Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27-04-2024 22:20

General

  • Target

    8570.docx

  • Size

    10KB

  • MD5

    9be77964c8027c03ad80ecaa07c05a3c

  • SHA1

    bf53b1711cd873ab85530e088681b23c4e1a602d

  • SHA256

    426b5f7927248c353e67c0dc26df4ca9d83352dde18fac0bf44c77f57c9decc9

  • SHA512

    b1ae81ebf3417ab427a073a30c0ba5ebcb34390b0106e34a50e6c21133d8967ed418e00ceb992a3bbb7b84866b64c4cac486a0b4a3cb059c5bd10530983e4ad1

  • SSDEEP

    192:1tK178MIr45yMtWN7Qirdl1bL0mqQTnhr5O5QT1QmP55xIbFTB8GoA6avmjq:1tK5zyMti7Qij1btLO5QT1QmDxGdzmO

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\8570.docx"
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2280

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD
      Filesize

      128KB

      MD5

      3a87e3e857f0f0633436f4725fe567ad

      SHA1

      23092e85a3953d0f74556845e752003948a91c64

      SHA256

      b85f2f2250b195a8d88c038350b5d294e5111d034a42075823b1247bd1abb97f

      SHA512

      ad63e32046232da346dba53f20c0d51ce525713fed8d1df94653634e9fcecd8ff047df852b9a34e00999f940e3dd09add626e00df9cdacb07d8ae78a44afa9f4

    • C:\Users\Admin\AppData\Local\Temp\{747DE148-23EE-4BDF-B474-75350F33A985}
      Filesize

      128KB

      MD5

      6c1e9f199f53a1a8a6229fea2df752c6

      SHA1

      4d7bad97bcc6678d663b1f1af29157e5550380b1

      SHA256

      3d3e3a92b82b7baef13978029012b5aea43ff13bdebbfd91b7ed59f0eb61b809

      SHA512

      cd825fddf88019bf0c38eea3ff0676d6655ac60a59748db1112981cbb6785f64c4e97d9c341b4f70463a166fdb24da7c244f34e814b021eaaa703e05badd61f0

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      0148be0d72b5b5911748b0f3d8ca8c75

      SHA1

      fa26ac512ca3dc04032228459830abcae0f61587

      SHA256

      9394d6c33cdc15a58964e97f3356b0eefcb4004075987af1c518d529d90bcb43

      SHA512

      2ff10bf5b0ebec40c6ee799d4fcd97bd33510405b3d79919eb82e53749d03585214885b649ab086d9965a04bd3a7d2a6181ae912fc4136936ea85b2d7dbe0803

    • memory/2740-0-0x000000002F5C1000-0x000000002F5C2000-memory.dmp
      Filesize

      4KB

    • memory/2740-1-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/2740-2-0x00000000716FD000-0x0000000071708000-memory.dmp
      Filesize

      44KB

    • memory/2740-68-0x00000000716FD000-0x0000000071708000-memory.dmp
      Filesize

      44KB

    • memory/2740-89-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/2740-90-0x00000000716FD000-0x0000000071708000-memory.dmp
      Filesize

      44KB