Analysis

  • max time kernel
    106s
  • max time network
    36s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2023, 07:02

General

  • Target

    42543424254673870027753__2023-08-03_1457.doc

  • Size

    527.3MB

  • MD5

    034ac24d760c3e946b044c12032b40d9

  • SHA1

    04d3e42cad8f0a4005589d7a53d067df324768b9

  • SHA256

    4ec23d327a426c1b002c2c0ecebb54685b314ae3011c6978cefac00157ffc828

  • SHA512

    356a988864544d543ac7cdcc233535b86c772a03860463e3169e5c78f1efcd2782b840cdeb78667e43d4d16640a46dbc74cbb83a439d538d00a8e5d572f5297b

  • SSDEEP

    6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\42543424254673870027753__2023-08-03_1457.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1248
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\080301.tmp"
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1640
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Users\Admin\AppData\Local\Temp\080301.tmp"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1972
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe "C:\Windows\system32\SAlkohjqRxap\VtUkGY.dll"
          4⤵
            PID:636
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        2⤵
          PID:1216

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\080301.tmp

              Filesize

              546.7MB

              MD5

              4f214becc5f8ac8bd13adef8437f7002

              SHA1

              a3b804db0726191408db0dd6fd82c8d8bd5722d0

              SHA256

              d7282f411b6f68f5c3a1657eb37a0f550d9d966a169b9290043d9e93b5f18ba3

              SHA512

              4f852216ca25459b2e2f2961d8a7acb011cccbe712a3eb54677967b92ecb9289a4770de3b7716a52f96aa33233b04607e63070e00a5c05fae078e399b3d1d9fe

            • C:\Users\Admin\AppData\Local\Temp\080304.zip

              Filesize

              882KB

              MD5

              d347a9e713947d67f6f575738ef07cd7

              SHA1

              f51f3983960517b07bb97f5ba5495480a31c8c0f

              SHA256

              22babdda065e864cc6309f90833994a36353ae21d3a7be6e3aafaf51024448f0

              SHA512

              5aef4fe8dbf87c3ff7e11af5e76912ef4e91e51246935132ee38a404c1f86cc464b527c2d47750930472121a23d1741e7c8e57f5ce41904af0d065bf6555a651

            • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

              Filesize

              20KB

              MD5

              5388224b2a289ca8add3c9984c35ce45

              SHA1

              9e5aaa29b541f06a85d97208496e82ab47a98038

              SHA256

              b91a74f6ef3f798210d878aa5a7f481eb0fe03e2fd2b199801283d17c07e7777

              SHA512

              d8beea5b364d9bba2e25bdddb1a3c846163d4cc92345fd84a6104ebaa7921d934bc25de49624c48060479c31c90c749ba66fe34390671aff09e267d1244a1763

            • \Users\Admin\AppData\Local\Temp\080301.tmp

              Filesize

              546.7MB

              MD5

              4f214becc5f8ac8bd13adef8437f7002

              SHA1

              a3b804db0726191408db0dd6fd82c8d8bd5722d0

              SHA256

              d7282f411b6f68f5c3a1657eb37a0f550d9d966a169b9290043d9e93b5f18ba3

              SHA512

              4f852216ca25459b2e2f2961d8a7acb011cccbe712a3eb54677967b92ecb9289a4770de3b7716a52f96aa33233b04607e63070e00a5c05fae078e399b3d1d9fe

            • \Users\Admin\AppData\Local\Temp\080301.tmp

              Filesize

              546.7MB

              MD5

              4f214becc5f8ac8bd13adef8437f7002

              SHA1

              a3b804db0726191408db0dd6fd82c8d8bd5722d0

              SHA256

              d7282f411b6f68f5c3a1657eb37a0f550d9d966a169b9290043d9e93b5f18ba3

              SHA512

              4f852216ca25459b2e2f2961d8a7acb011cccbe712a3eb54677967b92ecb9289a4770de3b7716a52f96aa33233b04607e63070e00a5c05fae078e399b3d1d9fe

            • memory/636-1271-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/1248-93-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-97-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-85-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-84-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-83-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-89-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-90-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-91-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-92-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-94-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB

            • memory/1248-96-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-95-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-86-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-98-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-121-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-163-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-168-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-205-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-88-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-1077-0x0000000005EC0000-0x0000000005EC1000-memory.dmp

              Filesize

              4KB

            • memory/1248-87-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-79-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-80-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-81-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1248-1270-0x0000000005EC0000-0x0000000005EC1000-memory.dmp

              Filesize

              4KB

            • memory/1248-82-0x00000000003F0000-0x00000000004F0000-memory.dmp

              Filesize

              1024KB

            • memory/1972-1264-0x00000000001A0000-0x00000000001A1000-memory.dmp

              Filesize

              4KB