Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/03/2024, 09:46
General
- Target inquiry.08.21.doc
- Size 84KB
- Sample240327-lr276scf3w
- SHA256 655da2956892b86082e1bf3d64819643b6671da87ec5bc06a375cbcaac29463f
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\inquiry.08.21.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\scriptrunner.exescriptrunner.exe -appvscript .hTA2⤵
- Process spawned unexpected child process
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\.hTA" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 14044⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2884 -ip 28841⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
.hTA
memory/2792-37-0x00000209F5850000-0x00000209F585A000-memory.dmp
memory/2792-41-0x00007FFF45520000-0x00007FFF45FE1000-memory.dmp
memory/2792-39-0x00007FFF45520000-0x00007FFF45FE1000-memory.dmp
memory/2884-45-0x0000000004830000-0x0000000004850000-memory.dmp
memory/4604-11-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-35-0x000002935A7D0000-0x000002935AFD0000-memory.dmp
memory/4604-5-0x00007FFF31A10000-0x00007FFF31A20000-memory.dmp
memory/4604-8-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-9-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-0-0x00007FFF31A10000-0x00007FFF31A20000-memory.dmp
memory/4604-10-0x00007FFF2F490000-0x00007FFF2F4A0000-memory.dmp
memory/4604-12-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-14-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-15-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-13-0x00007FFF2F490000-0x00007FFF2F4A0000-memory.dmp
memory/4604-16-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-17-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-18-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-19-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-20-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-23-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-24-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-25-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-6-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-36-0x000002935A7D0000-0x000002935AFD0000-memory.dmp
memory/4604-7-0x00007FFF31A10000-0x00007FFF31A20000-memory.dmp
memory/4604-3-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-4-0x00007FFF31A10000-0x00007FFF31A20000-memory.dmp
memory/4604-2-0x00007FFF31A10000-0x00007FFF31A20000-memory.dmp
memory/4604-1-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-52-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-53-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-54-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-55-0x000002935A7D0000-0x000002935AFD0000-memory.dmp
memory/4604-56-0x000002935A7D0000-0x000002935AFD0000-memory.dmp
memory/4604-75-0x00007FFF31A10000-0x00007FFF31A20000-memory.dmp
memory/4604-76-0x00007FFF31A10000-0x00007FFF31A20000-memory.dmp
memory/4604-77-0x00007FFF31A10000-0x00007FFF31A20000-memory.dmp
memory/4604-78-0x00007FFF31A10000-0x00007FFF31A20000-memory.dmp
memory/4604-79-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp
memory/4604-80-0x00007FFF71990000-0x00007FFF71B85000-memory.dmp