Analysis
-
max time kernel
151s -
max time network
74s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-10-2022 13:40
Static task
static1
Behavioral task
behavioral1
Sample
b9ca91d4651446f6cd6283af2acc1a14c73e9abc746323cd684b8f208fc42b8f.rtf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b9ca91d4651446f6cd6283af2acc1a14c73e9abc746323cd684b8f208fc42b8f.rtf
Resource
win10v2004-20220812-en
General
-
Target
b9ca91d4651446f6cd6283af2acc1a14c73e9abc746323cd684b8f208fc42b8f.rtf
-
Size
1.9MB
-
MD5
3f57988fa30c927eaec2cd3ea07e1345
-
SHA1
02ada56f35fcf701b5f93e4133caef910d51f6b7
-
SHA256
b9ca91d4651446f6cd6283af2acc1a14c73e9abc746323cd684b8f208fc42b8f
-
SHA512
686e91ee0db732d984b48a4d44fbe4a4d94022b80420f67a89bd560fd9ab6d1dbfebe0f930c7c5b3590aac8c8d90c548f5764fbe8beda2cead1fe2978a7db9d1
-
SSDEEP
24576:eFj/+UN64hNf4nQbaOFjA1hVaZFdIsfy+aOEDlh6Nt3W2cp+jpAHsqTxRTr9D2yb:X
Malware Config
Extracted
bandook
iamgood.blogdns.net
Signatures
-
Bandook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1560-70-0x0000000013149D07-mapping.dmp family_bandook behavioral1/memory/1560-69-0x0000000013140000-0x0000000013B94000-memory.dmp family_bandook behavioral1/memory/1560-74-0x0000000013140000-0x0000000013B94000-memory.dmp family_bandook behavioral1/memory/1560-75-0x0000000013140000-0x0000000013B94000-memory.dmp family_bandook behavioral1/memory/1560-76-0x0000000013140000-0x0000000013B94000-memory.dmp family_bandook -
Executes dropped EXE 2 IoCs
Processes:
~WRX0232D.tmp~WRX0232D.tmppid process 268 ~WRX0232D.tmp 1560 ~WRX0232D.tmp -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exeiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ebe = "C:\\Users\\Admin\\AppData\\Roaming\\ebe\\ebe.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ebe = "C:\\Users\\Admin\\AppData\\Roaming\\ebe\\ebe.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
~WRX0232D.tmpdescription pid process target process PID 268 set thread context of 1560 268 ~WRX0232D.tmp ~WRX0232D.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1672 WINWORD.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WINWORD.EXEpid process 1672 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1672 WINWORD.EXE 1672 WINWORD.EXE -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
WINWORD.EXE~WRX0232D.tmp~WRX0232D.tmpdescription pid process target process PID 1672 wrote to memory of 956 1672 WINWORD.EXE splwow64.exe PID 1672 wrote to memory of 956 1672 WINWORD.EXE splwow64.exe PID 1672 wrote to memory of 956 1672 WINWORD.EXE splwow64.exe PID 1672 wrote to memory of 956 1672 WINWORD.EXE splwow64.exe PID 268 wrote to memory of 1560 268 ~WRX0232D.tmp ~WRX0232D.tmp PID 268 wrote to memory of 1560 268 ~WRX0232D.tmp ~WRX0232D.tmp PID 268 wrote to memory of 1560 268 ~WRX0232D.tmp ~WRX0232D.tmp PID 268 wrote to memory of 1560 268 ~WRX0232D.tmp ~WRX0232D.tmp PID 268 wrote to memory of 1560 268 ~WRX0232D.tmp ~WRX0232D.tmp PID 268 wrote to memory of 1560 268 ~WRX0232D.tmp ~WRX0232D.tmp PID 1560 wrote to memory of 772 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 772 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 772 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 772 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 772 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 1416 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 1416 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 1416 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 1416 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 1416 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 1748 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 1748 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 1748 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 1748 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 1748 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 1036 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 1036 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 1036 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 1036 1560 ~WRX0232D.tmp iexplore.exe PID 1560 wrote to memory of 1036 1560 ~WRX0232D.tmp iexplore.