Analysis
- max time kernel
101s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
13/03/2024, 19:50
General
- Target adjure.04.30.2021.docm
- Size 76KB
- Sample240313-ykn37aee41
- SHA256 b3dbdf013c494dc354374a50e95635d53d2dabfc59527a17a5f104e8deb07554
Malware Config
Signatures
- Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
- Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 8 IoCs
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 18 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\adjure.04.30.2021.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 10082⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 10083⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
memory/1116-32-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1116-75-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1116-38-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1116-37-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1116-35-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1116-34-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1872-12-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1872-83-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1872-10-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1872-11-0x00007FFDE6070000-0x00007FFDE6080000-memory.dmp
memory/1872-0-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp
memory/1872-14-0x00007FFDE6070000-0x00007FFDE6080000-memory.dmp
memory/1872-15-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1872-13-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1872-16-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1872-21-0x000001DFC9F80000-0x000001DFCA780000-memory.dmp
memory/1872-22-0x000001DFCF160000-0x000001DFCF360000-memory.dmp
memory/1872-27-0x000001DFCE190000-0x000001DFCF160000-memory.dmp
memory/1872-29-0x000001DFC9F80000-0x000001DFCA780000-memory.dmp
memory/1872-9-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1872-8-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp
memory/1872-6-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp
memory/1872-5-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1872-2-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp
memory/1872-39-0x000001DFCE190000-0x000001DFCF160000-memory.dmp
memory/1872-124-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1872-122-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1872-123-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1872-120-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1872-95-0x000001DFCE190000-0x000001DFCF160000-memory.dmp
memory/1872-94-0x000001DFC9F80000-0x000001DFCA780000-memory.dmp
memory/1872-3-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1872-4-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp
memory/1872-1-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1872-7-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1872-86-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1872-90-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/1872-91-0x000001DFC9F80000-0x000001DFCA780000-memory.dmp
memory/1872-92-0x000001DFCF160000-0x000001DFCF360000-memory.dmp
memory/1872-93-0x000001DFCE190000-0x000001DFCF160000-memory.dmp
memory/3164-70-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp
memory/3164-71-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp
memory/3164-72-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp
memory/3164-73-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp
memory/3164-74-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp
memory/3164-59-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp