Analysis

  • max time kernel
    97s
  • max time network
    61s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19-10-2022 18:24

General

  • Target

    challenge-files/challenge-files/docs 06.02.2021.docm

  • Size

    43KB

  • MD5

    f08771b9fdfe82caaa089641e2348c8e

  • SHA1

    b02c121597c9d56d7fab76b54834d5f3bd961e8c

  • SHA256

    cc721111b5924cfeb91440ecaccc60ecc30d10fffbdab262f7c0a17027f527d1

  • SHA512

    3bb2b582e7119c346473f78056f95e0890a3e74976de733739af9aaef810c4e62b35d7f81ec52acfbf675d3d501a048a36fa323ef76ee8843502424211b46ebd

  • SSDEEP

    768:u5WkgUEeFPIlj5oQ0fUDjxXSwU/+BtgKpyAAlQg6DPLFXS:plekVoQTCFmgKpslepC

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\challenge-files\challenge-files\docs 06.02.2021.docm"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:608
    • C:\Windows\SysWOW64\explorer.exe
      explorer collectionBoxConst.hta
      2⤵
      • Process spawned unexpected child process
      PID:1068
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1584
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1056
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\challenge-files\challenge-files\collectionBoxConst.hta"
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:904
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" c:\users\public\collectionBoxConst.jpg,PluginInit
          3⤵
            PID:940

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Defense Evasion

      Modify Registry

      1
      T1112

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\challenge-files\challenge-files\collectionBoxConst.hta
        Filesize

        3KB

        MD5

        99a1a4391c6be3ac5f137c0a092d8edd

        SHA1

        34afc663a569d0ba183c73ab40ae8d682273d193

        SHA256

        b25865183c5cd2c5e550aca8476e592b62ed3e37e6b628f955bbed454fdbb100

        SHA512

        45e5b38d72add4d28234b539071a3cb4059c9c104b5389a43190fd3197843e103fdaf7552c1edcb9bbbabe15b122a8bef0389ce39d6130b438a835c4c2d4f345

      • memory/608-58-0x0000000070CED000-0x0000000070CF8000-memory.dmp
        Filesize

        44KB

      • memory/608-57-0x0000000075811000-0x0000000075813000-memory.dmp
        Filesize

        8KB

      • memory/608-54-0x0000000072281000-0x0000000072284000-memory.dmp
        Filesize

        12KB

      • memory/608-60-0x000000000070D000-0x0000000000711000-memory.dmp
        Filesize

        16KB

      • memory/608-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

      • memory/608-61-0x000000000070D000-0x0000000000711000-memory.dmp
        Filesize

        16KB

      • memory/608-59-0x000000000070D000-0x0000000000711000-memory.dmp
        Filesize

        16KB

      • memory/608-71-0x0000000070CED000-0x0000000070CF8000-memory.dmp
        Filesize

        44KB

      • memory/608-62-0x000000000070D000-0x0000000000711000-memory.dmp
        Filesize

        16KB

      • memory/608-55-0x000000006FD01000-0x000000006FD03000-memory.dmp
        Filesize

        8KB

      • memory/904-68-0x0000000000000000-mapping.dmp
      • memory/940-72-0x0000000000000000-mapping.dmp
      • memory/1056-66-0x000007FEFB931000-0x000007FEFB933000-memory.dmp
        Filesize

        8KB

      • memory/1068-65-0x000000006AE21000-0x000000006AE23000-memory.dmp
        Filesize

        8KB

      • memory/1068-63-0x0000000000000000-mapping.dmp
      • memory/1584-69-0x0000000000000000-mapping.dmp