Analysis

  • max time kernel
    105s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2023, 06:11

General

  • Target

    Electronic form/Electronic form.doc

  • Size

    238KB

  • MD5

    abf07ca5599b803d92cb8bc84022a92e

  • SHA1

    8153bfa1251585f26b58462b5d26084ba070909b

  • SHA256

    56bce1a1e4b52a55f128359d58cfd096ea51d2cccb65c9395e49c39076151614

  • SHA512

    7abe29d9160f164b8f2c6b28cac974b53e170fa0a4a451873118d7334849726515eafaff1b75d7ba11848f64c7455dd6d30d0db15adea283a5273568b8572729

  • SSDEEP

    6144:yO7DogBDkHS50LdfcGcbz1f5M9KTFrMpSlMKnRu+Q2:y+kgHnRu+x

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Electronic form\Electronic form.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\Electronic form\071140.tmp"
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:764
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Users\Admin\AppData\Local\Temp\Electronic form\071140.tmp"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:528
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VeakbIPWoxBsLwBQu\pxnpwFJWgqC.dll"
          4⤵
            PID:1348
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        2⤵
          PID:900

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\ELECTR~1\071146.zip

              Filesize

              864KB

              MD5

              9ad186e479e35bab7859e974b0cbfd65

              SHA1

              9a6191124de81354ffe01922e6348e6ab0830aee

              SHA256

              c8861f1708199dd01294e6d66ebf2bb3951980e177ec646b15291999e6b6a291

              SHA512

              f6578eaefd8a6934a10f0089877494e5c68f2fcf4fb821a5f6f1195b38559fa3086f57a5eaabd0a3efd6c42b4278d6d80d67ce4a4d440e944f9b42da9bde3ecd

            • C:\Users\Admin\AppData\Local\Temp\Electronic form\071140.tmp

              Filesize

              528.7MB

              MD5

              8467d39bd97385af80831fec91fc38bb

              SHA1

              27da57182e02b32adedbdea812d0107506e66a10

              SHA256

              73b63b12507b780f6e37ebc5a86ddd75edaa88895c32b0e04a6d41ead78f77b4

              SHA512

              a340986c205891e4b64405b12e5286d945e05c3278ceaa9fc19523058b982247f9893796632410d50f81045c0a0a2788a5af7a0ffdc7d38c467c728e8a95042e

            • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

              Filesize

              20KB

              MD5

              2908eeeccbccbe97b6c207fcaf667f1f

              SHA1

              34864ff87cbbce6bf97de0680a72f3d6de79d6b8

              SHA256

              6529476e40398e77852505196a2e456f31b37acbad70d06c5364b370be5b2771

              SHA512

              2081cf63d6a8102b6a1a69e82f705ea872971d6b007ae6937e8c86933ee6e97e2770189e500384f88fb92da92a2e9066886d28e0dc955dec46e94e10b22a6d96

            • \Users\Admin\AppData\Local\Temp\Electronic form\071140.tmp

              Filesize

              528.7MB

              MD5

              8467d39bd97385af80831fec91fc38bb

              SHA1

              27da57182e02b32adedbdea812d0107506e66a10

              SHA256

              73b63b12507b780f6e37ebc5a86ddd75edaa88895c32b0e04a6d41ead78f77b4

              SHA512

              a340986c205891e4b64405b12e5286d945e05c3278ceaa9fc19523058b982247f9893796632410d50f81045c0a0a2788a5af7a0ffdc7d38c467c728e8a95042e

            • \Users\Admin\AppData\Local\Temp\Electronic form\071140.tmp

              Filesize

              528.7MB

              MD5

              8467d39bd97385af80831fec91fc38bb

              SHA1

              27da57182e02b32adedbdea812d0107506e66a10

              SHA256

              73b63b12507b780f6e37ebc5a86ddd75edaa88895c32b0e04a6d41ead78f77b4

              SHA512

              a340986c205891e4b64405b12e5286d945e05c3278ceaa9fc19523058b982247f9893796632410d50f81045c0a0a2788a5af7a0ffdc7d38c467c728e8a95042e

            • memory/528-1262-0x0000000000130000-0x0000000000131000-memory.dmp

              Filesize

              4KB

            • memory/1348-1271-0x00000000001B0000-0x00000000001B1000-memory.dmp

              Filesize

              4KB

            • memory/1724-77-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-82-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-61-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-60-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-63-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-62-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-64-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-65-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-66-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-67-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-68-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-69-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-70-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-71-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-72-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-73-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-74-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-76-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-75-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-59-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-78-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-80-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-79-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-58-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-83-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-81-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-84-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-85-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-87-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-86-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-88-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-89-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-90-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-92-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-91-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-93-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-94-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-96-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-95-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-97-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-98-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-99-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-101-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-1072-0x0000000006130000-0x0000000006131000-memory.dmp

              Filesize

              4KB

            • memory/1724-1269-0x0000000006130000-0x0000000006131000-memory.dmp

              Filesize

              4KB

            • memory/1724-57-0x0000000000760000-0x0000000000860000-memory.dmp

              Filesize

              1024KB

            • memory/1724-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB