Analysis

  • max time kernel
    102s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    22-03-2023 16:17

General

  • Target

    2023-03-22_0820.doc

  • Size

    207KB

  • MD5

    ca35c5ec8c75acc2c9ba7c19076ade0d

  • SHA1

    ca31df8e4d94ed1d9648f103462f11988e87e77b

  • SHA256

    f72c3339a6ce6a8ba0fe430773d99e890d19d54357d14e838501bfea0b1cb2f1

  • SHA512

    6b51039c707b2f89f495d94b49c2cb3d57132bc333933687e3e7c598aa2b6ee9132c6e4863b92f52ac78227e6e515b8ee0bc6a414e2e2f5aa06f499dfa0da218

  • SSDEEP

    3072:r43Tj6XFk1R81XNvvMGSsLyVwy+WNX3pMwwrnYD5LPfF:r43T2N++WF3KfrYD5LPfF

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2023-03-22_0820.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1408
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\171717.tmp"
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1608
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Users\Admin\AppData\Local\Temp\171717.tmp"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:808
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PGPXRswgSY\yyPqMGiUkaJSRRZ.dll"
          4⤵
            PID:1988
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        2⤵
          PID:948

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\171717.tmp

        Filesize

        532.9MB

        MD5

        7291fb9bc7cccec7e9688247e80bf297

        SHA1

        63ebf96550a6e38539de9e9cbbe976a5855675a4

        SHA256

        bbaa295c4c2882f357aca0f1f9b6032523431c1e4dd98c998e5e06484f594694

        SHA512

        6dcf445f45e1571f15900d93523d220b9dc6c502ed712a65d173dde7b46c869cf0899c7b21d8de5bf5f7f8e173b5cc7a1af2d41566b8b683c9d5661de6e0c9e9

      • C:\Users\Admin\AppData\Local\Temp\171722.zip

        Filesize

        972KB

        MD5

        77cfabf26034b53f7c2471e9aa073847

        SHA1

        9fb5c65d8c5e7fd0df8ca28ec5fe4a6e5a30c5b8

        SHA256

        98ac85e40373cd16f6910cfd4bd092ab15a6eda3b513bd09da39b6a29fcb3504

        SHA512

        25e37745433af2aeb85fa4c9d197efcde802025832b28aa173c89ca417ee42fe1106616d565c51bdda4cec13e8508f7f23aeacc431a010c5f4c68ce5d21040fc

      • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

        Filesize

        20KB

        MD5

        76d7c5742af3fc815d026a52f920f008

        SHA1

        187199b1246ddecaa30a8bb25ef94a6d680f2317

        SHA256

        85034b125e03900fbaf2ed3905cc114a58bf72fc3a2d4a0ec25eb14fbf1a4754

        SHA512

        cba62e16eee125b5663a1b4f7cd9165a90377da30939c513c63afcd0a28decb0f7112992973e5dc24a92125337edfff2c7ac29507a7817333e5e4d4d8271089e

      • \Users\Admin\AppData\Local\Temp\171717.tmp

        Filesize

        532.9MB

        MD5

        7291fb9bc7cccec7e9688247e80bf297

        SHA1

        63ebf96550a6e38539de9e9cbbe976a5855675a4

        SHA256

        bbaa295c4c2882f357aca0f1f9b6032523431c1e4dd98c998e5e06484f594694

        SHA512

        6dcf445f45e1571f15900d93523d220b9dc6c502ed712a65d173dde7b46c869cf0899c7b21d8de5bf5f7f8e173b5cc7a1af2d41566b8b683c9d5661de6e0c9e9

      • \Users\Admin\AppData\Local\Temp\171717.tmp

        Filesize

        532.9MB

        MD5

        7291fb9bc7cccec7e9688247e80bf297

        SHA1

        63ebf96550a6e38539de9e9cbbe976a5855675a4

        SHA256

        bbaa295c4c2882f357aca0f1f9b6032523431c1e4dd98c998e5e06484f594694

        SHA512

        6dcf445f45e1571f15900d93523d220b9dc6c502ed712a65d173dde7b46c869cf0899c7b21d8de5bf5f7f8e173b5cc7a1af2d41566b8b683c9d5661de6e0c9e9

      • memory/808-847-0x0000000000120000-0x0000000000121000-memory.dmp

        Filesize

        4KB

      • memory/1408-74-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-77-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-63-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-66-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-65-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-67-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-68-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-69-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-70-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-71-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-72-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-73-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

      • memory/1408-76-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-75-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-64-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-79-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-80-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-78-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-82-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-83-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-81-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-84-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-93-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-111-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-62-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-61-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-59-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-60-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-58-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1408-57-0x0000000000510000-0x0000000000610000-memory.dmp

        Filesize

        1024KB

      • memory/1988-848-0x0000000000130000-0x0000000000131000-memory.dmp

        Filesize

        4KB