Analysis

  • max time kernel
    22s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2023, 06:16

General

  • Target

    2023-03-08_1509.doc

  • Size

    520.3MB

  • MD5

    f5e7227c77fac1e1fd2dd02c74f142e6

  • SHA1

    c2f88e9be84a1d93e053854d662082189ad59e55

  • SHA256

    b2bb80310dca2ee1127f4723ca27cf6a59f0243760e139f6f108cdb692b795f7

  • SHA512

    73d0ca98f6e1f7a04772e84b95753d11bbf22496404d5dc1ba1bf3fec367efad65e60d5bba82be8993af1b99830b83f9345b411f092984b495bc34f3eb4ebd42

  • SSDEEP

    6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2023-03-08_1509.doc"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1636
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\072025.tmp"
      2⤵
      • Process spawned unexpected child process
      PID:1648
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Users\Admin\AppData\Local\Temp\072025.tmp"
        3⤵
          PID:1484
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LQYiQwNmulLFNhtNt\lhWp.dll"
            4⤵
              PID:1620
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          2⤵
            PID:1016

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\072025.tmp

                Filesize

                517.2MB

                MD5

                e1b2d20c8bdc29f4b998d80ac9a4dd3e

                SHA1

                25e3ecb94527fd6d891ddaca38905aea7da34144

                SHA256

                b683b0147646504a5cafa3a5c235eed86371c3d2640401bafed47c28629b1ef8

                SHA512

                3dfd8657130ba08a66f359d89c420892efe05672e9aa3dfadaef6bbce5903aacb32be59a38076c839e18d8712325bd2e85e563d6c4a4f05c10a4cb1f266467e7

              • C:\Users\Admin\AppData\Local\Temp\072030.zip

                Filesize

                872KB

                MD5

                d5700e1ee975acb953e76eac021dc57d

                SHA1

                a5e008828774992d42ddd66a00cda20e0d29b4a6

                SHA256

                e184e3130db13b0f2c4079a7d19e669f1873a7029f79fc928f07829007dbaca8

                SHA512

                0a1e10ded8a5dc96776571afbd84b735fac9b7c3baa2acaa576d26edf6cf81cfa28ebdcbba00ba70c99c655f49ed78ff1202ceed22425c92ec441df740edc7c5

              • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

                Filesize

                20KB

                MD5

                c30f7745c2fb9cdf4565da087a63aafa

                SHA1

                a161c02e1d5ea51ea83c4eab99f0ba3fe7e233f5

                SHA256

                c42d8a602c788c6924ba9b59320d2c4944fda247ac0e4cbe63e1aae9af5c04ad

                SHA512

                d4cef71f64fbf95aaf0d3b469f1d70e64e1c2ca8ccb79fc7a0e53389c71f0baad2b046bbb7ff8d2545283b5122f97f19cd85a555821ab2de83b40c1650870f62

              • \Users\Admin\AppData\Local\Temp\072025.tmp

                Filesize

                499.4MB

                MD5

                a34bfb95e5e1ecb024e8c69baef691c4

                SHA1

                1591af6f0191e9d9fcbe62cbd98d1afbc5e281db

                SHA256

                4de9469e98b53a2b151f2c8ea3d69fca77d53e13efb55ef2aeab5e1d49f4be7b

                SHA512

                47c6fb422971a25d4f50e2544aa6362a6ea29211eee5cc3c773523adef2e29c9348cef2d432329f1055194acbf79f787690f13914b379f8450b924f0cf06102d

              • \Users\Admin\AppData\Local\Temp\072025.tmp

                Filesize

                447.6MB

                MD5

                5e24f0b1c4646d5e68cae44b7ac973a3

                SHA1

                e08e20c2ac56156badaaf10f9afe32aa61135ba9

                SHA256

                1d8776b07c090119a91d735d8ea0f83806758759c4c15fc7f452f325ac112434

                SHA512

                eab99651fc0c29e13823fe5094026528a883520d90a5cbd40f25646e440538c7e1ca0ddd461b3958f4850b53b551c72d0ffe17a1e7cc7dfa4e3962f03fd80332

              • memory/1484-1268-0x00000000002A0000-0x00000000002A1000-memory.dmp

                Filesize

                4KB

              • memory/1620-1270-0x0000000000270000-0x0000000000271000-memory.dmp

                Filesize

                4KB

              • memory/1636-75-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-78-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-61-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-60-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-59-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-71-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-72-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-70-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-69-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-68-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-67-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-66-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-65-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-64-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-63-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-73-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-74-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-76-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-77-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-58-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-79-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-81-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-80-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-62-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-82-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-86-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-91-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-92-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-90-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-89-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-88-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-87-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-85-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-84-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-83-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-95-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-94-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-96-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-97-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-98-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-57-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-93-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-99-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-107-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

              • memory/1636-1077-0x00000000060E0000-0x00000000060E1000-memory.dmp

                Filesize

                4KB

              • memory/1636-1271-0x00000000060E0000-0x00000000060E1000-memory.dmp

                Filesize

                4KB

              • memory/1636-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

                Filesize

                64KB