Resubmissions

08/03/2023, 06:44

230308-hhkpzsea2x 10

Analysis

  • max time kernel
    119s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2023, 06:44

General

  • Target

    954895897851030__2023-08-03_0953.doc

  • Size

    502.3MB

  • MD5

    a59e9fe46fe7ccd8c74b1dc39553d1a5

  • SHA1

    6b2699157dd7bb19cdb7f0ffb959c20c90318e9c

  • SHA256

    4792472bd90dab5885a789793a3309109b7f8d305203faa011d92b0efdf1720b

  • SHA512

    cfc9951ccf2e7001184b71855c1074c5c8a74b8739494121f5df6f8151d90af6ff5f9ea6b524f71fc4d5b3a3ded608172372c49cb9f7771c6594cb19d179435d

  • SSDEEP

    6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\954895897851030__2023-08-03_0953.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\074914.tmp"
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:944
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Users\Admin\AppData\Local\Temp\074914.tmp"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1232
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe "C:\Windows\system32\EXAUvcorxjk\wERxsxY.dll"
          4⤵
            PID:580
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        2⤵
          PID:1856

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\074914.tmp

              Filesize

              546.7MB

              MD5

              4f214becc5f8ac8bd13adef8437f7002

              SHA1

              a3b804db0726191408db0dd6fd82c8d8bd5722d0

              SHA256

              d7282f411b6f68f5c3a1657eb37a0f550d9d966a169b9290043d9e93b5f18ba3

              SHA512

              4f852216ca25459b2e2f2961d8a7acb011cccbe712a3eb54677967b92ecb9289a4770de3b7716a52f96aa33233b04607e63070e00a5c05fae078e399b3d1d9fe

            • C:\Users\Admin\AppData\Local\Temp\074917.zip

              Filesize

              882KB

              MD5

              d347a9e713947d67f6f575738ef07cd7

              SHA1

              f51f3983960517b07bb97f5ba5495480a31c8c0f

              SHA256

              22babdda065e864cc6309f90833994a36353ae21d3a7be6e3aafaf51024448f0

              SHA512

              5aef4fe8dbf87c3ff7e11af5e76912ef4e91e51246935132ee38a404c1f86cc464b527c2d47750930472121a23d1741e7c8e57f5ce41904af0d065bf6555a651

            • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

              Filesize

              20KB

              MD5

              deb3c49348c48e3d466946ee7f03ba37

              SHA1

              72ccc366707e2cf805bab0030913ef1748c4d304

              SHA256

              5db04fd69a2f792034ab16d3bf5c7341d632f90400bf90a667681b246dfb4299

              SHA512

              9be2e867dbff0dfc125846cf14d3302ffab0ea362b72756071c5398327a06dcbc00799f5467efc86b422c5550c601e95ca96849ac6aa9e105814dcf9e0463f4c

            • \Users\Admin\AppData\Local\Temp\074914.tmp

              Filesize

              546.7MB

              MD5

              4f214becc5f8ac8bd13adef8437f7002

              SHA1

              a3b804db0726191408db0dd6fd82c8d8bd5722d0

              SHA256

              d7282f411b6f68f5c3a1657eb37a0f550d9d966a169b9290043d9e93b5f18ba3

              SHA512

              4f852216ca25459b2e2f2961d8a7acb011cccbe712a3eb54677967b92ecb9289a4770de3b7716a52f96aa33233b04607e63070e00a5c05fae078e399b3d1d9fe

            • \Users\Admin\AppData\Local\Temp\074914.tmp

              Filesize

              546.7MB

              MD5

              4f214becc5f8ac8bd13adef8437f7002

              SHA1

              a3b804db0726191408db0dd6fd82c8d8bd5722d0

              SHA256

              d7282f411b6f68f5c3a1657eb37a0f550d9d966a169b9290043d9e93b5f18ba3

              SHA512

              4f852216ca25459b2e2f2961d8a7acb011cccbe712a3eb54677967b92ecb9289a4770de3b7716a52f96aa33233b04607e63070e00a5c05fae078e399b3d1d9fe

            • memory/580-1270-0x0000000000140000-0x0000000000141000-memory.dmp

              Filesize

              4KB

            • memory/1232-1264-0x0000000000130000-0x0000000000131000-memory.dmp

              Filesize

              4KB

            • memory/1988-97-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-98-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-88-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-90-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-89-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-91-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-92-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-94-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-95-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB

            • memory/1988-96-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-93-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-83-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-85-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-121-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-125-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-163-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-205-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-86-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-1077-0x0000000005F20000-0x0000000005F21000-memory.dmp

              Filesize

              4KB

            • memory/1988-87-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-84-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-82-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-80-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-81-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB

            • memory/1988-1271-0x0000000005F20000-0x0000000005F21000-memory.dmp

              Filesize

              4KB

            • memory/1988-79-0x0000000000770000-0x0000000000870000-memory.dmp

              Filesize

              1024KB