Analysis

  • max time kernel
    146s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    19-03-2023 10:58

General

  • Target

    Mail_17032023.doc

  • Size

    545.3MB

  • MD5

    c81c9c01882f96abdcfa92ee9f31a3b1

  • SHA1

    682ec88a99317a68027b9d6a68cfbf84a17606af

  • SHA256

    406ffd16cec91bb6f53e27623c096a4a6bb060ff5ab52d45e6e6ae864dbcc8a3

  • SHA512

    d3b4e663f8e7134825e6b9d27fc8dada8e470cb82e27cc04d4248c5d279261036c42281773814581671f33558833e1ecb2932d14dff5ba811e6111eb08d6b520

  • SSDEEP

    6144:ip32/gDd0Nmt71wFmSWjfDrV8YQnZocbyrX4NqclWL9:ip32SEmtJwFmhjfPtrXqqyW

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file
  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Mail_17032023.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1840
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\115925.tmp"
        2⤵
        • Process spawned unexpected child process
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:536
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Users\Admin\AppData\Local\Temp\115925.tmp"
          3⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1804
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KPIfpfnqMQQPh\HUmCanOeOcHbO.dll"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1508

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\115925.tmp
      Filesize

      561KB

      MD5

      c901c8089c5e017f8e9b4b15c8ef154f

      SHA1

      336c2bea43bfa2e8afd27a164dba640f36c0013c

      SHA256

      fd79e8fa5e3801101a1305b6aba7a5e7fdc852ed9036d6d9a5210be414a5cc5a

      SHA512

      9ff052f9fc9cc3cf74b170f76d6a20a01c5dbb74b2d97edc9e55b75f52b408f3104e49bf290773bd63d216f2787d945aa7d954b58e927c99e1db18c6a7d74ade

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      c5baa4c6b8c370ef1a585662e21c2ccb

      SHA1

      a36d8c12e3c4820d8c47d7a85e6e4e8d9aa26703

      SHA256

      bc5b6ca24f3c68d25cfdaf83075450e2904f113c490967def0566cd2cd681edc

      SHA512

      fa637bf5639fffb3ab5aba64591d1dc94281a8c385690d76eafeb59fdacbd9481e925a58a045d9a570d7f7dd27b2f52dbc252d0dbea1692c0f1183f25326f6c7

    • \Users\Admin\AppData\Local\Temp\115925.tmp
      Filesize

      561KB

      MD5

      c901c8089c5e017f8e9b4b15c8ef154f

      SHA1

      336c2bea43bfa2e8afd27a164dba640f36c0013c

      SHA256

      fd79e8fa5e3801101a1305b6aba7a5e7fdc852ed9036d6d9a5210be414a5cc5a

      SHA512

      9ff052f9fc9cc3cf74b170f76d6a20a01c5dbb74b2d97edc9e55b75f52b408f3104e49bf290773bd63d216f2787d945aa7d954b58e927c99e1db18c6a7d74ade

    • \Users\Admin\AppData\Local\Temp\115925.tmp
      Filesize

      561KB

      MD5

      c901c8089c5e017f8e9b4b15c8ef154f

      SHA1

      336c2bea43bfa2e8afd27a164dba640f36c0013c

      SHA256

      fd79e8fa5e3801101a1305b6aba7a5e7fdc852ed9036d6d9a5210be414a5cc5a

      SHA512

      9ff052f9fc9cc3cf74b170f76d6a20a01c5dbb74b2d97edc9e55b75f52b408f3104e49bf290773bd63d216f2787d945aa7d954b58e927c99e1db18c6a7d74ade

    • memory/1684-54-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1684-59-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-58-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-60-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-61-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-63-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-62-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-65-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-64-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-66-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-67-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-69-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-68-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-70-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-72-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-71-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-74-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-73-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-76-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-75-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-78-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-77-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-80-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-81-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-79-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-82-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-83-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-84-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-85-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-86-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-88-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-87-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-89-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-90-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-91-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-92-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-93-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-94-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-95-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-97-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-96-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-98-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-99-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-100-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-101-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-102-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-103-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-104-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-105-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-106-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-107-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-108-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-109-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-110-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-111-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-113-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-112-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-115-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-114-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-116-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-117-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1684-118-0x00000000005A0000-0x00000000006A0000-memory.dmp
      Filesize

      1024KB

    • memory/1804-1446-0x00000000001B0000-0x00000000001B1000-memory.dmp
      Filesize

      4KB