Resubmissions

15-03-2023 22:24

230315-2bkk7ahh2v 10

15-03-2023 22:11

230315-139tqafe65 10

15-03-2023 22:08

230315-12bwashg4t 4

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-03-2023 22:24

General

  • Target

    1603.one

  • Size

    130KB

  • MD5

    3267ae8154776913b0032a6806fdb9c3

  • SHA1

    9bcc9835656c3e7ab5a08476e604cfea8ee1b6b1

  • SHA256

    fe983efbd9760c4875fd711062dd94d91c9e31c1a5fc47d288ef72ba6c913266

  • SHA512

    2d1904620234b26a0dd85e78c6643f6e15d89d4b5b3a33db926b7485873ba89e20008fa6ddadb8e85f693c4bfcb6b82d75acbecdbf0b9654800643d8ce405606

  • SSDEEP

    3072:PrfWMINYf3K19kzCnEEQvSMVnte8ZP1Y6J0cTgGQ:d6nInM8TXJ5Q

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 12 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Script User-Agent 12 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "C:\Users\Admin\AppData\Local\Temp\1603.one"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:544
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{01625E5F-3F70-4A7F-B69B-D849E0854F9A}\NT\0\click.wsf"
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      PID:2576
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 444 -p 3324 -ip 3324
    1⤵
      PID:4860
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3324 -s 2640
      1⤵
      • Program crash
      PID:2692

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BL.bin
      Filesize

      61KB

      MD5

      45282862aeb428ffb5d4986704a8f4d5

      SHA1

      fa2b0a82f3ca6bc7c00704556c9494b303613972

      SHA256

      af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e

      SHA512

      db6457af502f45665ce4cc6573c5746607d8ffc661f0dcb224beceed93886f6c6194561cacc0efa543f0b2f62db976742f42c6c8102c5b11b65329757110b1db

    • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BM.bin
      Filesize

      48KB

      MD5

      b7fc313714edd7866f4c76527282c2b5

      SHA1

      c86217b46956933fae4a30483a63b33f34b8c503

      SHA256

      b6d25f5eb52d5c24ef6c325bd25f18e413f3e23d20413a3693749275ba4b192c

      SHA512

      038a73b7a69dd976c964f1538f5b4f7c6c64721e4f2f1a831815598faae84cac53305c03f5cea6e66acdc110a9a5117eee191345ea004b9576c752122f8d88f7

    • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BN.bin
      Filesize

      567B

      MD5

      d055ce625528e448c61315eaaef5bb71

      SHA1

      029df4c872b1c154f32e7fe94f434547c3ba6192

      SHA256

      85bf1e672b4e86e9af0c7874681ec9620dfdc78e0335b83eef38c17d813b6705

      SHA512

      705b6b729e967fa946469571109aa892f5cb55a01c74d40ae02140d10cbf9b65dd5e511c06ebfe494e407742f8c6f4fbbe88664b78b37abfb2f19db1f66f4247

    • C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{01625E5F-3F70-4A7F-B69B-D849E0854F9A}\NT\0\click.wsf
      Filesize

      61KB

      MD5

      45282862aeb428ffb5d4986704a8f4d5

      SHA1

      fa2b0a82f3ca6bc7c00704556c9494b303613972

      SHA256

      af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e

      SHA512

      db6457af502f45665ce4cc6573c5746607d8ffc661f0dcb224beceed93886f6c6194561cacc0efa543f0b2f62db976742f42c6c8102c5b11b65329757110b1db

    • C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{01625E5F-3F70-4A7F-B69B-D849E0854F9A}\NT\0\radB6317.tmp.dll
      Filesize

      10B

      MD5

      7605968e79d0ca095ab1231486d2b814

      SHA1

      a007b420d19ceefa840f0373e050e3b51a4ab480

      SHA256

      493fda53120050f85836032324409be6c6484f90a0755ae0c6a673ba7626818b

      SHA512

      769249da7ed6c6bf5671bbc2371a6453b433226ceb8c4c2aa3604000d66647bcec83dee1ab64c0262fa40f923d77e23bad2c47274d339effc51d904ce77072a6

    • memory/544-133-0x00007FFB89930000-0x00007FFB89940000-memory.dmp
      Filesize

      64KB

    • memory/544-134-0x00007FFB89930000-0x00007FFB89940000-memory.dmp
      Filesize

      64KB

    • memory/544-135-0x00007FFB89930000-0x00007FFB89940000-memory.dmp
      Filesize

      64KB

    • memory/544-136-0x00007FFB89930000-0x00007FFB89940000-memory.dmp
      Filesize

      64KB

    • memory/544-137-0x00007FFB89930000-0x00007FFB89940000-memory.dmp
      Filesize

      64KB

    • memory/544-138-0x00007FFB878D0000-0x00007FFB878E0000-memory.dmp
      Filesize

      64KB

    • memory/544-139-0x00007FFB878D0000-0x00007FFB878E0000-memory.dmp
      Filesize

      64KB