Resubmissions

13-09-2023 20:47

230913-zk1mnahe68 10

13-09-2023 19:55

230913-ym9snsef2y 10

13-09-2023 19:49

230913-yjtbhshc66 3

Analysis

  • max time kernel
    294s
  • max time network
    291s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-09-2023 19:55

General

  • Target

    doc_0322.one

  • Size

    261KB

  • MD5

    03e8285045cf9dcf8aaf6aa5173e9405

  • SHA1

    ed25287886244cf4ef5849da33c4a35352cfeecd

  • SHA256

    0f358a71775ad9224f77547f23c75333fabcdfa089abf80a68f6703cd4885080

  • SHA512

    998386ad433408b94d92e7231022004337a3732db24ac591d273494a22f7ffe1294d6f7a8fa61919ca0131a4a7b040917645f6ea85b761b582c0841e309bd669

  • SSDEEP

    3072:xXzeHrBwsHzUfxJ3mY2IsGllOb3HPWaBtOzUfxJ3mY2IsGllOb3HPWaBtuXq:FeHrBwsYXm5ZGa3vRXm5ZGa3v7

Score
6/10

Malware Config

Signatures

  • Process spawned suspicious child process 1 IoCs

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "C:\Users\Admin\AppData\Local\Temp\doc_0322.one"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4156
    • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 3164
      2⤵
      • Process spawned suspicious child process
      • Suspicious use of WriteProcessMemory
      PID:3840
      • C:\Windows\system32\dwwin.exe
        C:\Windows\system32\dwwin.exe -x -s 3164
        3⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        PID:3868

Network

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3840-25-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/3840-46-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/3840-47-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/3840-45-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/3840-44-0x00007FFF09130000-0x00007FFF09140000-memory.dmp
    Filesize

    64KB

  • memory/3840-43-0x00007FFF09130000-0x00007FFF09140000-memory.dmp
    Filesize

    64KB

  • memory/3840-42-0x00007FFF09130000-0x00007FFF09140000-memory.dmp
    Filesize

    64KB

  • memory/3840-40-0x00007FFF09130000-0x00007FFF09140000-memory.dmp
    Filesize

    64KB

  • memory/3840-33-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/3840-32-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/3840-31-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/3840-29-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/3840-27-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/4156-9-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/4156-12-0x00007FFF06930000-0x00007FFF06940000-memory.dmp
    Filesize

    64KB

  • memory/4156-16-0x00007FFF06930000-0x00007FFF06940000-memory.dmp
    Filesize

    64KB

  • memory/4156-15-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/4156-17-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/4156-18-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/4156-19-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/4156-20-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/4156-22-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/4156-21-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/4156-13-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/4156-14-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/4156-11-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/4156-10-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/4156-0-0x00007FFF09130000-0x00007FFF09140000-memory.dmp
    Filesize

    64KB

  • memory/4156-6-0x00007FFF09130000-0x00007FFF09140000-memory.dmp
    Filesize

    64KB

  • memory/4156-41-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/4156-8-0x00007FFF09130000-0x00007FFF09140000-memory.dmp
    Filesize

    64KB

  • memory/4156-7-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/4156-5-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/4156-3-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB

  • memory/4156-4-0x00007FFF09130000-0x00007FFF09140000-memory.dmp
    Filesize

    64KB

  • memory/4156-2-0x00007FFF09130000-0x00007FFF09140000-memory.dmp
    Filesize

    64KB

  • memory/4156-1-0x00007FFF490B0000-0x00007FFF492A5000-memory.dmp
    Filesize

    2.0MB