Overview
overview
10Static
static
10Challenge_...m.docx
windows7-x64
4Challenge_...m.docx
windows10-2004-x64
1Challenge_...1.docx
windows7-x64
4Challenge_...1.docx
windows10-2004-x64
1Challenge_...y.docx
windows7-x64
4Challenge_...y.docx
windows10-2004-x64
1Challenge_...1.docx
windows7-x64
4Challenge_...1.docx
windows10-2004-x64
1tools/numb...ing.py
ubuntu-18.04-amd64
1tools/numb...ing.py
debian-9-armhf
1tools/numb...ing.py
debian-9-mips
1tools/numb...ing.py
debian-9-mipsel
1decoder_add1.py
ubuntu-18.04-amd64
1decoder_add1.py
debian-9-armhf
1decoder_add1.py
debian-9-mips
1decoder_add1.py
debian-9-mipsel
1decoder_ah.py
ubuntu-18.04-amd64
1decoder_ah.py
debian-9-armhf
1decoder_ah.py
debian-9-mips
1decoder_ah.py
debian-9-mipsel
1decoder_chr.py
ubuntu-18.04-amd64
1decoder_chr.py
debian-9-armhf
1decoder_chr.py
debian-9-mips
1decoder_chr.py
debian-9-mipsel
1decoder_rol1.py
ubuntu-18.04-amd64
1decoder_rol1.py
debian-9-armhf
1decoder_rol1.py
debian-9-mips
1decoder_rol1.py
debian-9-mipsel
1decoder_xor1.py
ubuntu-18.04-amd64
1decoder_xor1.py
debian-9-armhf
1decoder_xor1.py
debian-9-mips
1decoder_xor1.py
debian-9-mipsel
1Analysis
-
max time kernel
302s -
max time network
293s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
17-10-2023 04:42
Static task
static1
Behavioral task
behavioral1
Sample
Challenge_FIles/Employee_W2_Form.docx
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Challenge_FIles/Employee_W2_Form.docx
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
Challenge_FIles/Employees_Contact_Audit_Oct_2021.docx
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
Challenge_FIles/Employees_Contact_Audit_Oct_2021.docx
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
Challenge_FIles/Work_From_Home_Survey.docx
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
Challenge_FIles/Work_From_Home_Survey.docx
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
Challenge_FIles/income_tax_and_benefit_return_2021.docx
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
Challenge_FIles/income_tax_and_benefit_return_2021.docx
Resource
win10v2004-20230915-en
Behavioral task
behavioral9
Sample
tools/numbers-to-string.py
Resource
ubuntu1804-amd64-20230831-en
Behavioral task
behavioral10
Sample
tools/numbers-to-string.py
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral11
Sample
tools/numbers-to-string.py
Resource
debian9-mipsbe-20230831-en
Behavioral task
behavioral12
Sample
tools/numbers-to-string.py
Resource
debian9-mipsel-20230831-en
Behavioral task
behavioral13
Sample
decoder_add1.py
Resource
ubuntu1804-amd64-20230831-en
Behavioral task
behavioral14
Sample
decoder_add1.py
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral15
Sample
decoder_add1.py
Resource
debian9-mipsbe-20230831-en
Behavioral task
behavioral16
Sample
decoder_add1.py
Resource
debian9-mipsel-20230831-en
Behavioral task
behavioral17
Sample
decoder_ah.py
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral18
Sample
decoder_ah.py
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral19
Sample
decoder_ah.py
Resource
debian9-mipsbe-20230831-en
Behavioral task
behavioral20
Sample
decoder_ah.py
Resource
debian9-mipsel-20230831-en
Behavioral task
behavioral21
Sample
decoder_chr.py
Resource
ubuntu1804-amd64-20230831-en
Behavioral task
behavioral22
Sample
decoder_chr.py
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral23
Sample
decoder_chr.py
Resource
debian9-mipsbe-20230831-en
Behavioral task
behavioral24
Sample
decoder_chr.py
Resource
debian9-mipsel-20230831-en
Behavioral task
behavioral25
Sample
decoder_rol1.py
Resource
