Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    11/01/2024, 23:25

General

  • Target

    54deafaa7fbd40b7da5f291d6f6a683d.doc

  • Size

    38KB

  • MD5

    54deafaa7fbd40b7da5f291d6f6a683d

  • SHA1

    5e3fa26bdbc204a26b6ae642b3e8911a2b857b8e

  • SHA256

    403b71c0ff36ff91bd8102d080b744f811978f4d3017a80b527a7f93f1e6e1ad

  • SHA512

    902dfb651f5c9797ca3d14e60d7cbaa8f27f1f33869f52547d331486513f20e9cc9fc9b79804f47ee69a76af730d715f40a4e25e7093049e853386647126ee2b

  • SSDEEP

    384:rzOmycGhgnfLWmihpF2z0zjsxGL6upkqv50Q51:/OmlGhgnDW53NHO1qv50Q5

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\54deafaa7fbd40b7da5f291d6f6a683d.doc"
    1⤵
    • Deletes itself
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2348
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2492

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\54deafaa7fbd40b7da5f291d6f6a683d.doc

      Filesize

      47KB

      MD5

      edbe22ef891d7933e522c5da36399631

      SHA1

      89a9c7344f25025ff9eeec72e312040a2fb182c8

      SHA256

      7dba8fdc89d990bc4bf0205c1a38edb75ee316f65361fc3e6b30c72fa228f36d

      SHA512

      4a9c3612449ad8dc6009e1fd0948ed132f8f5bb1216c2adcbc846c0cdd024c0ad64ffe8b1e10e7bbdbeaa51629e176921c318899b18aab546a3932ebeb390243

    • C:\Users\Admin\AppData\Local\Temp\VBFF56.tmp

      Filesize

      1KB

      MD5

      c24a6bc31320ab4de4f004f231419aa8

      SHA1

      7d9035a54ce4483602369b161fe59a0b1e232b4d

      SHA256

      5234d340260df439355558f13f446a87dbbe358f4eebbe4d9f42a574d3432dcc

      SHA512

      be8c35157ee1852b7829c4fc2e6a7209b63284973a30af8a7c732f6b6684de5426d124adc65e87cdf8eeab1a65bcc02a648fa05f9144caf98c6307a4e5d00214

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      25KB

      MD5

      42655e6d410ed748cb1a80111e11ad98

      SHA1

      79ffb0d50286ccf1c319ce8061c61226b86ab3a9

      SHA256

      203e473dfca828f3b56b00b31f67e1823c51aedbe42088189586a92d36ec96b0

      SHA512

      a08e79431d98938e794fc1897f88cd1a44dfd5dca6b65f03baa579e43d1792636b5ff8a3c666f529be1e44da52e6286c921c46c4a98c5805cb7136d1238f3161

    • memory/2348-8-0x0000000000620000-0x0000000000720000-memory.dmp

      Filesize

      1024KB

    • memory/2348-7-0x0000000000620000-0x0000000000720000-memory.dmp

      Filesize

      1024KB

    • memory/2348-10-0x0000000000620000-0x0000000000720000-memory.dmp

      Filesize

      1024KB

    • memory/2348-9-0x0000000000620000-0x0000000000720000-memory.dmp

      Filesize

      1024KB

    • memory/2348-13-0x0000000000620000-0x0000000000720000-memory.dmp

      Filesize

      1024KB

    • memory/2348-6-0x0000000000620000-0x0000000000720000-memory.dmp

      Filesize

      1024KB

    • memory/2348-11-0x0000000000620000-0x0000000000720000-memory.dmp

      Filesize

      1024KB

    • memory/2348-0-0x000000002FE91000-0x000000002FE92000-memory.dmp

      Filesize

      4KB

    • memory/2348-2-0x000000007130D000-0x0000000071318000-memory.dmp

      Filesize

      44KB

    • memory/2348-38-0x000000007130D000-0x0000000071318000-memory.dmp

      Filesize

      44KB

    • memory/2348-39-0x0000000000620000-0x0000000000720000-memory.dmp

      Filesize

      1024KB

    • memory/2348-40-0x0000000000620000-0x0000000000720000-memory.dmp

      Filesize

      1024KB

    • memory/2348-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2348-60-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2348-61-0x0000000000620000-0x0000000000720000-memory.dmp

      Filesize

      1024KB