Analysis

  • max time kernel
    144s
  • max time network
    160s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    19-03-2023 12:06

General

  • Target

    3861_97384.doc

  • Size

    534.4MB

  • MD5

    cf3838fc76086249c9c58b7112739152

  • SHA1

    42461186f63f10eeaba8979339c536b83668afbe

  • SHA256

    ecb30e7fe7b8c6c8267be45cfaea5adb0d1954f116d7cc57400b21027ff16585

  • SHA512

    0b89a5a81eac54728b8b88a99d7b049fd2881da4a8740f6fb3ad144488f86666764e069864c18b969a81c840322bab70cb17b5629bdf6ec2b69109621488b60f

  • SSDEEP

    6144:zZRtBPT4N/uQaNULlPUvauNTklB7ShcbYdFf8UOPv:zZvJhfKd2amwYdKUq

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file
  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\3861_97384.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:920
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\130810.tmp"
        2⤵
        • Process spawned unexpected child process
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1916
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Users\Admin\AppData\Local\Temp\130810.tmp"
          3⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1252
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CjzMUKiMTPDzPuXS\zxCKwQhdDUAFFAB.dll"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:952

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\130810.tmp
      Filesize

      561KB

      MD5

      c901c8089c5e017f8e9b4b15c8ef154f

      SHA1

      336c2bea43bfa2e8afd27a164dba640f36c0013c

      SHA256

      fd79e8fa5e3801101a1305b6aba7a5e7fdc852ed9036d6d9a5210be414a5cc5a

      SHA512

      9ff052f9fc9cc3cf74b170f76d6a20a01c5dbb74b2d97edc9e55b75f52b408f3104e49bf290773bd63d216f2787d945aa7d954b58e927c99e1db18c6a7d74ade

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      0ea358a37fd830a8bc151ff7d9738f59

      SHA1

      ab444744f5dd62e9fc897d40aee305b0b040b4c2

      SHA256

      54cb7fe728cdd8bbf5f546c0953d35f95b1255eb0cf33a91d06d9815716ff068

      SHA512

      2bb3fb6dd954f4d34f09116fa5c3f555c5ad7399bcc284c7c477a001f3d1425ee155416fc0f0680b9eaa1342b33c93088f276f98208e8577b161760beacff0e5

    • \Users\Admin\AppData\Local\Temp\130810.tmp
      Filesize

      561KB

      MD5

      c901c8089c5e017f8e9b4b15c8ef154f

      SHA1

      336c2bea43bfa2e8afd27a164dba640f36c0013c

      SHA256

      fd79e8fa5e3801101a1305b6aba7a5e7fdc852ed9036d6d9a5210be414a5cc5a

      SHA512

      9ff052f9fc9cc3cf74b170f76d6a20a01c5dbb74b2d97edc9e55b75f52b408f3104e49bf290773bd63d216f2787d945aa7d954b58e927c99e1db18c6a7d74ade

    • \Users\Admin\AppData\Local\Temp\130810.tmp
      Filesize

      561KB

      MD5

      c901c8089c5e017f8e9b4b15c8ef154f

      SHA1

      336c2bea43bfa2e8afd27a164dba640f36c0013c

      SHA256

      fd79e8fa5e3801101a1305b6aba7a5e7fdc852ed9036d6d9a5210be414a5cc5a

      SHA512

      9ff052f9fc9cc3cf74b170f76d6a20a01c5dbb74b2d97edc9e55b75f52b408f3104e49bf290773bd63d216f2787d945aa7d954b58e927c99e1db18c6a7d74ade

    • memory/1252-1055-0x0000000000120000-0x0000000000121000-memory.dmp
      Filesize

      4KB

    • memory/1520-93-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-97-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-86-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-87-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-88-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-90-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-89-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-91-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-92-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-54-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1520-94-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-95-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-96-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-85-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-98-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-99-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-100-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-123-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-168-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-166-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-84-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-82-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-83-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-81-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB

    • memory/1520-80-0x0000000000810000-0x0000000000910000-memory.dmp
      Filesize

      1024KB