Analysis
- max time kernel
129s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
09/04/2024, 01:32
General
- Target 697e5c66b37dca99fc17ba919792e7429efbff1df26cea3c26866eff269b0055.dotm
- Size 38KB
- Sample240409-byc7hsdg4v
- SHA256 697e5c66b37dca99fc17ba919792e7429efbff1df26cea3c26866eff269b0055
Malware Config
Signatures
- Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Loads dropped DLL 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\697e5c66b37dca99fc17ba919792e7429efbff1df26cea3c26866eff269b0055.dotm" /o ""1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\TEMP\en-US\ointer.bat2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "BackupNonMaintenance" /tr "C:\Windows\System32\rundll32.exe "C:\Users\Admin\AppData\Local\TEMP\en-US\flexi.dll",UILOIPE" /sc DAILY /mo 13⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\TEMP\en-US\ointer.bat2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "BackupNonMaintenance"3⤵
-
-
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 20082⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 20083⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\TEMP\en-US\flexi.dll,UILOIPE1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ointer.bat
ointer.bat
rrMTWHKr.dll
memory/4136-112-0x00007FFE97250000-0x00007FFE97260000-memory.dmp
memory/4136-113-0x00007FFE97250000-0x00007FFE97260000-memory.dmp
memory/4136-114-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4136-111-0x00007FFE97250000-0x00007FFE97260000-memory.dmp
memory/4136-110-0x00007FFE97250000-0x00007FFE97260000-memory.dmp
memory/4136-97-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-42-0x0000018C576E0000-0x0000018C57AE0000-memory.dmp
memory/4672-56-0x0000018C5E300000-0x0000018C5E305000-memory.dmp
memory/4672-10-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-13-0x00007FFE94DB0000-0x00007FFE94DC0000-memory.dmp
memory/4672-12-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-15-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-16-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-17-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-18-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-19-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-21-0x00007FFE94DB0000-0x00007FFE94DC0000-memory.dmp
memory/4672-20-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-14-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-0-0x00007FFE97250000-0x00007FFE97260000-memory.dmp
memory/4672-49-0x0000018C59A50000-0x0000018C5AA20000-memory.dmp
memory/4672-50-0x0000018C58970000-0x0000018C59170000-memory.dmp
memory/4672-55-0x0000018C58970000-0x0000018C59170000-memory.dmp
memory/4672-11-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-57-0x0000018C5E310000-0x0000018C5E810000-memory.dmp
memory/4672-1-0x00007FFE97250000-0x00007FFE97260000-memory.dmp
memory/4672-8-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-77-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-78-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-79-0x0000018C576E0000-0x0000018C57AE0000-memory.dmp
memory/4672-80-0x0000018C58970000-0x0000018C59170000-memory.dmp
memory/4672-81-0x0000018C59A50000-0x0000018C5AA20000-memory.dmp
memory/4672-9-0x00007FFE97250000-0x00007FFE97260000-memory.dmp
memory/4672-7-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-6-0x00007FFE97250000-0x00007FFE97260000-memory.dmp
memory/4672-5-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-3-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-4-0x00007FFE97250000-0x00007FFE97260000-memory.dmp
memory/4672-2-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-115-0x00007FFED71D0000-0x00007FFED73C5000-memory.dmp
memory/4672-116-0x0000018C5E300000-0x0000018C5E305000-memory.dmp