Analysis

  • max time kernel
    105s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2023, 06:35

General

  • Target

    report 03 08 2023.doc

  • Size

    522.3MB

  • MD5

    2148a6a2bef5a35ce5665cbc12d5e474

  • SHA1

    2e87b33309c888ab7d655e92a45a31f15753fdee

  • SHA256

    f616da0ebb4f984aecd40da922c0cdf70987643a86afadc969aa76598120cd5d

  • SHA512

    fb232985018569cdbba001273278a6128af1395e1dc4631b023a0c49fefffd43a93dd6b0332c2cc634aa87d850ea2866614cacb6b064e57f4d48c7b41b60ea4c

  • SSDEEP

    6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\report 03 08 2023.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1768
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\073724.tmp"
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:304
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Users\Admin\AppData\Local\Temp\073724.tmp"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1764
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IQegiDrp\ndMWIkQHUWmMH.dll"
          4⤵
            PID:544
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        2⤵
          PID:392

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\073724.tmp

              Filesize

              546.7MB

              MD5

              4f214becc5f8ac8bd13adef8437f7002

              SHA1

              a3b804db0726191408db0dd6fd82c8d8bd5722d0

              SHA256

              d7282f411b6f68f5c3a1657eb37a0f550d9d966a169b9290043d9e93b5f18ba3

              SHA512

              4f852216ca25459b2e2f2961d8a7acb011cccbe712a3eb54677967b92ecb9289a4770de3b7716a52f96aa33233b04607e63070e00a5c05fae078e399b3d1d9fe

            • C:\Users\Admin\AppData\Local\Temp\073727.zip

              Filesize

              882KB

              MD5

              d347a9e713947d67f6f575738ef07cd7

              SHA1

              f51f3983960517b07bb97f5ba5495480a31c8c0f

              SHA256

              22babdda065e864cc6309f90833994a36353ae21d3a7be6e3aafaf51024448f0

              SHA512

              5aef4fe8dbf87c3ff7e11af5e76912ef4e91e51246935132ee38a404c1f86cc464b527c2d47750930472121a23d1741e7c8e57f5ce41904af0d065bf6555a651

            • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

              Filesize

              20KB

              MD5

              d337dae212d144c3f1658c9576c8944c

              SHA1

              344688b5792244a3cbbfe1d85593363e3a65eafa

              SHA256

              74f6f1927cd19235e43ac14b178c2526f3717403595dc95c92dc4c7dfdd4e314

              SHA512

              33611b33e56949ab60f19e6ec68df87db9e26467e824ebf9ca95aa945a00d816ddd72b0feec2316bec89ee92a4eda49dbbc47bd0bcef97c7faa7741eb9d57ca0

            • \Users\Admin\AppData\Local\Temp\073724.tmp

              Filesize

              546.7MB

              MD5

              4f214becc5f8ac8bd13adef8437f7002

              SHA1

              a3b804db0726191408db0dd6fd82c8d8bd5722d0

              SHA256

              d7282f411b6f68f5c3a1657eb37a0f550d9d966a169b9290043d9e93b5f18ba3

              SHA512

              4f852216ca25459b2e2f2961d8a7acb011cccbe712a3eb54677967b92ecb9289a4770de3b7716a52f96aa33233b04607e63070e00a5c05fae078e399b3d1d9fe

            • \Users\Admin\AppData\Local\Temp\073724.tmp

              Filesize

              546.7MB

              MD5

              4f214becc5f8ac8bd13adef8437f7002

              SHA1

              a3b804db0726191408db0dd6fd82c8d8bd5722d0

              SHA256

              d7282f411b6f68f5c3a1657eb37a0f550d9d966a169b9290043d9e93b5f18ba3

              SHA512

              4f852216ca25459b2e2f2961d8a7acb011cccbe712a3eb54677967b92ecb9289a4770de3b7716a52f96aa33233b04607e63070e00a5c05fae078e399b3d1d9fe

            • memory/544-1271-0x0000000000200000-0x0000000000201000-memory.dmp

              Filesize

              4KB

            • memory/1764-1264-0x00000000001A0000-0x00000000001A1000-memory.dmp

              Filesize

              4KB

            • memory/1768-77-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-81-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-60-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-62-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-61-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-64-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-63-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-65-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-66-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-67-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-68-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-69-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-70-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-71-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-72-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-73-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-75-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-74-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-76-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-59-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-78-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-79-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-80-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-58-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-82-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-83-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-84-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-85-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-86-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-87-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-88-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-90-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-91-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-89-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-96-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-95-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-94-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-93-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-92-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-97-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-98-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-99-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-101-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-1077-0x0000000006240000-0x0000000006241000-memory.dmp

              Filesize

              4KB

            • memory/1768-1270-0x0000000006240000-0x0000000006241000-memory.dmp

              Filesize

              4KB

            • memory/1768-57-0x0000000000460000-0x0000000000560000-memory.dmp

              Filesize

              1024KB

            • memory/1768-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB