Analysis
- max time kernel
148s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
28/03/2024, 02:20
General
- Target bbdbcec62526b94b38d7ab4e0e794efcc363cd7ec033f39c543c666378c317ea.doc
- Size 243KB
- Sample240328-csentsag39
- SHA256 bbdbcec62526b94b38d7ab4e0e794efcc363cd7ec033f39c543c666378c317ea
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Loads dropped DLL 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 7 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\bbdbcec62526b94b38d7ab4e0e794efcc363cd7ec033f39c543c666378c317ea.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Regsvr32.exe"Regsvr32.exe" /s "C:/Users/Admin/AppData/Local/Temp/app.pln"2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:/Users/Admin/AppData/Local/Temp/app.pln"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /sc minute /mo 10 /tn "EdgeUpdate" /tr "regsvr32.exe /s C:/Users/Admin/AppData/Local/Temp/app.pln" /f291 Connection: keep-alive Set-Cookie: stel_ssid=b7dc017117a2fa6fdf_5263559391557823068; expires=Fri, 29 Mar 2024 02(È{Ù04⤵
- Creates scheduled task(s)
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2264,i,13734085038406049477,12426093271221802693,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
app.pln
memory/3704-18-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-20-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-4-0x00007FFB101F0000-0x00007FFB10200000-memory.dmp
memory/3704-2-0x00007FFB101F0000-0x00007FFB10200000-memory.dmp
memory/3704-6-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-35-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-7-0x00007FFB101F0000-0x00007FFB10200000-memory.dmp
memory/3704-8-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-9-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-10-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-11-0x00007FFB0E030000-0x00007FFB0E040000-memory.dmp
memory/3704-12-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-13-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-14-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-15-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-16-0x00007FFB0E030000-0x00007FFB0E040000-memory.dmp
memory/3704-17-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-0-0x00007FFB101F0000-0x00007FFB10200000-memory.dmp
memory/3704-3-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-19-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-5-0x00007FFB101F0000-0x00007FFB10200000-memory.dmp
memory/3704-36-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-37-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-44-0x000001CC3BE90000-0x000001CC3CE60000-memory.dmp
memory/3704-45-0x000001CC3BE90000-0x000001CC3CE60000-memory.dmp
memory/3704-1-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-81-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-80-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3704-78-0x00007FFB101F0000-0x00007FFB10200000-memory.dmp
memory/3704-75-0x00007FFB101F0000-0x00007FFB10200000-memory.dmp
memory/3704-76-0x00007FFB101F0000-0x00007FFB10200000-memory.dmp
memory/3704-77-0x00007FFB101F0000-0x00007FFB10200000-memory.dmp
memory/3704-79-0x00007FFB50170000-0x00007FFB50365000-memory.dmp
memory/3772-69-0x00000000023D0000-0x0000000002566000-memory.dmp
memory/3772-68-0x0000000000D60000-0x0000000000EF9000-memory.dmp
memory/3772-67-0x0000000010000000-0x000000001029B000-memory.dmp
memory/3772-86-0x0000000002C50000-0x0000000002CC2000-memory.dmp