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\b9ca91d4651446f6cd6283af2acc1a14c73e9abc746323cd684b8f208fc42b8f.rtf"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRX0232D.tmp"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRX0232D.tmp"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRX0232D.tmp"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRX0232D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRX0232D.tmpFilesize
803KB
MD5ef6211f8e06e188de46281d6827d73c2
SHA164442b66bbd7705f4d532324b4d5bf10236c306e
SHA256300500a5ca6cc96d6dcd4350fe353faccd3af631a383a2c47ef1e31e6e836c71
SHA512c9005a9d968b193f3a0e96dd6eaf8ef00dee27f36f4490a5348e23b3746ddff8e510c20431784b422db8d7b65884feacc94012c2bf2c43c8f8e2e116d533600a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRX0232D.tmpFilesize
803KB
MD5ef6211f8e06e188de46281d6827d73c2
SHA164442b66bbd7705f4d532324b4d5bf10236c306e
SHA256300500a5ca6cc96d6dcd4350fe353faccd3af631a383a2c47ef1e31e6e836c71
SHA512c9005a9d968b193f3a0e96dd6eaf8ef00dee27f36f4490a5348e23b3746ddff8e510c20431784b422db8d7b65884feacc94012c2bf2c43c8f8e2e116d533600a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRX0232D.tmpFilesize
803KB
MD5ef6211f8e06e188de46281d6827d73c2
SHA164442b66bbd7705f4d532324b4d5bf10236c306e
SHA256300500a5ca6cc96d6dcd4350fe353faccd3af631a383a2c47ef1e31e6e836c71
SHA512c9005a9d968b193f3a0e96dd6eaf8ef00dee27f36f4490a5348e23b3746ddff8e510c20431784b422db8d7b65884feacc94012c2bf2c43c8f8e2e116d533600a
-
C:\Users\Admin\AppData\Roaming\ebe\ebe.exeFilesize
803KB
MD5ef6211f8e06e188de46281d6827d73c2
SHA164442b66bbd7705f4d532324b4d5bf10236c306e
SHA256300500a5ca6cc96d6dcd4350fe353faccd3af631a383a2c47ef1e31e6e836c71
SHA512c9005a9d968b193f3a0e96dd6eaf8ef00dee27f36f4490a5348e23b3746ddff8e510c20431784b422db8d7b65884feacc94012c2bf2c43c8f8e2e116d533600a
-
memory/956-59-0x0000000000000000-mapping.dmp
-
memory/956-60-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmpFilesize
8KB
-
memory/1560-74-0x0000000013140000-0x0000000013B94000-memory.dmpFilesize
10.3MB
-
memory/1560-69-0x0000000013140000-0x0000000013B94000-memory.dmpFilesize
10.3MB
-
memory/1560-76-0x0000000013140000-0x0000000013B94000-memory.dmpFilesize
10.3MB
-
memory/1560-75-0x0000000013140000-0x0000000013B94000-memory.dmpFilesize
10.3MB
-
memory/1560-70-0x0000000013149D07-mapping.dmp
-
memory/1560-67-0x0000000013140000-0x0000000013B94000-memory.dmpFilesize
10.3MB
-
memory/1672-61-0x000000006B891000-0x000000006B893000-memory.dmpFilesize
8KB
-
memory/1672-66-0x0000000005490000-0x0000000005590000-memory.dmpFilesize
1024KB
-
memory/1672-64-0x000000007116D000-0x0000000071178000-memory.dmpFilesize
44KB
-
memory/1672-57-0x0000000075201000-0x0000000075203000-memory.dmpFilesize
8KB
-
memory/1672-65-0x0000000005360000-0x0000000005370000-memory.dmpFilesize
64KB
-
memory/1672-54-0x0000000072701000-0x0000000072704000-memory.dmpFilesize
12KB
-
memory/1672-58-0x000000007116D000-0x0000000071178000-memory.dmpFilesize
44KB
-
memory/1672-62-0x0000000005360000-0x0000000005370000-memory.dmpFilesize
64KB
-
memory/1672-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1672-55-0x0000000070181000-0x0000000070183000-memory.dmpFilesize
8KB