Resubmissions

09-03-2023 06:42

230309-hgpybaah95 10

07-03-2023 13:00

230307-p826aaaa95 8

07-03-2023 12:24

230307-pljqeshc7z 10

Analysis

  • max time kernel
    107s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    07-03-2023 13:00

General

  • Target

    INVOICE 589 03_23.doc

  • Size

    526.2MB

  • MD5

    b59808aba76dd0095aa06133382de9ed

  • SHA1

    59aed06213b305d2877031e8ef489064ef74ca74

  • SHA256

    2e116e6a43dcc2ee55df34664a7d5bfae36918f3a8ce5af97be6cb99e3a4de5b

  • SHA512

    134c7c9929c277a3ec0403c2246214059d107c78c0056f8190218e0d16ded3cfaa7a4682d695f9e6212c66220cb222589c8fcd19f6ea70a00994eb06eec6566b

  • SSDEEP

    3072:eoEW2aOtFjH0lP2IpjctfRcVVwEi/A8NVM1wIOCbX6bYLjWFJuvx7ueK6:ZE1aOtFa2I9c3aVw4zwxCbJ4Jup

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 7 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\INVOICE 589 03_23.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1888

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      24c016cdc256211a5be3eae929660174

      SHA1

      5d5716328bb980069aff114d1cacf77b1d712837

      SHA256

      3e310ef70c4afec9e19bd1c9ec3f37e5e2c4e45ec8a4443ba2d8bed3258d0772

      SHA512

      98438993e89d7f4bb8a8bc8b8ca584a289c1aa3f2e69bbc6ff474b36ffb4bbaeacf9dcbbd23fc5eded4c9aae4e91cb3f7f9a7cb1475cffb25d904e48f821c844

    • memory/1632-70-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-62-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-72-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-60-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-59-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-58-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-63-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-65-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-67-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-66-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-64-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-68-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-69-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1632-57-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-61-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-73-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-74-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-75-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-76-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-78-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-77-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-80-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-79-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-81-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-83-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-82-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-84-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-111-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/1632-71-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB