Analysis
-
max time kernel
187s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-11-2022 11:38
Behavioral task
behavioral1
Sample
9b28f78ebb97bc88b473fb92cafd03ef.doc
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9b28f78ebb97bc88b473fb92cafd03ef.doc
Resource
win10v2004-20220812-en
General
-
Target
9b28f78ebb97bc88b473fb92cafd03ef.doc
-
Size
1.3MB
-
MD5
9b28f78ebb97bc88b473fb92cafd03ef
-
SHA1
345524df277ae83f974dbb121b01b571b7d7f528
-
SHA256
da8996a9e24fb4286a984cb02a21b613232ba9afcaaa0949d18d4ca11d08ccf1
-
SHA512
03dbff5c4d8b1038de19beb2878b2d76c344a75a4eb844914770b866974566fc9addc1e30bd18939b8663f51c924108353524eacb0772db29cb9e944de723788
-
SSDEEP
24576:mEIZ4wA74D4SQKxZcy8gthDW4/chYusVNVQK0U/S8mB:m+wJD4QZh/qWKMn70uS8K
Malware Config
Extracted
hancitor
2306_vensip
http://extilivelly.com/8/forum.php
http://cludimetifte.ru/8/forum.php
http://sakincesed.ru/8/forum.php
Signatures
-
Hancitor
Hancitor is downloader used to deliver other malware families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 4596 4544 rundll32.exe WINWORD.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 38 4152 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4152 rundll32.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 37 api.ipify.org -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
NTFS ADS 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\{C5F28547-578E-482E-9776-2FF0E55929B6}\kiks.dll:Zone.Identifier WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4544 WINWORD.EXE 4544 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 4152 rundll32.exe 4152 rundll32.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
WINWORD.EXEpid process 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
WINWORD.EXErundll32.exedescription pid process target process PID 4544 wrote to memory of 2080 4544 WINWORD.EXE splwow64.exe PID 4544 wrote to memory of 2080 4544 WINWORD.EXE splwow64.exe PID 4544 wrote to memory of 4596 4544 WINWORD.EXE rundll32.exe PID 4544 wrote to memory of 4596 4544 WINWORD.EXE rundll32.exe PID 4596 wrote to memory of 4152 4596 rundll32.exe rundll32.exe PID 4596 wrote to memory of 4152 4596 rundll32.exe rundll32.exe PID 4596 wrote to memory of 4152 4596 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\9b28f78ebb97bc88b473fb92cafd03ef.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" c:\users\admin\appdata\roaming\microsoft\templates\kikus.dll,OFCBWXTHRNL2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" c:\users\admin\appdata\roaming\microsoft\templates\kikus.dll,OFCBWXTHRNL3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\kikus.dllFilesize
721KB
MD58876aa101dabbb2456452f1e61a8b2c8
SHA143494e5875ddeef341dacc55b8cc8e5dc2982bd0
SHA256768e3c148345b946c30bb5f1521b1fa92ddc5fa1bf3af0946f7559e6fc79d57e
SHA512b5313d2a4493202e7ce6c52143fe0637b17fda734c52fb9da45a301e229b5917b67ef6c13a458282466612b86a73fbbaf6e4955837b32cd724b3ff4c0676bf45
-
\??\c:\users\admin\appdata\roaming\microsoft\templates\kikus.dllFilesize
721KB
MD58876aa101dabbb2456452f1e61a8b2c8
SHA143494e5875ddeef341dacc55b8cc8e5dc2982bd0
SHA256768e3c148345b946c30bb5f1521b1fa92ddc5fa1bf3af0946f7559e6fc79d57e
SHA512b5313d2a4493202e7ce6c52143fe0637b17fda734c52fb9da45a301e229b5917b67ef6c13a458282466612b86a73fbbaf6e4955837b32cd724b3ff4c0676bf45
-
memory/2080-139-0x0000000000000000-mapping.dmp
-
memory/4152-148-0x0000000002EE0000-0x0000000002EEA000-memory.dmpFilesize
40KB
-
memory/4152-147-0x0000000002EE0000-0x0000000002EEA000-memory.dmpFilesize
40KB
-
memory/4152-146-0x0000000002EC0000-0x0000000002EC8000-memory.dmpFilesize
32KB
-
memory/4152-144-0x0000000000000000-mapping.dmp
-
memory/4544-137-0x00007FFD188D0000-0x00007FFD188E0000-memory.dmpFilesize
64KB
-
memory/4544-132-0x00007FFD1B230000-0x00007FFD1B240000-memory.dmpFilesize
64KB
-
memory/4544-141-0x0000020F9158C000-0x0000020F9158E000-memory.dmpFilesize
8KB
-
memory/4544-153-0x00007FFD1B230000-0x00007FFD1B240000-memory.dmpFilesize
64KB
-
memory/4544-138-0x00007FFD188D0000-0x00007FFD188E0000-memory.dmpFilesize
64KB
-
memory/4544-135-0x00007FFD1B230000-0x00007FFD1B240000-memory.dmpFilesize
64KB
-
memory/4544-136-0x00007FFD1B230000-0x00007FFD1B240000-memory.dmpFilesize
64KB
-
memory/4544-140-0x0000020F9158C000-0x0000020F9158E000-memory.dmpFilesize
8KB
-
memory/4544-133-0x00007FFD1B230000-0x00007FFD1B240000-memory.dmpFilesize
64KB
-
memory/4544-134-0x00007FFD1B230000-0x00007FFD1B240000-memory.dmpFilesize
64KB
-
memory/4544-150-0x00007FFD1B230000-0x00007FFD1B240000-memory.dmpFilesize
64KB
-
memory/4544-151-0x00007FFD1B230000-0x00007FFD1B240000-memory.dmpFilesize
64KB
-
memory/4544-152-0x00007FFD1B230000-0x00007FFD1B240000-memory.dmpFilesize
64KB
-
memory/4596-142-0x0000000000000000-mapping.dmp