ubuntu1804-amd64-20230831-en
Behavioral task
behavioral26
Sample
decoder_rol1.py
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral27
Sample
decoder_rol1.py
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral28
Sample
decoder_rol1.py
Resource
debian9-mipsel-20230831-en
Behavioral task
behavioral29
Sample
decoder_xor1.py
Resource
ubuntu1804-amd64-20230831-en
Behavioral task
behavioral30
Sample
decoder_xor1.py
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral31
Sample
decoder_xor1.py
Resource
debian9-mipsbe-20230831-en
Behavioral task
behavioral32
Sample
decoder_xor1.py
Resource
debian9-mipsel-en-20211208
General
-
Target
Challenge_FIles/income_tax_and_benefit_return_2021.docx
-
Size
23KB
-
MD5
55998cb43459159a5ed4511f00ff3fc8
-
SHA1
9bec2182cc5b41fe8783bb7ab6e577bac5c19f04
-
SHA256
d0e1f97dbe2d0af9342e64d460527b088d85f96d38b1d1d4aa610c0987dca745
-
SHA512
8f04951f9efb5acdad0a625d9f63154089d552fe4281ca53a759cc0a0468b8d9c76af863e34ed6e00802225a4408bcda1110a6efce30357e6173973ea5bf7838
-
SSDEEP
384:Q6UDg00MWEg9fPCPyH111/elBqhveoNHfn5yAehqbhtgyhdCxi556BjsbIwRq:QcMWE04uebyvNv5yHcttg6dwc5YQb5w
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
NTFS ADS 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\Challenge_FIles\mhtml:http:\hidusi.com\e8c76295a5f9acb7\side.html!x-usc:http:\hidusi.com\e8c76295a5f9acb7\side.html WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4008 WINWORD.EXE 4008 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WINWORD.EXEdescription pid process Token: SeAuditPrivilege 4008 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 25 IoCs
Processes:
WINWORD.EXEpid process 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE 4008 WINWORD.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Challenge_FIles\income_tax_and_benefit_return_2021.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4008-0-0x00007FFC95530000-0x00007FFC95540000-memory.dmpFilesize
64KB
-
memory/4008-1-0x00007FFCD54B0000-0x00007FFCD56A5000-memory.dmpFilesize
2.0MB
-
memory/4008-3-0x00007FFC95530000-0x00007FFC95540000-memory.dmpFilesize
64KB
-
memory/4008-2-0x00007FFC95530000-0x00007FFC95540000-memory.dmpFilesize
64KB
-
memory/4008-4-0x00007FFCD54B0000-0x00007FFCD56A5000-memory.dmpFilesize
2.0MB
-
memory/4008-6-0x00007FFCD54B0000-0x00007FFCD56A5000-memory.dmpFilesize
2.0MB
-
memory/4008-5-0x00007FFC95530000-0x00007FFC95540000-memory.dmpFilesize
64KB
-
memory/4008-7-0x00007FFCD54B0000-0x00007FFCD56A5000-memory.dmpFilesize
2.0MB
-
memory/4008-8-0x00007FFC95530000-0x00007FFC95540000-memory.dmpFilesize
64KB
-
memory/4008-9-0x00007FFCD54B0000-0x00007FFCD56A5000-memory.dmpFilesize
2.0MB
-
memory/4008-10-0x00007FFCD54B0000-0x00007FFCD56A5000-memory.dmpFilesize
2.0MB
-
memory/4008-11-0x00007FFCD54B0000-0x00007FFCD56A5000-memory.dmpFilesize
2.0MB
-
memory/4008-12-0x00007FFCD54B0000-0x00007FFCD56A5000-memory.dmpFilesize
2.0MB
-
memory/4008-13-0x00007FFCD54B0000-0x00007FFCD56A5000-memory.dmpFilesize
2.0MB
-
memory/4008-14-0x00007FFCD54B0000-0x00007FFCD56A5000-memory.dmpFilesize
2.0MB
-
memory/4008-15-0x00007FFC92D20000-0x00007FFC92D30000-memory.dmpFilesize
64KB
-
memory/4008-16-0x00007FFCD54B0000-0x00007FFCD56A5000-memory.dmpFilesize
2.0MB
-
memory/4008-17-0x00007FFCD54B0000-0x00007FFCD56A5000-memory.dmpFilesize
2.0MB
-
memory/4008-18-0x00007FFCD54B0000-0x00007FFCD56A5000-memory.dmpFilesize
2.0MB
-
memory/4008-19-0x00007FFC92D20000-0x00007FFC92D30000-memory.dmpFilesize
64KB
-
memory/4008-35-0x00007FFCD54B0000-0x00007FFCD56A5000-memory.dmpFilesize
2.0MB
-
memory/4008-36-0x00007FFCD54B0000-0x00007FFCD56A5000-memory.dmpFilesize
2.0MB