Analysis

  • max time kernel
    120s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    20-12-2023 12:39

General

  • Target

    1/【财务部】关于工资调整通知.exe

  • Size

    1.4MB

  • MD5

    a6d9c8a9b440e3479dd3590d9bcde94f

  • SHA1

    7a114ee63b4ce4bff0960cdd880155cb46579bde

  • SHA256

    781a0adab936e9735b324e86cdfac0998c2411ee6e9830841c203510d487a850

  • SHA512

    bcecb32072c263411be1e0852d92b5d9b43da11a849d980f19763a62d5e8e80e661131c99b4e607c56c7910a5a7e4de3deba31ed0044f47dac123aa9e2ff3f7f

  • SSDEEP

    24576:OxY2ohZF25g1IrDSwYVYLncnEDBm8I/owIyPeNcI4rFq:OxY2225onnVLnEIp/UN

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1\【财务部】关于工资调整通知.exe
    "C:\Users\Admin\AppData\Local\Temp\1\【财务部】关于工资调整通知.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:284
    • \??\c:\programdata\baiDun.exe
      c:/programdata/baiDun.exe
      2⤵
      • Executes dropped EXE
      PID:1264
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1\附件.docx"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2060
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:660
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1\08FD~1.EXE >> NUL
        2⤵
        • Deletes itself
        PID:2176

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\1\附件.docx
      Filesize

      9KB

      MD5

      53b4b1af878da3dd53be95ff68fa8f05

      SHA1

      60f5c3be5a2f99f594015a39925a71142a0fe358

      SHA256

      66999ec379c661a681aeaa18a4aabfc2b6cb221e5948dca9960eda48c224122c

      SHA512

      4ee43a43d16630ae620d4cbf4b547906c16345cf18d094e4aae772067a5d5ceab640990b2582adbf0c4f554a58e7d9f18f3b905a3a27e0fc0c492aa287d0c153

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      a578c062d092a84b3391cef9ae156b27

      SHA1

      a4a9b42172c9f482c03e09e47c9fdf11c8a40f42

      SHA256

      7766204be3f943b37ee717545954a3214baf51683d42d85b48cfa05b759ae134

      SHA512

      33dffcab3cbf056a396b92e3ab221602fa75fdfb6625098f826bdb209d0078242dd8424e782d3ed2ef3702a9dee36854653b12064ace4d1be00be377fdc1edad

    • \ProgramData\baiDun.exe
      Filesize

      829KB

      MD5

      3823006c7e1f815b2e36a49b969a4a52

      SHA1

      3b137ae62df91c1489dd3f631f97bd31803f649a

      SHA256

      2a24baed4f0d411d3b51d1b5fde4d6f81fbc222e04b697aa8ebfc5b736eda84a

      SHA512

      a917c5107607983fe3ac9fe4aaf1027b53a832a2d27175be8d82de1773f3b35c92d79c58151969746e698f3746b9d6b9cda352fc6af1b6cb38e3329963735079

    • memory/2060-5-0x000000002F121000-0x000000002F122000-memory.dmp
      Filesize

      4KB

    • memory/2060-6-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/2060-7-0x000000007169D000-0x00000000716A8000-memory.dmp
      Filesize

      44KB

    • memory/2060-17-0x000000007169D000-0x00000000716A8000-memory.dmp
      Filesize

      44KB

    • memory/2060-35-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/2060-36-0x000000007169D000-0x00000000716A8000-memory.dmp
      Filesize

      44KB