Analysis

  • max time kernel
    199s
  • max time network
    202s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 09:34

General

  • Target

    201d6cee594f4b4fb7445b7d65d79ec6574ce56463e76e5a4574b4d5ec264542.exe

  • Size

    723KB

  • MD5

    bdb6a69ae23569a7dfb3259fefde14a5

  • SHA1

    b0d24b8a75ea8ff8e22a1ff4e7fa2dea4e4f2749

  • SHA256

    201d6cee594f4b4fb7445b7d65d79ec6574ce56463e76e5a4574b4d5ec264542

  • SHA512

    3f26af94b584121d133216709653d3ee7495e67debb78fc569dd12149c3fde277e3a853464feea81bd113d324d8767948946844134396f90b7bf89b0a119e908

  • SSDEEP

    12288:ERBk7MpC7tYR4eYLEkiw4PKEgOHS1ZBvKEjGbCAlLxgajRy9hH:EFQeYLbKKEPS1bvKE2JCajRUH

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\201d6cee594f4b4fb7445b7d65d79ec6574ce56463e76e5a4574b4d5ec264542.exe
    "C:\Users\Admin\AppData\Local\Temp\201d6cee594f4b4fb7445b7d65d79ec6574ce56463e76e5a4574b4d5ec264542.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:336
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start C:\Users\Admin\h.vbs && start C:\Users\Admin\Voc.doc
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:660
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\h.vbs"
        3⤵
        • Drops startup file
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:520
        • C:\Windows\SysWOW64\wscript.exe
          "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\h.vbs"
          4⤵
          • Drops startup file
          • Adds Run key to start application
          PID:1280
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Voc.doc"
        3⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1756
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          4⤵
            PID:452

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\h.vbs

      Filesize

      43KB

      MD5

      1ec283947dc7d76854c936806f57eacf

      SHA1

      c7a604353750d3d4e43cfb9d813b41776855bf73

      SHA256

      8b8aead4157caa14460cfcabebf4084934c9a0296dba3827d32401db3a2aee43

      SHA512

      6dbb19b6915fd3eec68ea266ad5ff874996a3052ce32e2e0453c3b12586fbdfe33650318cc3833b7152a01603e60030fd6fcd11f7634ffdc172fb6c5db0a1a9a

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h.vbs

      Filesize

      43KB

      MD5

      1ec283947dc7d76854c936806f57eacf

      SHA1

      c7a604353750d3d4e43cfb9d813b41776855bf73

      SHA256

      8b8aead4157caa14460cfcabebf4084934c9a0296dba3827d32401db3a2aee43

      SHA512

      6dbb19b6915fd3eec68ea266ad5ff874996a3052ce32e2e0453c3b12586fbdfe33650318cc3833b7152a01603e60030fd6fcd11f7634ffdc172fb6c5db0a1a9a

    • C:\Users\Admin\Voc.doc

      Filesize

      32KB

      MD5

      4478b9ae1b1b462028f6acdab4060e36

      SHA1

      68301c030e9948bc715adf8e38c17bd373b0ce8c

      SHA256

      afa9980d6a8151348f8134bebf191705740e71f2e60e39f1c6bea9ac39a498a3

      SHA512

      dd39f4a01b521aa061e81c8ce9a9f81b6c5a83e578b9431d6011c63927735fb32ea20f55df8d9ec26241e38bc62e32e900d5455dba77f1643cac110afe987985

    • C:\Users\Admin\h.vbs

      Filesize

      43KB

      MD5

      1ec283947dc7d76854c936806f57eacf

      SHA1

      c7a604353750d3d4e43cfb9d813b41776855bf73

      SHA256

      8b8aead4157caa14460cfcabebf4084934c9a0296dba3827d32401db3a2aee43

      SHA512

      6dbb19b6915fd3eec68ea266ad5ff874996a3052ce32e2e0453c3b12586fbdfe33650318cc3833b7152a01603e60030fd6fcd11f7634ffdc172fb6c5db0a1a9a

    • memory/336-54-0x0000000074E01000-0x0000000074E03000-memory.dmp

      Filesize

      8KB

    • memory/452-73-0x000007FEFB7D1000-0x000007FEFB7D3000-memory.dmp

      Filesize

      8KB

    • memory/452-72-0x0000000000000000-mapping.dmp

    • memory/520-58-0x0000000000000000-mapping.dmp

    • memory/660-55-0x0000000000000000-mapping.dmp

    • memory/1280-66-0x0000000000000000-mapping.dmp

    • memory/1756-64-0x0000000070B8D000-0x0000000070B98000-memory.dmp

      Filesize

      44KB

    • memory/1756-63-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1756-70-0x0000000070B8D000-0x0000000070B98000-memory.dmp

      Filesize

      44KB

    • memory/1756-62-0x000000006FBA1000-0x000000006FBA3000-memory.dmp

      Filesize

      8KB

    • memory/1756-61-0x0000000072121000-0x0000000072124000-memory.dmp

      Filesize

      12KB

    • memory/1756-60-0x0000000000000000-mapping.dmp

    • memory/1756-74-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1756-75-0x0000000070B8D000-0x0000000070B98000-memory.dmp

      Filesize

      44KB