Resubmissions

21-03-2023 15:02

230321-sepjwabf44 8

21-03-2023 13:19

230321-qkn47acd8w 8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    21-03-2023 13:19

General

  • Target

    e61ad1ca19a69d4c85b91d8b7b69cf08413fd78fd7df1c878a10a4c5b4497b9e.docm

  • Size

    35KB

  • MD5

    c47bba8a8821ace4dec8e4a83bcf5d86

  • SHA1

    7ca510812ddbfb4be6ce3506143e0ed9ac92c5e7

  • SHA256

    e61ad1ca19a69d4c85b91d8b7b69cf08413fd78fd7df1c878a10a4c5b4497b9e

  • SHA512

    81d6ec5ff3610a1770b0f3030fbf6ac3438d8e58ab17092b94c4bdf0cb2466a2c200d4d8d6405364dbd127dc2ca04e7c3eb61d92a0b073d04e2b13b7939e3f23

  • SSDEEP

    768:pIBkgj8RxAQkGbPcyqy81pTxllNBujX/2NW:Uj8RXkGwyRepTBOruE

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e61ad1ca19a69d4c85b91d8b7b69cf08413fd78fd7df1c878a10a4c5b4497b9e.docm"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Users\Admin\AppData\Local\Temp\rad440A9.tmp.exe
      rad440A9.tmp.exe
      2⤵
      • Executes dropped EXE
      PID:108
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1824

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\rad440A9.tmp.exe
      Filesize

      1.8MB

      MD5

      15df6ef5f388e706ab46675c00185ae4

      SHA1

      62b0e6473f98470d25a16a2a2d96095570403670

      SHA256

      1e27243ac8e2edff7d5be32a012530add1bae71ad5452064dfcd35e69d95f313

      SHA512

      34578d2a61629ea8e14a8ae8dfa86c608f84b7928aa15535b1250270122439b46d173153b993178d3352d9f49eeff80ed3c0d9efef70acf149666ce9a68fb659

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      505da863baa677bcd791fba789f96c9b

      SHA1

      9f2f1677aab94d6a8e940d67b4976950b17c6d5e

      SHA256

      5ae4b4bde44f0e7efca4fdcbf2133132b0a58e9ecfc5a2caa0b0677e19003652

      SHA512

      3b7569aa55401dfa148bcec8e57bae27458d5eb213438da2a8c7fcaab6702b28a0bfb8907f8bcadba745aa43cc814fce3a45deaaf819f4eca1a7e1fef79bcede

    • \Users\Admin\AppData\Local\Temp\rad440A9.tmp.exe
      Filesize

      1.8MB

      MD5

      15df6ef5f388e706ab46675c00185ae4

      SHA1

      62b0e6473f98470d25a16a2a2d96095570403670

      SHA256

      1e27243ac8e2edff7d5be32a012530add1bae71ad5452064dfcd35e69d95f313

      SHA512

      34578d2a61629ea8e14a8ae8dfa86c608f84b7928aa15535b1250270122439b46d173153b993178d3352d9f49eeff80ed3c0d9efef70acf149666ce9a68fb659

    • \Users\Admin\AppData\Local\Temp\rad440A9.tmp.exe
      Filesize

      1.8MB

      MD5

      15df6ef5f388e706ab46675c00185ae4

      SHA1

      62b0e6473f98470d25a16a2a2d96095570403670

      SHA256

      1e27243ac8e2edff7d5be32a012530add1bae71ad5452064dfcd35e69d95f313

      SHA512

      34578d2a61629ea8e14a8ae8dfa86c608f84b7928aa15535b1250270122439b46d173153b993178d3352d9f49eeff80ed3c0d9efef70acf149666ce9a68fb659

    • memory/108-135-0x0000000000130000-0x0000000000649000-memory.dmp
      Filesize

      5.1MB

    • memory/108-121-0x0000000000130000-0x0000000000649000-memory.dmp
      Filesize

      5.1MB

    • memory/1760-100-0x0000000000710000-0x0000000000810000-memory.dmp
      Filesize

      1024KB

    • memory/1760-101-0x0000000000710000-0x0000000000810000-memory.dmp
      Filesize

      1024KB

    • memory/1760-103-0x0000000000710000-0x0000000000810000-memory.dmp
      Filesize

      1024KB

    • memory/1760-104-0x0000000000710000-0x0000000000810000-memory.dmp
      Filesize

      1024KB

    • memory/1760-105-0x0000000000710000-0x0000000000810000-memory.dmp
      Filesize

      1024KB

    • memory/1760-107-0x0000000000710000-0x0000000000810000-memory.dmp
      Filesize

      1024KB

    • memory/1760-106-0x0000000000710000-0x0000000000810000-memory.dmp
      Filesize

      1024KB

    • memory/1760-108-0x0000000000710000-0x0000000000810000-memory.dmp
      Filesize

      1024KB

    • memory/1760-109-0x0000000000710000-0x0000000000810000-memory.dmp
      Filesize

      1024KB

    • memory/1760-111-0x00000000071D0000-0x0000000007210000-memory.dmp
      Filesize

      256KB

    • memory/1760-54-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1760-102-0x0000000000710000-0x0000000000810000-memory.dmp
      Filesize

      1024KB

    • memory/1760-99-0x0000000000710000-0x0000000000810000-memory.dmp
      Filesize

      1024KB

    • memory/1760-119-0x000000000ADE0000-0x000000000B2F9000-memory.dmp
      Filesize

      5.1MB

    • memory/1760-120-0x000000000ADE0000-0x000000000B2F9000-memory.dmp
      Filesize

      5.1MB

    • memory/1760-98-0x0000000000710000-0x0000000000810000-memory.dmp
      Filesize

      1024KB

    • memory/1760-125-0x00000000071D0000-0x0000000007210000-memory.dmp
      Filesize

      256KB

    • memory/1760-130-0x000000000ADE0000-0x000000000B2F9000-memory.dmp
      Filesize

      5.1MB

    • memory/1760-97-0x0000000000710000-0x0000000000810000-memory.dmp
      Filesize

      1024KB

    • memory/1760-96-0x0000000000710000-0x0000000000810000-memory.dmp
      Filesize

      1024KB

    • memory/1760-160-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB