Analysis

  • max time kernel
    23s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2023, 09:45

General

  • Target

    1.doc

  • Size

    516.3MB

  • MD5

    c2ba98ea49f3d5f5b04d7980ed36b75d

  • SHA1

    0b66f823f6edf03c3992d9265a43aa5ffa24938a

  • SHA256

    1e041bead6abf833504e173d6b1026ee766bfef84635a7d222e520a673d8896c

  • SHA512

    108011d99c013c97e462cb1792a8e5de1a1ebdccd5073acc2c5ac08dc8fcca0acd20eb0bfd37850721a46dffdf54d88bfac59aca6399dda8e4ee53434796e365

  • SSDEEP

    6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1.doc"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1980
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\094651.tmp"
      2⤵
      • Process spawned unexpected child process
      PID:1736
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Users\Admin\AppData\Local\Temp\094651.tmp"
        3⤵
          PID:468
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YhLsgkKrtjtM\EQOiPJHyYqkwRYo.dll"
            4⤵
              PID:1908
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          2⤵
            PID:1044

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\094651.tmp

                Filesize

                410.9MB

                MD5

                7475c86d57ee370f2cf2d9c30908ca7c

                SHA1

                16fcb70a6d7289bb778d416e1f0d645fd1f6dac0

                SHA256

                6356816e8a8a9ffd4d32f96bec65000e4ac7d7d7088e0f08ed98b749289de5dd

                SHA512

                5d6a50b9eb3e6bc6b0cd0eb7cf12f1a5e4547b6fdbc5822580cfb9d1273725cc4d985494e97d1789b7cf8892f3f2031adaf7df6a3a72be8011f47469f9dc3642

              • C:\Users\Admin\AppData\Local\Temp\094654.zip

                Filesize

                852KB

                MD5

                b68294947488080ff0a99def9ed22c4b

                SHA1

                8bf91771e28c84adb2ad80e92e9d4e13e6c52b6c

                SHA256

                ae869a73754e3cd48c17ca12821abf2d188aeea7603b412f4fc7d5d0b6b2d9a3

                SHA512

                68943596f0cac042deddd5893aba1d625cb2420238f858b5a0a372c932228e4fc7f4a0ca9cb1fe84852949137c40192058659ed058f2c0b5d7b1730448d2ad41

              • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

                Filesize

                20KB

                MD5

                625678b0a890a9773350e53fbb5b2c00

                SHA1

                b1a6da6c2cc1f7f93192a66320097d4a187477f9

                SHA256

                61a19c93664059a9ed0dc660a5dbde02a95b3a601e3e152bb278a5870603430e

                SHA512

                208bd5b04087f98ada5b1f4a2f8b6ff7560199df0f4658c7a3e55a096f22a74b1f9a22f5335194c5212a13c77100e4c5f6550f71f2f846121ec962812d991b4b

              • \Users\Admin\AppData\Local\Temp\094651.tmp

                Filesize

                481.0MB

                MD5

                981e9024ce2d688158194e94a6124d39

                SHA1

                7b8f552e0d1234faa44c542fce6dd36f8234db35

                SHA256

                f7fd2b56bd4d42c441641e4408beb6803005cf7e5faa84269af8c80ea0cfb0b5

                SHA512

                ab1ced44a1f5a22f05bb24259b7cd5ae7853bdb21339972ecf2cb2217a4dfe6d5f932a3a04bebed0473038e14b932a6f85639e19f2f86f2cc3321e2cbbbfc1ff

              • \Users\Admin\AppData\Local\Temp\094651.tmp

                Filesize

                495.9MB

                MD5

                688a29f6cd1173e6678f32c3da53f1d1

                SHA1

                55951768617fff688d8b4266283befb826602831

                SHA256

                3a547e0c80968626f2d6603bcbf7c16d5d99c78c74a8adf1bf99c053666b3492

                SHA512

                66f5e87899705151da7aff57cef3fe58f9b6f2919659f01a5f04e086a1447a41df34891938148c84efe783ffb7b5aeb49131365d2df06a662a191d2ee432dd1f

              • memory/468-1264-0x0000000000120000-0x0000000000121000-memory.dmp

                Filesize

                4KB

              • memory/1908-1271-0x00000000002F0000-0x00000000002F1000-memory.dmp

                Filesize

                4KB

              • memory/1980-73-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-75-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-65-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-67-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-66-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-68-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-69-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-72-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-74-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

                Filesize

                64KB

              • memory/1980-71-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-78-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-77-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-64-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-76-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-70-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-99-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-109-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-141-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-63-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-1077-0x0000000006060000-0x0000000006061000-memory.dmp

                Filesize

                4KB

              • memory/1980-62-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-60-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-61-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-59-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-1270-0x0000000006060000-0x0000000006061000-memory.dmp

                Filesize

                4KB

              • memory/1980-58-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB

              • memory/1980-57-0x0000000000630000-0x0000000000730000-memory.dmp

                Filesize

                1024KB