Analysis
- max time kernel
145s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
27/01/2024, 21:43
General
- Target 7b5b74ed8ca5f213d111ec2fced1f446.doc
- Size 623KB
- Sample240127-1lex1sefgn
- SHA256 797fb35ec5ef998f910b1b488a3a394f0d2921e26f1625cd46bfc294800484a4
Malware Config
Extracted
-
hancitor
-
1908_jkdsf
-
http://thookedaurce.com/8/forum.php
-
http://foolockpary.ru/8/forum.php
-
http://usitemithe.ru/8/forum.php
Signatures
- Hancitor
Hancitor is downloader used to deliver other malware families.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 1 IoCs
- Loads dropped DLL 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 16 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7b5b74ed8ca5f213d111ec2fced1f446.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\SYSTEM32\rundll32.exerundll32 c:\users\admin\appdata\roaming\microsoft\templates\yefff.dll,KBLQIJOPAQU2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 c:\users\admin\appdata\roaming\microsoft\templates\yefff.dll,KBLQIJOPAQU1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
4D14CB7F.emf
8933E7F6.emf
index.dat
glib.doc
yefff.dll
yefff.dll
memory/3044-104-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-152-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-8-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-10-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-9-0x00007FFE7DCA0000-0x00007FFE7DCB0000-memory.dmp
memory/3044-12-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-11-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-15-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-16-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-14-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-18-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-19-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-20-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-21-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-22-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-17-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-13-0x00007FFE7DCA0000-0x00007FFE7DCB0000-memory.dmp
memory/3044-24-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-36-0x0000021FB68E0000-0x0000021FB78B0000-memory.dmp
memory/3044-42-0x0000021FB68E0000-0x0000021FB78B0000-memory.dmp
memory/3044-45-0x0000021FB68E0000-0x0000021FB78B0000-memory.dmp
memory/3044-49-0x0000021FB68E0000-0x0000021FB78B0000-memory.dmp
memory/3044-57-0x0000021FB68E0000-0x0000021FB78B0000-memory.dmp
memory/3044-6-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-72-0x0000021FB68E0000-0x0000021FB78B0000-memory.dmp
memory/3044-73-0x0000021FB68E0000-0x0000021FB78B0000-memory.dmp
memory/3044-5-0x00007FFE801B0000-0x00007FFE801C0000-memory.dmp
memory/3044-95-0x0000021FB68E0000-0x0000021FB78B0000-memory.dmp
memory/3044-4-0x00007FFE801B0000-0x00007FFE801C0000-memory.dmp
memory/3044-0-0x00007FFE801B0000-0x00007FFE801C0000-memory.dmp
memory/3044-136-0x0000021FB68E0000-0x0000021FB78B0000-memory.dmp
memory/3044-2-0x00007FFE801B0000-0x00007FFE801C0000-memory.dmp
memory/3044-3-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-155-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-7-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-149-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-231-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-160-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-159-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-158-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-161-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-157-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-156-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-154-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-162-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-163-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-230-0x00007FFE801B0000-0x00007FFE801C0000-memory.dmp
memory/3044-229-0x00007FFE801B0000-0x00007FFE801C0000-memory.dmp
memory/3044-164-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-153-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-151-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-150-0x00007FFEC0130000-0x00007FFEC0325000-memory.dmp
memory/3044-167-0x0000021FB68E0000-0x0000021FB78B0000-memory.dmp
memory/3044-168-0x0000021FB68E0000-0x0000021FB78B0000-memory.dmp
memory/3044-169-0x0000021FB68E0000-0x0000021FB78B0000-memory.dmp
memory/3044-175-0x0000021FB68E0000-0x0000021FB78B0000-memory.dmp
memory/3044-228-0x00007FFE801B0000-0x00007FFE801C0000-memory.dmp
memory/3044-179-0x0000021FB68E0000-0x0000021FB78B0000-memory.dmp
memory/3044-180-0x0000021FB68E0000-0x0000021FB78B0000-memory.dmp
memory/3044-1-0x00007FFE801B0000-0x00007FFE801C0000-memory.dmp
memory/3044-187-0x0000021FB68E0000-0x0000021FB78B0000-memory.dmp
memory/3044-189-0x0000021FB68E0000-0x0000021FB78B0000-memory.dmp
memory/3044-191-0x0000021FB68E0000-0x0000021FB78B0000-memory.dmp
memory/3044-227-0x00007FFE801B0000-0x00007FFE801C0000-memory.dmp
memory/4972-192-0x00000000024B0000-0x00000000024BA000-memory.dmp
memory/4972-178-0x00000000022D0000-0x00000000023A2000-memory.dmp
memory/4972-165-0x0000000000960000-0x0000000000968000-memory.dmp
memory/4972-166-0x00000000024B0000-0x00000000024BA000-memory.dmp
memory/4972-148-0x00000000022D0000-0x00000000023A2000-memory.dmp