Analysis

  • max time kernel
    149s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 10:22

General

  • Target

    388f212dfca2bfb5db0a8b9958a43da6860298cdd4fcd53ed2c75e3b059ee622.docm

  • Size

    257KB

  • MD5

    c34bb2fdbce2524c8aa74fe8149952a9

  • SHA1

    159345bbeabf12c423f418f7788e525c5f377b2a

  • SHA256

    388f212dfca2bfb5db0a8b9958a43da6860298cdd4fcd53ed2c75e3b059ee622

  • SHA512

    c1d8798ea907cf4386da9b73b9c85a75af49def54e921d3f76463c3d23bd8c257bef33e0920e64f712ae29a9616f1eb8d9cb7879045b3a52441229371f1f06a0

  • SSDEEP

    6144:k3dDZWGnv6NPtk+q1w4znZSXrQxTQNv8D6ktI9GqXFG:k3dDZWGy4Dw4zZSXrgTQNv8DtWn1G

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\388f212dfca2bfb5db0a8b9958a43da6860298cdd4fcd53ed2c75e3b059ee622.docm" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\ProgramData\W0il\Earthquake.exe
      C:\ProgramData\W0il\Earthquake.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3444

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\W0il\Earthquake.exe

          Filesize

          47KB

          MD5

          0159c86ff9e92590335e438b5ebae2de

          SHA1

          1fe5a658143d1fc34646bf767956a8f4b842773e

          SHA256

          8c9b0fd259e7f016f53be8edc53fe5f908b48ae691e21f0f820da11429e595d8

          SHA512

          9008e6ae1fc00e465ac4ed575b1cdb1666075236c6e459dc15390202d0fe3cd6479564976d4549e27cc005e357d3d4ee2d3d6c2b892fa46d6fcdc43142bbf986

        • C:\ProgramData\W0il\Earthquake.zip

          Filesize

          23KB

          MD5

          81fdfe3078cb5a0ce3aadedfb7aca2f3

          SHA1

          cffc2751fca2bf23f024666e14ddf28bb18719a8

          SHA256

          1986757926bdd5aaf7cc3606cabe97c2181acabe1eec97cf7ceff88d50ef9719

          SHA512

          913894f9122722386a3b6ddf5ba0b793e68e04a7f1567baf1d90d5180b1602055ce4df710f55bf0bcf2d297afb84b1c7912fc943160d4335e2f2a57237b1c7e9

        • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

          Filesize

          2B

          MD5

          f3b25701fe362ec84616a93a45ce9998

          SHA1

          d62636d8caec13f04e28442a0a6fa1afeb024bbb

          SHA256

          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

          SHA512

          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

        • memory/3048-20-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-17-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-4-0x00007FFEA2870000-0x00007FFEA2880000-memory.dmp

          Filesize

          64KB

        • memory/3048-6-0x00007FFEA2870000-0x00007FFEA2880000-memory.dmp

          Filesize

          64KB

        • memory/3048-7-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-8-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-9-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-10-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-12-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-11-0x00007FFEA0120000-0x00007FFEA0130000-memory.dmp

          Filesize

          64KB

        • memory/3048-13-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-14-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-15-0x00007FFEA0120000-0x00007FFEA0130000-memory.dmp

          Filesize

          64KB

        • memory/3048-16-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-18-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-19-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-23-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-0-0x00007FFEA2870000-0x00007FFEA2880000-memory.dmp

          Filesize

          64KB

        • memory/3048-5-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-22-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-49-0x000001101B770000-0x000001101C740000-memory.dmp

          Filesize

          15.8MB

        • memory/3048-30-0x000001101E510000-0x000001101E710000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-3-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-29-0x000001101B770000-0x000001101C740000-memory.dmp

          Filesize

          15.8MB

        • memory/3048-2-0x00007FFEA2870000-0x00007FFEA2880000-memory.dmp

          Filesize

          64KB

        • memory/3048-66-0x000001101B770000-0x000001101C740000-memory.dmp

          Filesize

          15.8MB

        • memory/3048-102-0x000001101B770000-0x000001101C740000-memory.dmp

          Filesize

          15.8MB

        • memory/3048-101-0x000001101B770000-0x000001101C740000-memory.dmp

          Filesize

          15.8MB

        • memory/3048-100-0x000001101E510000-0x000001101E710000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-1-0x00007FFEA2870000-0x00007FFEA2880000-memory.dmp

          Filesize

          64KB

        • memory/3048-91-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-97-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-98-0x00007FFEE27F0000-0x00007FFEE29E5000-memory.dmp

          Filesize

          2.0MB

        • memory/3048-99-0x000001101B770000-0x000001101C740000-memory.dmp

          Filesize

          15.8MB

        • memory/3444-70-0x000001BC746D0000-0x000001BC746E0000-memory.dmp

          Filesize

          64KB

        • memory/3444-69-0x00007FFEB6E80000-0x00007FFEB7941000-memory.dmp

          Filesize

          10.8MB

        • memory/3444-68-0x000001BC72A00000-0x000001BC72A12000-memory.dmp

          Filesize

          72KB

        • memory/3444-103-0x00007FFEB6E80000-0x00007FFEB7941000-memory.dmp

          Filesize

          10.8MB

        • memory/3444-104-0x000001BC746D0000-0x000001BC746E0000-memory.dmp

          Filesize

          64KB