20402a7587544d4b4d76afbe3fecf82239eed5b9b3dc69885c748f785ba55708

General

Target

8421b07fef4b5f_JC.exe
Size

467KB
MD5

8421b07fef4b5fd01ee94ab88da0066b
SHA1

5de92151ebec2e0608e9e5d022f5da7c38e34b53
SHA256

20402a7587544d4b4d76afbe3fecf82239eed5b9b3dc69885c748f785ba55708
SHA512

385073a21b5d66fc1c0d8df0e1c8d35248e3d32d0c1ab659a46a861caf39eb0ad232f5f74c896229754178ac4a271773bb80f4bf01bf401ce2677584d8161fa9
SSDEEP

6144:jFrJxvldL4c5ONK1xgWbd1s79+iStwTgUq+uUCN5Tb/lEh7cJJqBhGrirbO4Dyb9:Bb4bZudi79Lf/65Tb/QLGrObb/zsn1Ak

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation	67A3.tmp

Executes dropped EXE 1 IoCs

pid	Process
4056	67A3.tmp

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{5280EF14-F33D-4E7F-AB6A-49A7AD2C7FCA}.catalogItem	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings	67A3.tmp

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3936	WINWORD.EXE
3936	WINWORD.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4056	67A3.tmp

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3936	WINWORD.EXE
3936	WINWORD.EXE
3936	WINWORD.EXE
3936	WINWORD.EXE
3936	WINWORD.EXE
3936	WINWORD.EXE
3936	WINWORD.EXE
3936	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4056	4840	8421b07fef4b5f_JC.exe	86
PID 4840 wrote to memory of 4056	4840	8421b07fef4b5f_JC.exe	86
PID 4840 wrote to memory of 4056	4840	8421b07fef4b5f_JC.exe	86
PID 4056 wrote to memory of 3936	4056	67A3.tmp	90
PID 4056 wrote to memory of 3936	4056	67A3.tmp	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8421b07fef4b5f_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8421b07fef4b5f_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\Temp\67A3.tmp
  "C:\Users\Admin\AppData\Local\Temp\67A3.tmp" --helpC:\Users\Admin\AppData\Local\Temp\8421b07fef4b5f_JC.exe CEC31A260443769E9E00B2FA5409E2BA673C95D9FBE7736FCDDE2C556345176099BA8D5A2746C8E98FE2ACC3A5BC07F00F87977056B075EB71B3EF1DCA6B2A66
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\8421b07fef4b5f_JC.doc" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:3936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:2684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\67A3.tmp

Filesize
467KB

MD5
208687152a630b8713f7c2907531df23

SHA1
989ed4c652bfbc66e08506eb4c133233a3361fa9

SHA256
189660852e40374627f5d256f14c95f9c6fe33588f35ba99ae6748cb1607045e

SHA512
3b6cc342c3a72951cf9771e4c0d229c05b8ec447c3a59755b2f115c17acdaff97e1b454c1e7b3b0ceb75f2d67e875f9bfa5f5b43b4fe16e60bb234153955907b

Download Submit
C:\Users\Admin\AppData\Local\Temp\67A3.tmp

Filesize
467KB

MD5
208687152a630b8713f7c2907531df23

SHA1
989ed4c652bfbc66e08506eb4c133233a3361fa9

SHA256
189660852e40374627f5d256f14c95f9c6fe33588f35ba99ae6748cb1607045e

SHA512
3b6cc342c3a72951cf9771e4c0d229c05b8ec447c3a59755b2f115c17acdaff97e1b454c1e7b3b0ceb75f2d67e875f9bfa5f5b43b4fe16e60bb234153955907b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8421b07fef4b5f_JC.doc

Filesize
35KB

MD5
a6b03fc9e5439b7504ba08010a960962

SHA1
e93a74f35ac1ed020158642eb1f2087fd31fc7c6

SHA256
b3b306a9618a08a003443e00e8ce2fcb14040775c3aeadc11cf120668e98dff1

SHA512
decbe4fa7eec0833a27acbde8b4de099124aa42e551f710fb615e6fc5aa0056ce9e44fc282e4930b1a669a1e012700b2c79cebc8a7b8ee4c66cfc29c800cddd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\8421b07fef4b5f_JC.doc

