Analysis
-
max time kernel
142s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 06:24
Static task
static1
Behavioral task
behavioral1
Sample
8dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c.exe
Resource
win10v2004-20220901-en
General
-
Target
8dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c.exe
-
Size
27KB
-
MD5
8a14b82fdbf63695569b3aaa1b76dca3
-
SHA1
81ea5808fe48d81746b3d28b449fbf87507897f1
-
SHA256
8dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c
-
SHA512
3d6cd80116e56d1a8a70b4177ca8a6daf89897e2fd54e1bfbf3a5b899011d2404f99d52707758ab3044215f57e78a1fd6709efc4e67ada46aa8a24d113a2ec04
-
SSDEEP
768:DBu6LUjA/P4t6yeNR78L1yShobJDDLQppv:duAAhcuLWbBLQL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
msword98.exepid process 2188 msword98.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msword98.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msword98 = "C:\\Windows\\system32\\msword98.exe" msword98.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msword98 = "C:\\Users\\Admin\\msword98.exe" msword98.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
svchost.exedescription ioc process File opened for modification \??\PhysicalDrive0 svchost.exe -
Drops file in System32 directory 1 IoCs
Processes:
8dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c.exedescription ioc process File created C:\Windows\SysWOW64\msword98.exe 8dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
msword98.exedescription pid process target process PID 2188 set thread context of 2788 2188 msword98.exe svchost.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 520 4836 WerFault.exe 8dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c.exe 1432 2788 WerFault.exe svchost.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
8dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c.exemsword98.exedescription pid process target process PID 4836 wrote to memory of 2188 4836 8dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c.exe msword98.exe PID 4836 wrote to memory of 2188 4836 8dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c.exe msword98.exe PID 4836 wrote to memory of 2188 4836 8dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c.exe msword98.exe PID 2188 wrote to memory of 2788 2188 msword98.exe svchost.exe PID 2188 wrote to memory of 2788 2188 msword98.exe svchost.exe PID 2188 wrote to memory of 2788 2188 msword98.exe svchost.exe PID 2188 wrote to memory of 2788 2188 msword98.exe svchost.exe PID 2188 wrote to memory of 2788 2188 msword98.exe svchost.exe PID 2188 wrote to memory of 2788 2188 msword98.exe svchost.exe PID 2188 wrote to memory of 2788 2188 msword98.exe svchost.exe PID 2188 wrote to memory of 2788 2188 msword98.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c.exe"C:\Users\Admin\AppData\Local\Temp\8dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msword98.exeC:\Windows\system32\msword98.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe3⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 2404⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 3482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4836 -ip 48361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2788 -ip 27881⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\msword98.exeFilesize
27KB
MD58a14b82fdbf63695569b3aaa1b76dca3
SHA181ea5808fe48d81746b3d28b449fbf87507897f1
SHA2568dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c
SHA5123d6cd80116e56d1a8a70b4177ca8a6daf89897e2fd54e1bfbf3a5b899011d2404f99d52707758ab3044215f57e78a1fd6709efc4e67ada46aa8a24d113a2ec04
-
C:\Windows\SysWOW64\msword98.exeFilesize
27KB
MD58a14b82fdbf63695569b3aaa1b76dca3
SHA181ea5808fe48d81746b3d28b449fbf87507897f1
SHA2568dede52db3dcb9bc5d4349b0a7b725bd4b769a34be6f8ba1ffbad8477056ae3c
SHA5123d6cd80116e56d1a8a70b4177ca8a6daf89897e2fd54e1bfbf3a5b899011d2404f99d52707758ab3044215f57e78a1fd6709efc4e67ada46aa8a24d113a2ec04
-
memory/2188-142-0x0000000000000000-mapping.dmp
-
memory/2188-154-0x0000000070000000-0x000000007000D000-memory.dmpFilesize
52KB
-
memory/2788-152-0x0000000070000000-0x00000000701FB000-memory.dmpFilesize
2.0MB
-
memory/2788-150-0x0000000000000000-mapping.dmp
-
memory/2788-157-0x0000000070000000-0x00000000701FB000-memory.dmpFilesize
2.0MB
-
memory/2788-155-0x0000000070000000-0x00000000701FB000-memory.dmpFilesize
2.0MB
-
memory/2788-153-0x0000000070000000-0x00000000701FB000-memory.dmpFilesize
2.0MB
-
memory/2788-151-0x0000000070000000-0x00000000701FB000-memory.dmpFilesize
2.0MB
-
memory/4836-138-0x0000000009100000-0x0000000009109000-memory.dmpFilesize
36KB
-
memory/4836-135-0x0000000009100000-0x0000000009109000-memory.dmpFilesize
36KB
-
memory/4836-136-0x0000000009100000-0x0000000009109000-memory.dmpFilesize
36KB
-
memory/4836-140-0x0000000009100000-0x0000000009109000-memory.dmpFilesize
36KB
-
memory/4836-137-0x0000000009100000-0x0000000009109000-memory.dmpFilesize
36KB
-
memory/4836-139-0x0000000009100000-0x0000000009109000-memory.dmpFilesize
36KB
-
memory/4836-156-0x0000000070000000-0x000000007000D000-memory.dmpFilesize
52KB
-
memory/4836-141-0x0000000070000000-0x000000007000D000-memory.dmpFilesize
52KB