Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2024, 02:20

General

  • Target

    bbdbcec62526b94b38d7ab4e0e794efcc363cd7ec033f39c543c666378c317ea.doc

  • Size

    243KB

  • MD5

    c7155ee36a292f7fd3ec128a5386bad3

  • SHA1

    d2ebba5249076fdb49f5a70d8391882694478849

  • SHA256

    bbdbcec62526b94b38d7ab4e0e794efcc363cd7ec033f39c543c666378c317ea

  • SHA512

    bc6c1e4c3c0588f98fc1ebea36ef1d3f5f52c13c8f039d793204be91d4ccd725693c6093ca3cbd3cbf13bf8c775f784ef608b1424a19b6b12f9e606eb8fe6436

  • SSDEEP

    6144:Z2hxiaIlxQ1iXaF5H/FtDBoccgbb5UUELzt:ZsDIlxgiXabRpzEL

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\bbdbcec62526b94b38d7ab4e0e794efcc363cd7ec033f39c543c666378c317ea.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3704
    • C:\Windows\system32\Regsvr32.exe
      "Regsvr32.exe" /s "C:/Users/Admin/AppData/Local/Temp/app.pln"
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:3640
      • C:\Windows\SysWOW64\regsvr32.exe
        /s "C:/Users/Admin/AppData/Local/Temp/app.pln"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3772
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /create /sc minute /mo 10 /tn "EdgeUpdate" /tr "regsvr32.exe /s C:/Users/Admin/AppData/Local/Temp/app.pln" /f291 Connection: keep-alive Set-Cookie: stel_ssid=b7dc017117a2fa6fdf_5263559391557823068; expires=Fri, 29 Mar 2024 02(È{Ù0
          4⤵
          • Creates scheduled task(s)
          PID:8
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2264,i,13734085038406049477,12426093271221802693,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2980

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\app.pln

            Filesize

            2.6MB

            MD5

            86e9ce5acb23e1ce8fbd63ac2bcdae2e

            SHA1

            a87d17f6008511b758e7e196ad0c48ef0e2c8a5e

            SHA256

            f4e45d8de105c1d73091fc6d93106c5eef287f0cb3d97cdc6837f8f6d79ea447

            SHA512

            36fb7daa1434c2feaf89031b4cd08cca99e2dd4b3831f0b8958b15d856d892e6bdb3374cf4d3ab7c2ba6c36a27c622bdf7bb6f53d71fb2af3161497deea52477

          • memory/3704-18-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-20-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-4-0x00007FFB101F0000-0x00007FFB10200000-memory.dmp

            Filesize

            64KB

          • memory/3704-2-0x00007FFB101F0000-0x00007FFB10200000-memory.dmp

            Filesize

            64KB

          • memory/3704-6-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-35-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-7-0x00007FFB101F0000-0x00007FFB10200000-memory.dmp

            Filesize

            64KB

          • memory/3704-8-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-9-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-10-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-11-0x00007FFB0E030000-0x00007FFB0E040000-memory.dmp

            Filesize

            64KB

          • memory/3704-12-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-13-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-14-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-15-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-16-0x00007FFB0E030000-0x00007FFB0E040000-memory.dmp

            Filesize

            64KB

          • memory/3704-17-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-0-0x00007FFB101F0000-0x00007FFB10200000-memory.dmp

            Filesize

            64KB

          • memory/3704-3-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-19-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-5-0x00007FFB101F0000-0x00007FFB10200000-memory.dmp

            Filesize

            64KB

          • memory/3704-36-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-37-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-44-0x000001CC3BE90000-0x000001CC3CE60000-memory.dmp

            Filesize

            15.8MB

          • memory/3704-45-0x000001CC3BE90000-0x000001CC3CE60000-memory.dmp

            Filesize

            15.8MB

          • memory/3704-1-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-81-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-80-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3704-78-0x00007FFB101F0000-0x00007FFB10200000-memory.dmp

            Filesize

            64KB

          • memory/3704-75-0x00007FFB101F0000-0x00007FFB10200000-memory.dmp

            Filesize

            64KB

          • memory/3704-76-0x00007FFB101F0000-0x00007FFB10200000-memory.dmp

            Filesize

            64KB

          • memory/3704-77-0x00007FFB101F0000-0x00007FFB10200000-memory.dmp

            Filesize

            64KB

          • memory/3704-79-0x00007FFB50170000-0x00007FFB50365000-memory.dmp

            Filesize

            2.0MB

          • memory/3772-69-0x00000000023D0000-0x0000000002566000-memory.dmp

            Filesize

            1.6MB

          • memory/3772-68-0x0000000000D60000-0x0000000000EF9000-memory.dmp

            Filesize

            1.6MB

          • memory/3772-67-0x0000000010000000-0x000000001029B000-memory.dmp

            Filesize

            2.6MB

          • memory/3772-86-0x0000000002C50000-0x0000000002CC2000-memory.dmp

            Filesize

            456KB