Filesize
35KB

MD5
a6b03fc9e5439b7504ba08010a960962

SHA1
e93a74f35ac1ed020158642eb1f2087fd31fc7c6

SHA256
b3b306a9618a08a003443e00e8ce2fcb14040775c3aeadc11cf120668e98dff1

SHA512
decbe4fa7eec0833a27acbde8b4de099124aa42e551f710fb615e6fc5aa0056ce9e44fc282e4930b1a669a1e012700b2c79cebc8a7b8ee4c66cfc29c800cddd0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/3936-149-0x00007FF8BE0D0000-0x00007FF8BE0E0000-memory.dmp

Filesize
64KB

Download
memory/3936-162-0x00007FF8BBED0000-0x00007FF8BBEE0000-memory.dmp

Filesize
64KB

Download
memory/3936-151-0x00007FF8BE0D0000-0x00007FF8BE0E0000-memory.dmp

Filesize
64KB

Download
memory/3936-153-0x00007FF8BE0D0000-0x00007FF8BE0E0000-memory.dmp

Filesize
64KB

Download
memory/3936-152-0x00007FF8FE050000-0x00007FF8FE245000-memory.dmp

Filesize
2.0MB

Download
memory/3936-154-0x00007FF8FE050000-0x00007FF8FE245000-memory.dmp

Filesize
2.0MB

Download
memory/3936-155-0x00007FF8FE050000-0x00007FF8FE245000-memory.dmp

Filesize
2.0MB

Download
memory/3936-156-0x00007FF8BE0D0000-0x00007FF8BE0E0000-memory.dmp

Filesize
64KB

Download
memory/3936-157-0x00007FF8FE050000-0x00007FF8FE245000-memory.dmp

Filesize
2.0MB

Download
memory/3936-158-0x00007FF8FE050000-0x00007FF8FE245000-memory.dmp

Filesize
2.0MB

Download
memory/3936-160-0x00007FF8FE050000-0x00007FF8FE245000-memory.dmp

Filesize
2.0MB

Download
memory/3936-159-0x00007FF8FE050000-0x00007FF8FE245000-memory.dmp

Filesize
2.0MB

Download
memory/3936-161-0x00007FF8FE050000-0x00007FF8FE245000-memory.dmp

Filesize
2.0MB

Download
memory/3936-150-0x00007FF8FE050000-0x00007FF8FE245000-memory.dmp

Filesize
2.0MB

Download
memory/3936-163-0x00007FF8BBED0000-0x00007FF8BBEE0000-memory.dmp

Filesize
64KB

Download
memory/3936-165-0x00007FF8FE050000-0x00007FF8FE245000-memory.dmp

Filesize
2.0MB

Download
memory/3936-148-0x00007FF8FE050000-0x00007FF8FE245000-memory.dmp

Filesize
2.0MB

Download
memory/3936-171-0x00007FF8FE050000-0x00007FF8FE245000-memory.dmp

Filesize
2.0MB

Download
memory/3936-176-0x00007FF8FE050000-0x00007FF8FE245000-memory.dmp

Filesize
2.0MB

Download
memory/3936-147-0x00007FF8BE0D0000-0x00007FF8BE0E0000-memory.dmp

Filesize
64KB

Download
memory/3936-207-0x00007FF8BE0D0000-0x00007FF8BE0E0000-memory.dmp

Filesize
64KB

Download
memory/3936-208-0x00007FF8BE0D0000-0x00007FF8BE0E0000-memory.dmp

Filesize
64KB

Download
memory/3936-209-0x00007FF8BE0D0000-0x00007FF8BE0E0000-memory.dmp

Filesize
64KB

Download
memory/3936-210-0x00007FF8BE0D0000-0x00007FF8BE0E0000-memory.dmp

Filesize
64KB

Download
memory/3936-211-0x00007FF8FE050000-0x00007FF8FE245000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads