Analysis

  • max time kernel
    123s
  • max time network
    92s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    23-03-2023 07:15

General

  • Target

    Invoice# 5140312 23-03-2023_0714.doc

  • Size

    522.2MB

  • MD5

    9fa322450e0bcdc40fa080cf8b49afea

  • SHA1

    9278643d2fce17e9fd8b3ea61ef4ec15830bf2f1

  • SHA256

    a0318b404ba8ae1eacbf350dd72c7fc708c184c78170bd715deb1f95356a3c65

  • SHA512

    fc56db89c8bbae9c754bf9f7b505dbca774edef95ead849ff5aed76a5f76c1dbc65fca3a6e1ce248b3ad5da78fc765abd7908e2d443f4bece4b53d03c6f82c5a

  • SSDEEP

    3072:brrCtKZF4eqZ627NHRxMvOwvzpl+vk6jZc:5F4eqYwHMvfvzpKk6Nc

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Invoice# 5140312 23-03-2023_0714.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\081558.tmp"
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1628
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Users\Admin\AppData\Local\Temp\081558.tmp"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2020
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BNYayzjdyQlJ\WkdcvZmAgZsHm.dll"
          4⤵
            PID:752
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        2⤵
          PID:1704

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Defense Evasion

      Modify Registry

      1
      T1112

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
        Filesize

        61KB

        MD5

        e71c8443ae0bc2e282c73faead0a6dd3

        SHA1

        0c110c1b01e68edfacaeae64781a37b1995fa94b

        SHA256

        95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

        SHA512

        b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        a06bad811b537eba18927285ebe1655e

        SHA1

        f70a01868e90cb333c853593d5f5035286f83ff2

        SHA256

        780cd35088e47eff4e84a51ffe4f46be29e44595c917220908eb7cc50c955476

        SHA512

        9922a9f48af30f130e854fdf77375f01c6bdbfc6f5771b46d63ee9586e328d2ab46afd66cce380b1d42b1eca14c39500b181bab56d358f8c0c37b76e0431ab07

      • C:\Users\Admin\AppData\Local\Temp\081558.tmp
        Filesize

        536.9MB

        MD5

        3734e7ac83e3013b2eedd095a38b2992

        SHA1

        a9fd2e6cb607e3c977f0fc7222e9b190bfc75327

        SHA256

        55a64669009e01b0b719a092a520b5973ce16bab7b1a02985e833d500bc9bfd7

        SHA512

        98d36cc466b4c6ae2dde69145a438bfc7a69379bfd1e76980f4c3bae822b3897de4a24180ef556f053471e815146c4dc29a8991be8bb6dbbbb45dc4e6a921ede

      • C:\Users\Admin\AppData\Local\Temp\081605.zip
        Filesize

        976KB

        MD5

        bc9e932d478972c90af6690741aae444

        SHA1

        9220821e851b9f5f1f42a031610d56629e91c4c9

        SHA256

        241d6a4757b73c2cc6c64646157b613fcf0eceb0a91b26d1c5e82f8d32588f0c

        SHA512

        3b300ba550b33a435e388e1857d70b6e7c2a938d6047e23b77763e72a51a286a612da7fae51dce3bd7db8b531e4d35e33f32887717ec94ef1ca2e9c5b528c6c2

      • C:\Users\Admin\AppData\Local\Temp\Cab4FBA.tmp
        Filesize

        61KB

        MD5

        fc4666cbca561e864e7fdf883a9e6661

        SHA1

        2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

        SHA256

        10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

        SHA512

        c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

      • C:\Users\Admin\AppData\Local\Temp\Tar532A.tmp
        Filesize

        161KB

        MD5

        be2bec6e8c5653136d3e72fe53c98aa3

        SHA1

        a8182d6db17c14671c3d5766c72e58d87c0810de

        SHA256

        1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

        SHA512

        0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

      • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
        Filesize

        20KB

        MD5

        7bbce04e2690f18d752f07f0e596d59d

        SHA1

        2f32ce27280112eefc10c11a1207e9d43163f6b7

        SHA256

        46058a8950eed7a023466c4dcddba1672a8e09e653178099addfc34e2b515a94

        SHA512

        587764488c4a0a9e6d931b69753e664abe13fc7fd2e613d21379be2160de442810414400639edd974a4fa30cd296a615bb75976fe4eecb8f5151b30a4e0688f7

      • \Users\Admin\AppData\Local\Temp\081558.tmp
        Filesize

        536.9MB

        MD5

        3734e7ac83e3013b2eedd095a38b2992

        SHA1

        a9fd2e6cb607e3c977f0fc7222e9b190bfc75327

        SHA256

        55a64669009e01b0b719a092a520b5973ce16bab7b1a02985e833d500bc9bfd7

        SHA512

        98d36cc466b4c6ae2dde69145a438bfc7a69379bfd1e76980f4c3bae822b3897de4a24180ef556f053471e815146c4dc29a8991be8bb6dbbbb45dc4e6a921ede

      • \Users\Admin\AppData\Local\Temp\081558.tmp
        Filesize

        536.9MB

        MD5

        3734e7ac83e3013b2eedd095a38b2992

        SHA1

        a9fd2e6cb607e3c977f0fc7222e9b190bfc75327

        SHA256

        55a64669009e01b0b719a092a520b5973ce16bab7b1a02985e833d500bc9bfd7

        SHA512

        98d36cc466b4c6ae2dde69145a438bfc7a69379bfd1e76980f4c3bae822b3897de4a24180ef556f053471e815146c4dc29a8991be8bb6dbbbb45dc4e6a921ede

      • memory/752-913-0x0000000000130000-0x0000000000131000-memory.dmp
        Filesize

        4KB

      • memory/836-78-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-74-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-68-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-69-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-70-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-71-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-72-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-73-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-76-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-75-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-54-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

      • memory/836-79-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-80-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-81-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-77-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-67-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-82-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-83-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-84-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-111-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-112-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-66-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-65-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-64-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-63-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-62-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-60-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-61-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-59-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-57-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/836-58-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

      • memory/2020-908-0x00000000001B0000-0x00000000001B1000-memory.dmp
        Filesize

        4KB