Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
18/03/2024, 00:48
General
- Target d225efab3cf8f751c299accb3f114e9b.doc
- Size 612KB
- Sample240318-a568haca73
- SHA256 2ae278b49a16340323666bc486a2686491391374365393142e44a25c16b29465
Malware Config
Extracted
-
hancitor
-
1808_plfr
-
http://madmilons.com/8/forum.php
-
http://counteent.ru/8/forum.php
-
http://simatereare.ru/8/forum.php
Signatures
- Hancitor
Hancitor is downloader used to deliver other malware families.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 1 IoCs
- Loads dropped DLL 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 16 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d225efab3cf8f751c299accb3f114e9b.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\SYSTEM32\rundll32.exerundll32 c:\users\admin\appdata\roaming\microsoft\templates\yefff.dll,DJJEQGVHMRG2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32 c:\users\admin\appdata\roaming\microsoft\templates\yefff.dll,DJJEQGVHMRG3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
331D38F7.emf
4C51654E.emf
index.dat
glib.doc
yefff.dll
memory/1480-141-0x0000000000D00000-0x0000000000D0A000-memory.dmp
memory/1480-127-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/1480-123-0x0000000000D00000-0x0000000000D0A000-memory.dmp
memory/1480-121-0x0000000000CE0000-0x0000000000CE8000-memory.dmp
memory/2068-43-0x000001903A160000-0x000001903B130000-memory.dmp
memory/2068-8-0x00007FFB2DBF0000-0x00007FFB2DC00000-memory.dmp
memory/2068-12-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp
memory/2068-11-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp
memory/2068-13-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp
memory/2068-14-0x00007FFB2BB90000-0x00007FFB2BBA0000-memory.dmp
memory/2068-15-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp
memory/2068-16-0x00007FFB2BB90000-0x00007FFB2BBA0000-memory.dmp
memory/2068-17-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp
memory/2068-18-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp
memory/2068-19-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp
memory/2068-20-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp
memory/2068-21-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp
memory/2068-31-0x000001903A160000-0x000001903B130000-memory.dmp
memory/2068-40-0x000001903A160000-0x000001903B130000-memory.dmp
memory/2068-0-0x00007FFB2DBF0000-0x00007FFB2DC00000-memory.dmp
memory/2068-55-0x000001903A160000-0x000001903B130000-memory.dmp
memory/2068-10-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp
memory/2068-69-0x000001903A160000-0x000001903B130000-memory.dmp
memory/2068-70-0x000001903A160000-0x000001903B130000-memory.dmp
memory/2068-9-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp
memory/2068-5-0x00007FFB2DBF0000-0x00007FFB2DC00000-memory.dmp
memory/2068-7-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp
memory/2068-119-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp
memory/2068-120-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp
memory/2068-6-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp
memory/2068-122-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp
memory/2068-4-0x00007FFB2DBF0000-0x00007FFB2DC00000-memory.dmp
memory/2068-124-0x000001903A160000-0x000001903B130000-memory.dmp
memory/2068-3-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp
memory/2068-128-0x000001903A160000-0x000001903B130000-memory.dmp
memory/2068-2-0x00007FFB2DBF0000-0x00007FFB2DC00000-memory.dmp
memory/2068-136-0x000001903A160000-0x000001903B130000-memory.dmp
memory/2068-137-0x000001903A160000-0x000001903B130000-memory.dmp
memory/2068-139-0x000001903A160000-0x000001903B130000-memory.dmp
memory/2068-1-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp
memory/2068-174-0x00007FFB2DBF0000-0x00007FFB2DC00000-memory.dmp
memory/2068-175-0x00007FFB2DBF0000-0x00007FFB2DC00000-memory.dmp
memory/2068-176-0x00007FFB2DBF0000-0x00007FFB2DC00000-memory.dmp
memory/2068-177-0x00007FFB2DBF0000-0x00007FFB2DC00000-memory.dmp
memory/2068-178-0x00007FFB6DB70000-0x00007FFB6DD65000-memory.dmp