Analysis

  • max time kernel
    22s
  • max time network
    87s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2023, 09:39

General

  • Target

    K-1 03.07.2023.doc

  • Size

    527.2MB

  • MD5

    fd37aece5d1c1538fdaab4b4fa1fa16a

  • SHA1

    101fbc6beec580efc3582c7f619c711e9fb6d385

  • SHA256

    d9988c6dcd1c169af8db5bc3c363f18f66501a63dd9fc1b671ad32f5de359472

  • SHA512

    99cc15b540873054513d9f3fb13b250b253ab77ca83c45b350af17d04572b76db67c5f176627aaa8741113bc26d6890a15bde794557065dc9c341a65a4c13fb0

  • SSDEEP

    3072:eoEW2aOtFjH0lP2IpjctfRcVVwEi/A8NVM1wIOCbX6bYLjWFJuvx7ueK6:ZE1aOtFa2I9c3aVw4zwxCbJ4Jup

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\K-1 03.07.2023.doc"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1692
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\094022.tmp"
      2⤵
      • Process spawned unexpected child process
      PID:836
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Users\Admin\AppData\Local\Temp\094022.tmp"
        3⤵
          PID:1220
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WRzVwkmp\bLyMZs.dll"
            4⤵
              PID:840
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          2⤵
            PID:1540

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\094022.tmp

                Filesize

                482.4MB

                MD5

                b92a5ad2eda2b86cc23f5ba3073d12b9

                SHA1

                02bad075709052d89695ad63cd1de9b387fb5485

                SHA256

                1caf1e6087e1b90fb3b9937ae7d6c667c6c20cf2663dbd226d1184a41d4edc8a

                SHA512

                eca9a6249f21f8296ef38c47baf4d78d06b484fabceb6c7a3f6b9f30ae6591b10b7fac1714cf5b302b299500ecaa8b072eceafb1342aac42e334df5aa8eecfc3

              • C:\Users\Admin\AppData\Local\Temp\094030.zip

                Filesize

                878KB

                MD5

                e4ca5ade365a549639456e7002246f22

                SHA1

                f07d577919e7a34eda0e55d2b249248384da4b0c

                SHA256

                dc7832d51eed30c96cb7ea377dc59753c1fe13fd7745a3530c95422ca1e4d760

                SHA512

                caa1d75ad6b8acd990e6ec0fa4c7a39b7a55d7c75394ef258ef1ea9a18e8c6855cff261946d5d0985d981541a343cd072b5d7a5f72388ccc5b683e9ef2fc7e26

              • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

                Filesize

                20KB

                MD5

                ec0092800a0dfb05f51ce86a13716c62

                SHA1

                4d0b346c8d6a0fa6b69b732eef1106adcd68296b

                SHA256

                0353bae2fb100caf995c8d530a72d4f49dc86a75ef0867e5d83316d08450385d

                SHA512

                33e3572a33c6c63ef732be662ab865cc9ef99f694a8f0cdc08db6b7606a8526004e6f0a553109015c9c28d14045e8dff9e7ecd1fc92af6cbeea9c4ab3f084a87

              • \Users\Admin\AppData\Local\Temp\094022.tmp

                Filesize

                492.8MB

                MD5

                1557a4c53d8aff5a54446d1583a1adea

                SHA1

                b9d1b3db08a931da3b014e34509e21a0f9937f18

                SHA256

                7a1230940384c0bd4ed88271b69199c8c2f955a6e16100b8bb07ca7b6af88894

                SHA512

                11f07702e74785a5dc8e0e1d9635e7f7bef48c13a0f1909d1a44bf45aedc840f4f9553d8fd53d039a775191d24764e9fcde9df67ec27398fccca7ea9fa49cac0

              • \Users\Admin\AppData\Local\Temp\094022.tmp

                Filesize

                447.5MB

                MD5

                b2071905e0368d2032f42c1f623717df

                SHA1

                9361ba1d15f21ffba765c8f408ac544d63a65d4d

                SHA256

                17592b849c9aad6f0a67b07ad591db08c357d392f43fc149b01cc5ec0649059a

                SHA512

                cec274f566720823d314330080d8cb4bf5921634c121acf2ec36ce93f6d19fb90e12ea65757d9a7960e2b5812c45af38ce84202fea7c1d9fd45a31633a0615ca

              • memory/840-848-0x0000000000130000-0x0000000000131000-memory.dmp

                Filesize

                4KB

              • memory/1220-847-0x00000000000B0000-0x00000000000B1000-memory.dmp

                Filesize

                4KB

              • memory/1692-268-0x0000000000640000-0x0000000000740000-memory.dmp

                Filesize

                1024KB

              • memory/1692-352-0x0000000000640000-0x0000000000740000-memory.dmp

                Filesize

                1024KB

              • memory/1692-187-0x0000000000640000-0x0000000000740000-memory.dmp

                Filesize

                1024KB

              • memory/1692-214-0x0000000000640000-0x0000000000740000-memory.dmp

                Filesize

                1024KB

              • memory/1692-241-0x0000000000640000-0x0000000000740000-memory.dmp

                Filesize

                1024KB

              • memory/1692-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

                Filesize

                64KB

              • memory/1692-295-0x0000000000640000-0x0000000000740000-memory.dmp

                Filesize

                1024KB

              • memory/1692-322-0x0000000000640000-0x0000000000740000-memory.dmp

                Filesize

                1024KB

              • memory/1692-349-0x0000000000640000-0x0000000000740000-memory.dmp

                Filesize

                1024KB

              • memory/1692-160-0x0000000000640000-0x0000000000740000-memory.dmp

                Filesize

                1024KB

              • memory/1692-376-0x0000000000640000-0x0000000000740000-memory.dmp

                Filesize

                1024KB

              • memory/1692-403-0x0000000000640000-0x0000000000740000-memory.dmp

                Filesize

                1024KB

              • memory/1692-133-0x0000000000640000-0x0000000000740000-memory.dmp

                Filesize

                1024KB

              • memory/1692-106-0x0000000000640000-0x0000000000740000-memory.dmp

                Filesize

                1024KB

              • memory/1692-79-0x0000000000640000-0x0000000000740000-memory.dmp

                Filesize

                1024KB

              • memory/1692-83-0x0000000000640000-0x0000000000740000-memory.dmp

                Filesize

                1024KB

              • memory/1692-82-0x0000000000640000-0x0000000000740000-memory.dmp

                Filesize

                1024KB

              • memory/1692-80-0x0000000000640000-0x0000000000740000-memory.dmp

                Filesize

                1024KB

              • memory/1692-81-0x0000000000640000-0x0000000000740000-memory.dmp

                Filesize

                1024KB