Resubmissions
07/03/2023, 21:18
230307-z5p2nabe8y1007/03/2023, 20:15
230307-y1kqpsbg321007/03/2023, 12:20
230307-phtffshc7w10Analysis
- max time kernel
24s - max time network
95s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
- submitted
07/03/2023, 12:20
General
- Target INVOICE VL18998 07 March 23.doc
- Size 506.2MB
- Sample230307-phtffshc7w
- SHA256 cb638551632b271c9993266834e78a2c9a64a4b9deb8590497b0901f1044e6ff
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Office loads VBA resources, possible macro or embedded object present
- Modifies Internet Explorer settings 1 TTPs 9 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\INVOICE VL18998 07 March 23.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\132245.tmp"2⤵
- Process spawned unexpected child process
-
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\132245.tmp"3⤵
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\NNNmGbqzpmJww\BiSgfNncoyEAQL.dll"4⤵
-
-
-
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
132245.tmp
132255.zip
132245.tmp
132245.tmp
memory/548-848-0x00000000005E0000-0x00000000005E1000-memory.dmp
memory/1336-268-0x00000000004D0000-0x00000000005D0000-memory.dmp
memory/1336-322-0x00000000004D0000-0x00000000005D0000-memory.dmp
memory/1336-133-0x00000000004D0000-0x00000000005D0000-memory.dmp
memory/1336-160-0x00000000004D0000-0x00000000005D0000-memory.dmp
memory/1336-187-0x00000000004D0000-0x00000000005D0000-memory.dmp
memory/1336-214-0x00000000004D0000-0x00000000005D0000-memory.dmp
memory/1336-241-0x00000000004D0000-0x00000000005D0000-memory.dmp
memory/1336-54-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/1336-295-0x00000000004D0000-0x00000000005D0000-memory.dmp
memory/1336-106-0x00000000004D0000-0x00000000005D0000-memory.dmp
memory/1336-349-0x00000000004D0000-0x00000000005D0000-memory.dmp
memory/1336-377-0x00000000004D0000-0x00000000005D0000-memory.dmp
memory/1336-376-0x00000000004D0000-0x00000000005D0000-memory.dmp
memory/1336-403-0x00000000004D0000-0x00000000005D0000-memory.dmp
memory/1336-83-0x00000000004D0000-0x00000000005D0000-memory.dmp
memory/1336-82-0x00000000004D0000-0x00000000005D0000-memory.dmp
memory/1336-81-0x00000000004D0000-0x00000000005D0000-memory.dmp
memory/1336-80-0x00000000004D0000-0x00000000005D0000-memory.dmp
memory/1336-79-0x00000000004D0000-0x00000000005D0000-memory.dmp
memory/1956-843-0x0000000000120000-0x0000000000121000-memory.dmp