Analysis

  • max time kernel
    111s
  • max time network
    100s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2023, 09:09

General

  • Target

    698904922815716351.doc

  • Size

    524.8MB

  • MD5

    33a26f690f19421e49cd0927921205e2

  • SHA1

    190752c02cd33244f631b2b0f1d389b283c2ec86

  • SHA256

    673bc1c81390a70de56e11ce2384b0975631e29b6392be97f17e6a76b7e36d7b

  • SHA512

    dd574e5f1086a80f31203d73b22040e0879dba4d07006b4f985b4e3f960d8cc039992a8d0a35cde42d15c51b9cb588c8764f0438ffa20ecf5fba269cab513ee6

  • SSDEEP

    12288:XxYDQ8EW+Ba+qKYR08a72L2X0dMzPPqvBUEu3uNsRAPYwT4q3MJ/d:2DPElaSUqqafj9Q4ZJ/d

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\698904922815716351.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\101057.tmp"
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1904
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Users\Admin\AppData\Local\Temp\101057.tmp"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:612
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CotiNmwpPVsxT\DNXkDgkZ.dll"
          4⤵
            PID:884
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        2⤵
          PID:1264

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

              Filesize

              61KB

              MD5

              e71c8443ae0bc2e282c73faead0a6dd3

              SHA1

              0c110c1b01e68edfacaeae64781a37b1995fa94b

              SHA256

              95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

              SHA512

              b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              0adc2ef9fd46c31f3e8959a23c1bd69a

              SHA1

              4a4b489504a3c10b1b1480c3783b6c2a8ebdf4db

              SHA256

              bccd0f3e0e0af5e45b115f00dfa5cdf6b98627a1a86351daddc76dcc9ccce5af

              SHA512

              53dbbc7b329f2de6671056c27d354e8208b0941d7f0cd0d18e9ed1f09b64949b3403ee1852ae864c573976bc1d3ada8269d4bcdd362af0c77d79b1f7e0486bc0

            • C:\Users\Admin\AppData\Local\Temp\101057.tmp

              Filesize

              504.7MB

              MD5

              69a5d6bff7916e89328735d6dfeb1969

              SHA1

              9b08a294c6f0c6cf91c023f8314a4434c23e0fd2

              SHA256

              d8b45395fabe03155050debe2c8669ebc3a38f0d151143129f4361d5dbf51616

              SHA512

              cb259efd4cd1824385e990b2bdedff62254e68655aa8cdf1b3f622a7c7047993980fd5f813bcf16e3efa6cd68ac4aeae07f2bbf0f848faf4389fbac137be1749

            • C:\Users\Admin\AppData\Local\Temp\101108.zip

              Filesize

              840KB

              MD5

              98f2c28db3044c0bb4f6532b4f63271a

              SHA1

              c7e464ad78ddc97d00f6bd5a25c463c4c4a693a9

              SHA256

              c0cc58370e1c362fb98653d01a3b36018775602ef2f115ca2ece20257f0e9aa2

              SHA512

              f0da48722a4d8fd2fc714e845b90de3727ff6d623054ca8dc23c319f2b1b2c31ff700a121cd0437cf8748cd8cb8df05c9698de88c66b74ba989fad89ea6877b1

            • C:\Users\Admin\AppData\Local\Temp\Cab5027.tmp

              Filesize

              61KB

              MD5

              fc4666cbca561e864e7fdf883a9e6661

              SHA1

              2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

              SHA256

              10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

              SHA512

              c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

            • C:\Users\Admin\AppData\Local\Temp\Tar53C6.tmp

              Filesize

              161KB

              MD5

              be2bec6e8c5653136d3e72fe53c98aa3

              SHA1

              a8182d6db17c14671c3d5766c72e58d87c0810de

              SHA256

              1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

              SHA512

              0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

            • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

              Filesize

              20KB

              MD5

              0785720aaa4c554fe82b8e4340c0229d

              SHA1

              8dd5f574eb5ff5c6d7b28a9cfd4d1a199adb01a3

              SHA256

              dd06b642bf5e6e2fcf5c7e1ea80d169e3c374131272232f8c298222cca07a430

              SHA512

              048383ea387385f854d02fdb8962fe227dafd62cba310a2f8ac72cdaabc2f752348e4e17258c5ec62bc5be694d9020fdfe5e33649b9f8c268de9b870ec90ea99

            • \Users\Admin\AppData\Local\Temp\101057.tmp

              Filesize

              504.7MB

              MD5

              69a5d6bff7916e89328735d6dfeb1969

              SHA1

              9b08a294c6f0c6cf91c023f8314a4434c23e0fd2

              SHA256

              d8b45395fabe03155050debe2c8669ebc3a38f0d151143129f4361d5dbf51616

              SHA512

              cb259efd4cd1824385e990b2bdedff62254e68655aa8cdf1b3f622a7c7047993980fd5f813bcf16e3efa6cd68ac4aeae07f2bbf0f848faf4389fbac137be1749

            • \Users\Admin\AppData\Local\Temp\101057.tmp

              Filesize

              504.7MB

              MD5

              69a5d6bff7916e89328735d6dfeb1969

              SHA1

              9b08a294c6f0c6cf91c023f8314a4434c23e0fd2

              SHA256

              d8b45395fabe03155050debe2c8669ebc3a38f0d151143129f4361d5dbf51616

              SHA512

              cb259efd4cd1824385e990b2bdedff62254e68655aa8cdf1b3f622a7c7047993980fd5f813bcf16e3efa6cd68ac4aeae07f2bbf0f848faf4389fbac137be1749

            • memory/612-1694-0x0000000000120000-0x0000000000121000-memory.dmp

              Filesize

              4KB

            • memory/2044-84-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-91-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-64-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-62-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-65-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-66-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-67-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-68-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-69-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-70-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-71-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-73-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-72-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-74-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-78-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-77-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-76-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-75-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-82-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-83-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-81-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-80-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-79-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-85-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-60-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-88-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-87-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-86-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-89-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-63-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-92-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-90-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-93-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-94-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-95-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-96-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-98-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-97-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-100-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-99-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-101-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-102-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-103-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-104-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-105-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-106-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-107-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-108-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-109-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-111-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-110-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-112-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-1455-0x0000000006280000-0x0000000006281000-memory.dmp

              Filesize

              4KB

            • memory/2044-61-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-59-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-58-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-57-0x0000000000690000-0x0000000000790000-memory.dmp

              Filesize

              1024KB

            • memory/2044-1700-0x0000000006280000-0x0000000006281000-memory.dmp

              Filesize

              4KB

            • memory/2044-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB