Malware Analysis Report

2025-01-22 19:07

Sample ID 240719-ztz3gszcjr
Target 226ad9680e604d4d538fb5e48948f2a72084da86407a93bf7d4f2c9efbb2742c
SHA256 226ad9680e604d4d538fb5e48948f2a72084da86407a93bf7d4f2c9efbb2742c
Tags
macro macro_on_action
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

226ad9680e604d4d538fb5e48948f2a72084da86407a93bf7d4f2c9efbb2742c

Threat Level: Known bad

The file 226ad9680e604d4d538fb5e48948f2a72084da86407a93bf7d4f2c9efbb2742c was found to be: Known bad.

Malicious Activity Summary

macro macro_on_action

Process spawned unexpected child process

Suspicious Office macro

Office macro that triggers on suspicious action

Drops file in Windows directory

Office loads VBA resources, possible macro or embedded object present

Checks processor information in registry

Runs ping.exe

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-19 21:01

Signatures

Office macro that triggers on suspicious action

macro macro_on_action
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious Office macro

macro
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-19 21:01

Reported

2024-07-19 21:02

Platform

win10v2004-20240709-en

Max time kernel

35s

Max time network

36s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\226ad9680e604d4d538fb5e48948f2a72084da86407a93bf7d4f2c9efbb2742c.doc" /o ""

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process N/A C:\Windows\SYSTEM32\ping.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\ping.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2464 wrote to memory of 1268 N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE C:\Windows\SYSTEM32\ping.exe
PID 2464 wrote to memory of 1268 N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE C:\Windows\SYSTEM32\ping.exe

Processes

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\226ad9680e604d4d538fb5e48948f2a72084da86407a93bf7d4f2c9efbb2742c.doc" /o ""

C:\Windows\SYSTEM32\ping.exe

ping -n 1 149.28.22.48

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
NL 52.109.89.19:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 19.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 28.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 121.170.16.2.in-addr.arpa udp

Files

memory/2464-0-0x00007FFD19FD0000-0x00007FFD19FE0000-memory.dmp

memory/2464-2-0x00007FFD19FD0000-0x00007FFD19FE0000-memory.dmp

memory/2464-1-0x00007FFD19FD0000-0x00007FFD19FE0000-memory.dmp

memory/2464-4-0x00007FFD59FED000-0x00007FFD59FEE000-memory.dmp

memory/2464-5-0x00007FFD19FD0000-0x00007FFD19FE0000-memory.dmp

memory/2464-3-0x00007FFD19FD0000-0x00007FFD19FE0000-memory.dmp

memory/2464-8-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

memory/2464-6-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

memory/2464-7-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

memory/2464-9-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

memory/2464-13-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

memory/2464-15-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

memory/2464-18-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

memory/2464-17-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

memory/2464-19-0x00007FFD17670000-0x00007FFD17680000-memory.dmp

memory/2464-16-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

memory/2464-14-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

memory/2464-12-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

memory/2464-11-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

memory/2464-10-0x00007FFD17670000-0x00007FFD17680000-memory.dmp

memory/2464-30-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

memory/2464-31-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

memory/2464-40-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

memory/2464-59-0x00007FFD19FD0000-0x00007FFD19FE0000-memory.dmp

memory/2464-60-0x00007FFD19FD0000-0x00007FFD19FE0000-memory.dmp

memory/2464-62-0x00007FFD19FD0000-0x00007FFD19FE0000-memory.dmp

memory/2464-61-0x00007FFD19FD0000-0x00007FFD19FE0000-memory.dmp

memory/2464-63-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-19 21:01

Reported

2024-07-19 21:02

Platform

win7-20240704-en

Max time kernel

20s

Max time network

16s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\226ad9680e604d4d538fb5e48948f2a72084da86407a93bf7d4f2c9efbb2742c.doc"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\ping.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Office loads VBA resources, possible macro or embedded object present

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ping.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\226ad9680e604d4d538fb5e48948f2a72084da86407a93bf7d4f2c9efbb2742c.doc"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\SysWOW64\ping.exe

ping -n 1 149.28.22.48

Network

N/A

Files

memory/2092-0-0x000000002F3F1000-0x000000002F3F2000-memory.dmp

memory/2092-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2092-2-0x0000000070A9D000-0x0000000070AA8000-memory.dmp

memory/2092-7-0x0000000006280000-0x0000000006380000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 6f5f5dc733c9bcc25ce6cf7d33bd33da
SHA1 ed5d8a678c4b9012dff10248d117713913ad9bcf
SHA256 b3de183d129db2170cc9769d7415d7e36623b22384cd20c85038068efae207ab
SHA512 71e3593d36e2aa9f36eaf6fbaa3e19c5c56a28a6b5bae0669db68283ceb797bab8383fc9968ed8b61fa2d59ae45305cc32c8116206c905a605ae7e82ce3aca85

memory/2092-23-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2092-24-0x0000000070A9D000-0x0000000070AA8000-memory.dmp