Resubmissions
07/03/2023, 23:26
230307-3e18sacb8v807/03/2023, 22:59
230307-2yrb9aca9z807/03/2023, 22:50
230307-2splgacf321007/03/2023, 22:45
230307-2pqpcsce9907/03/2023, 22:34
230307-2g4agsca4w10Analysis
- max time kernel
16s - max time network
34s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
- submitted
07/03/2023, 22:50
General
- Target documento 0803.doc
- Size 548.3MB
- Sample230307-2splgacf32
- SHA256 a85fa869a88e0c5464efb2e86ab86b97035374ea96bcc9c59a4fd7f7e3ba5de1
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Office loads VBA resources, possible macro or embedded object present
- Modifies Internet Explorer settings 1 TTPs 9 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\documento 0803.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\235743.tmp"2⤵
- Process spawned unexpected child process
-
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\235743.tmp"3⤵
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\FixYzqaRqoda\HjZaumm.dll"4⤵
-
-
-
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
235743.tmp
235746.zip
235743.tmp
235743.tmp
memory/688-1264-0x00000000001A0000-0x00000000001A1000-memory.dmp
memory/1272-1270-0x0000000000200000-0x0000000000201000-memory.dmp
memory/1460-87-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-98-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-54-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/1460-86-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-88-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-89-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-90-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-91-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-92-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-93-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-94-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-95-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-96-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-85-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-97-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-121-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-163-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-205-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-79-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-1077-0x00000000060C0000-0x00000000060C1000-memory.dmp
memory/1460-80-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-81-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-82-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-83-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-84-0x0000000000710000-0x0000000000810000-memory.dmp
memory/1460-1271-0x00000000060C0000-0x00000000060C1000-memory.dmp