Analysis

  • max time kernel
    459s
  • max time network
    414s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    16-02-2023 11:56

General

  • Target

    malware.dll

  • Size

    244KB

  • MD5

    df1b0f2d8e1c9ff27a9b0eb50d0967ef

  • SHA1

    fdd07c89c8ed656964dfa1a6cff271e170eda0c2

  • SHA256

    f9495e968f9a1610c0cf9383053e5b5696ecc85ca3ca2a338c24c7204cc93881

  • SHA512

    1310c467da1c30e1693b459102308e07aa755bec61423ae1e5a48b8313ebd24ff411b790f26b591b19d815e247d2c504f864fd73f9e0fd0bbb17917278f16d9a

  • SSDEEP

    3072:Um/5nor0i+jZfh7vFiTR8MpFdieXF7A9JhCS8QHlliVY7c7LzOKA1cZrPx4N4t:vM8j0z7AlE7GrIZ4NQ

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\malware.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1896
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\malware.dll
      2⤵
        PID:1760
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:536
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0xd0
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1912
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\TestUse.pdf"
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1524
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        1⤵
          PID:1920
        • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
          "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Documents\Files.docx"
          1⤵
          • Drops file in Windows directory
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1592
          • C:\Windows\splwow64.exe
            C:\Windows\splwow64.exe 12288
            2⤵
              PID:1660
          • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
            "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Documents\Are.docx"
            1⤵
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of SetWindowsHookEx
            PID:2008
          • C:\Windows\System32\NOTEPAD.EXE
            "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\ConnectNew.cmd
            1⤵
            • Opens file in notepad (likely ransom note)
            PID:1616

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

            Filesize

            88B

            MD5

            3bfafa0d38f0aa0cef57d1c5cec9ce6d

            SHA1

            46a620996257edcaae35eba50d556853f8d73b75

            SHA256

            4d37bb48809c83eea4541648e0c881e9a98ca4d49c9707f539ef4d8de866d287

            SHA512

            6ffc40c5ca4402547a21d12f61d2b1da26a8e70079a5b2e62a3cad0c0723813e78eb79b485250556ee7b69c28f7fdf3a103081a728234f7a68a886af6bf11c7e

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

            Filesize

            20KB

            MD5

            d4085535ae08c63619cc52dc6f7a7c0d

            SHA1

            f55669e503993dedc86146abf2790baa202542f7

            SHA256

            03e754a0d7ffa40d14231982f52704697d502f44cb14c73866cafac70e5e20ac

            SHA512

            7ab23d150fd4f033ce1715d71ce3cb9d1729e838b266b4152005fb7ea4118e74a81c7cf7ca0bfc00100bedd794e364b18224549099845637cc8d34d8f30760bf

          • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

            Filesize

            2B

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • memory/1592-67-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/1592-68-0x00000000719DD000-0x00000000719E8000-memory.dmp

            Filesize

            44KB

          • memory/1592-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/1592-64-0x00000000719DD000-0x00000000719E8000-memory.dmp

            Filesize

            44KB

          • memory/1592-61-0x00000000709F1000-0x00000000709F3000-memory.dmp

            Filesize

            8KB

          • memory/1592-60-0x0000000072F71000-0x0000000072F74000-memory.dmp

            Filesize

            12KB

          • memory/1660-65-0x0000000000000000-mapping.dmp

          • memory/1760-56-0x0000000076181000-0x0000000076183000-memory.dmp

            Filesize

            8KB

          • memory/1760-55-0x0000000000000000-mapping.dmp

          • memory/1896-54-0x000007FEFC621000-0x000007FEFC623000-memory.dmp

            Filesize

            8KB

          • memory/2008-69-0x0000000071CF1000-0x0000000071CF4000-memory.dmp

            Filesize

            12KB

          • memory/2008-70-0x0000000073011000-0x0000000073013000-memory.dmp

            Filesize

            8KB

          • memory/2008-71-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/2008-74-0x0000000073FFD000-0x0000000074008000-memory.dmp

            Filesize

            44KB

          • memory/2008-78-0x0000000073FFD000-0x0000000074008000-memory.dmp

            Filesize

            44KB