Analysis
-
max time kernel
7s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07-01-2024 06:34
Behavioral task
behavioral1
Sample
48463e9423607e7e5fbb05b42a3bc4ae.doc
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
48463e9423607e7e5fbb05b42a3bc4ae.doc
Resource
win10v2004-20231215-en
General
-
Target
48463e9423607e7e5fbb05b42a3bc4ae.doc
-
Size
623KB
-
MD5
48463e9423607e7e5fbb05b42a3bc4ae
-
SHA1
922f69f07b42322123a3ff3f8f6e63277d0deb70
-
SHA256
cef7ccf63ab0648d312c44000f29f93d672e6a99a8ab5d08b599719d3f2ac23d
-
SHA512
8e61c966467e0c4cf1edce45f25a43464d59f156c958c66169af4fbe6214e7ca6510995f5f8167ebca30813f70246d5164d1b77e6bc83b3255946780fc345bc8
-
SSDEEP
12288:zV9iQsDr8NREUYfwg8I3HMzNK3Rb+jC4xU4WhO:zVXkr8N+UYhR3HMBK3RMeO
Malware Config
Extracted
hancitor
1908_jkdsf
http://thookedaurce.com/8/forum.php
http://foolockpary.ru/8/forum.php
http://usitemithe.ru/8/forum.php
Signatures
-
Hancitor
Hancitor is downloader used to deliver other malware families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 4084 4856 rundll32.exe WINWORD.EXE -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 42 api.ipify.org -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
NTFS ADS 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\{2C9013B7-10DC-4694-AB73-6C741715A88F}\glib.bax:Zone.Identifier WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4856 WINWORD.EXE 4856 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
WINWORD.EXEpid process 4856 WINWORD.EXE 4856 WINWORD.EXE 4856 WINWORD.EXE 4856 WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 4856 wrote to memory of 1808 4856 WINWORD.EXE splwow64.exe PID 4856 wrote to memory of 1808 4856 WINWORD.EXE splwow64.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\48463e9423607e7e5fbb05b42a3bc4ae.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\SYSTEM32\rundll32.exerundll32 c:\users\admin\appdata\roaming\microsoft\templates\yefff.dll,KBLQIJOPAQU2⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32 c:\users\admin\appdata\roaming\microsoft\templates\yefff.dll,KBLQIJOPAQU3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1892-154-0x00000000012C0000-0x00000000012CA000-memory.dmpFilesize
40KB
-
memory/1892-178-0x00000000012C0000-0x00000000012CA000-memory.dmpFilesize
40KB
-
memory/1892-160-0x0000000000400000-0x00000000004D2000-memory.dmpFilesize
840KB
-
memory/1892-153-0x00000000012A0000-0x00000000012A8000-memory.dmpFilesize
32KB
-
memory/4856-36-0x0000025293290000-0x0000025294260000-memory.dmpFilesize
15.8MB
-
memory/4856-218-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-151-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-4-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-3-0x00007FF93FA10000-0x00007FF93FA20000-memory.dmpFilesize
64KB
-
memory/4856-2-0x00007FF93FA10000-0x00007FF93FA20000-memory.dmpFilesize
64KB
-
memory/4856-0-0x00007FF93FA10000-0x00007FF93FA20000-memory.dmpFilesize
64KB
-
memory/4856-11-0x00007FF93D9B0000-0x00007FF93D9C0000-memory.dmpFilesize
64KB
-
memory/4856-12-0x00007FF93D9B0000-0x00007FF93D9C0000-memory.dmpFilesize
64KB
-
memory/4856-30-0x0000025293290000-0x0000025294260000-memory.dmpFilesize
15.8MB
-
memory/4856-1-0x00007FF93FA10000-0x00007FF93FA20000-memory.dmpFilesize
64KB
-
memory/4856-37-0x0000025293290000-0x0000025294260000-memory.dmpFilesize
15.8MB
-
memory/4856-46-0x0000025293290000-0x0000025294260000-memory.dmpFilesize
15.8MB
-
memory/4856-55-0x0000025293290000-0x0000025294260000-memory.dmpFilesize
15.8MB
-
memory/4856-61-0x0000025293290000-0x0000025294260000-memory.dmpFilesize
15.8MB
-
memory/4856-86-0x0000025293290000-0x0000025294260000-memory.dmpFilesize
15.8MB
-
memory/4856-92-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-125-0x0000025293290000-0x0000025294260000-memory.dmpFilesize
15.8MB
-
memory/4856-135-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-136-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-141-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-145-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-148-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-152-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-10-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-9-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-6-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-8-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-175-0x0000025293290000-0x0000025294260000-memory.dmpFilesize
15.8MB
-
memory/4856-147-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-146-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-144-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-143-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-142-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-140-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-139-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-158-0x0000025293290000-0x0000025294260000-memory.dmpFilesize
15.8MB
-
memory/4856-159-0x0000025293290000-0x0000025294260000-memory.dmpFilesize
15.8MB
-
memory/4856-7-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-161-0x0000025293290000-0x0000025294260000-memory.dmpFilesize
15.8MB
-
memory/4856-164-0x0000025293290000-0x0000025294260000-memory.dmpFilesize
15.8MB
-
memory/4856-165-0x0000025293290000-0x0000025294260000-memory.dmpFilesize
15.8MB
-
memory/4856-166-0x0000025293290000-0x0000025294260000-memory.dmpFilesize
15.8MB
-
memory/4856-174-0x0000025293290000-0x0000025294260000-memory.dmpFilesize
15.8MB
-
memory/4856-149-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-177-0x0000025293290000-0x0000025294260000-memory.dmpFilesize
15.8MB
-
memory/4856-5-0x00007FF93FA10000-0x00007FF93FA20000-memory.dmpFilesize
64KB
-
memory/4856-180-0x0000025293290000-0x0000025294260000-memory.dmpFilesize
15.8MB
-
memory/4856-217-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-150-0x00007FF97F990000-0x00007FF97FB85000-memory.dmpFilesize
2.0MB
-
memory/4856-216-0x00007FF93FA10000-0x00007FF93FA20000-memory.dmpFilesize
64KB
-
memory/4856-215-0x00007FF93FA10000-0x00007FF93FA20000-memory.dmpFilesize
64KB
-
memory/4856-214-0x00007FF93FA10000-0x00007FF93FA20000-memory.dmpFilesize
64KB
-
memory/4856-213-0x00007FF93FA10000-0x00007FF93FA20000-memory.dmpFilesize
64KB