947f072cc87d07d77d2f0

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\spoolsv.exe

      Filesize

      376KB

      MD5

      cf826a47f5f402a2b37884ee0a99a7d4

      SHA1

      ece848503b24f6c365044a406b917f8e87131445

      SHA256

      3f115ff4f7372b1371bcc4bf1f6d167a6755a4610165b8c4eefce110c7df66c3

      SHA512

      9974d53496124d3e1a709147612263e9555c40f5aee1809d08beba2fdfd2bfdd0f8336c4b829e0fb170edcb8dbd0321c2c86d94272c947f072cc87d07d77d2f0

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\spoolsv.exe

      Filesize

      376KB

      MD5

      cf826a47f5f402a2b37884ee0a99a7d4

      SHA1

      ece848503b24f6c365044a406b917f8e87131445

      SHA256

      3f115ff4f7372b1371bcc4bf1f6d167a6755a4610165b8c4eefce110c7df66c3

      SHA512

      9974d53496124d3e1a709147612263e9555c40f5aee1809d08beba2fdfd2bfdd0f8336c4b829e0fb170edcb8dbd0321c2c86d94272c947f072cc87d07d77d2f0

    • C:\Users\Admin\AppData\Roaming\Install\svchost.exe

      Filesize

      376KB

      MD5

      cf826a47f5f402a2b37884ee0a99a7d4

      SHA1

      ece848503b24f6c365044a406b917f8e87131445

      SHA256

      3f115ff4f7372b1371bcc4bf1f6d167a6755a4610165b8c4eefce110c7df66c3

      SHA512

      9974d53496124d3e1a709147612263e9555c40f5aee1809d08beba2fdfd2bfdd0f8336c4b829e0fb170edcb8dbd0321c2c86d94272c947f072cc87d07d77d2f0

    • C:\Users\Admin\AppData\Roaming\Install\svchost.exe

      Filesize

      376KB

      MD5

      cf826a47f5f402a2b37884ee0a99a7d4

      SHA1

      ece848503b24f6c365044a406b917f8e87131445

      SHA256

      3f115ff4f7372b1371bcc4bf1f6d167a6755a4610165b8c4eefce110c7df66c3

      SHA512

      9974d53496124d3e1a709147612263e9555c40f5aee1809d08beba2fdfd2bfdd0f8336c4b829e0fb170edcb8dbd0321c2c86d94272c947f072cc87d07d77d2f0

    • C:\Users\Admin\AppData\Roaming\Install\svchost.exe

      Filesize

      376KB

      MD5

      cf826a47f5f402a2b37884ee0a99a7d4

      SHA1

      ece848503b24f6c365044a406b917f8e87131445

      SHA256

      3f115ff4f7372b1371bcc4bf1f6d167a6755a4610165b8c4eefce110c7df66c3

      SHA512

      9974d53496124d3e1a709147612263e9555c40f5aee1809d08beba2fdfd2bfdd0f8336c4b829e0fb170edcb8dbd0321c2c86d94272c947f072cc87d07d77d2f0

    • \Users\Admin\AppData\Local\Microsoft\Windows\spoolsv.exe

      Filesize

      376KB

      MD5

      cf826a47f5f402a2b37884ee0a99a7d4

      SHA1

      ece848503b24f6c365044a406b917f8e87131445

      SHA256

      3f115ff4f7372b1371bcc4bf1f6d167a6755a4610165b8c4eefce110c7df66c3

      SHA512

      9974d53496124d3e1a709147612263e9555c40f5aee1809d08beba2fdfd2bfdd0f8336c4b829e0fb170edcb8dbd0321c2c86d94272c947f072cc87d07d77d2f0

    • \Users\Admin\AppData\Roaming\Install\svchost.exe

      Filesize

      376KB

      MD5

      cf826a47f5f402a2b37884ee0a99a7d4

      SHA1

      ece848503b24f6c365044a406b917f8e87131445

      SHA256

      3f115ff4f7372b1371bcc4bf1f6d167a6755a4610165b8c4eefce110c7df66c3

      SHA512

      9974d53496124d3e1a709147612263e9555c40f5aee1809d08beba2fdfd2bfdd0f8336c4b829e0fb170edcb8dbd0321c2c86d94272c947f072cc87d07d77d2f0

    • \Users\Admin\AppData\Roaming\Install\svchost.exe

      Filesize

      376KB

      MD5

      cf826a47f5f402a2b37884ee0a99a7d4

      SHA1

      ece848503b24f6c365044a406b917f8e87131445

      SHA256

      3f115ff4f7372b1371bcc4bf1f6d167a6755a4610165b8c4eefce110c7df66c3

      SHA512

      9974d53496124d3e1a709147612263e9555c40f5aee1809d08beba2fdfd2bfdd0f8336c4b829e0fb170edcb8dbd0321c2c86d94272c947f072cc87d07d77d2f0

    • memory/660-77-0x0000000000250000-0x0000000000254000-memory.dmp

      Filesize

      16KB

    • memory/1264-107-0x0000000000400000-0x00000000004D6000-memory.dmp

      Filesize

      856KB

    • memory/1264-105-0x0000000000400000-0x00000000004D6000-memory.dmp

      Filesize

      856KB

    • memory/1264-108-0x0000000000400000-0x00000000004D6000-memory.dmp

      Filesize

      856KB

    • memory/1264-109-0x0000000000220000-0x0000000000224000-memory.dmp

      Filesize

      16KB

    • memory/1264-104-0x0000000000400000-0x00000000004D6000-memory.dmp

      Filesize

      856KB

    • memory/1312-61-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

      Filesize

      8KB

    • memory/1396-76-0x0000000000400000-0x00000000004D6000-memory.dmp

      Filesize

      856KB

    • memory/1396-70-0x0000000000400000-0x00000000004D6000-memory.dmp

      Filesize

      856KB

    • memory/1396-82-0x0000000000400000-0x00000000004D6000-memory.dmp

      Filesize

      856KB

    • memory/1396-83-0x0000000000400000-0x00000000004D6000-memory.dmp

      Filesize

      856KB

    • memory/1396-84-0x0000000000400000-0x0000000000401000-memory.dmp

      Filesize

      4KB

    • memory/1396-74-0x0000000000400000-0x00000000004D6000-memory.dmp

      Filesize

      856KB

    • memory/1396-72-0x0000000000400000-0x00000000004D6000-memory.dmp

      Filesize

      856KB

    • memory/1396-69-0x0000000000400000-0x00000000004D6000-memory.dmp

      Filesize

      856KB

    • memory/1396-90-0x0000000000400000-0x00000000004D6000-memory.dmp

      Filesize

      856KB

    • memory/1988-54-0x0000000072231000-0x0000000072234000-memory.dmp

      Filesize

      12KB

    • memory/1988-65-0x000000000C060000-0x000000000C160000-memory.dmp

      Filesize

      1024KB

    • memory/1988-64-0x000000000AAF0000-0x000000000AB00000-memory.dmp

      Filesize

      64KB

    • memory/1988-63-0x0000000070C9D000-0x0000000070CA8000-memory.dmp

      Filesize

      44KB

    • memory/1988-59-0x0000000070C9D000-0x0000000070CA8000-memory.dmp

      Filesize

      44KB

    • memory/1988-58-0x0000000070C9D000-0x0000000070CA8000-memory.dmp

      Filesize

      44KB

    • memory/1988-57-0x0000000075281000-0x0000000075283000-memory.dmp

      Filesize

      8KB

    • memory/1988-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1988-55-0x000000006FCB1000-0x000000006FCB3000-memory.dmp

      Filesize

      8KB