33a24ad4b225880bee5c9d40527022ea020daf2f6d7643269f4f739b3271f5de

Target

HRCComplaintProcedureForm (7).doc
Size

80KB
MD5

a411bb05ee4192202c88efdbd54552db
SHA1

6b0acf8175d39a1008bf9fb0d3c45bb63a3361e9
SHA256

33a24ad4b225880bee5c9d40527022ea020daf2f6d7643269f4f739b3271f5de
SHA512

6e424b2c2a7881d4969ddfaef595822f3d987e8fc49f578118c6d4ba25461ef53613405394f4ac366606ecfda08ede4d22f436f182aaee82ba9b5f7962cce6f4

Score

5^/10

persistence

Malware Config

Signatures

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe

Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1068 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

PowerShell_ISE.exe

pid process

1880 PowerShell_ISE.exe

pid	process
1068	WINWORD.EXE

pid	process
1880	PowerShell_ISE.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

PowerShell_ISE.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1880	PowerShell_ISE.exe
Token: SeBackupPrivilege	1668	vssvc.exe
Token: SeRestorePrivilege	1668	vssvc.exe
Token: SeAuditPrivilege	1668	vssvc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1068 WINWORD.EXE
1068 WINWORD.EXE

pid	process
1068	WINWORD.EXE
1068	WINWORD.EXE

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\HRCComplaintProcedureForm (7).doc"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1068

C:\Windows\sysWOW64\WindowsPowerShell\v1.0\PowerShell_ISE.exe
"C:\Windows\sysWOW64\WindowsPowerShell\v1.0\PowerShell_ISE.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1668

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1880-0-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/1880-1-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Filesize
4KB

Download
memory/1880-2-0x00000000047F0000-0x00000000047F1000-memory.dmp

Filesize
4KB

Download
memory/1880-3-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/1880-4-0x0000000005CA0000-0x0000000005CA1000-memory.dmp

Filesize
4KB

Download
memory/1880-5-0x0000000005EC0000-0x0000000005EC1000-memory.dmp

Filesize
4KB

Download
memory/1880-6-0x00000000053C0000-0x00000000053C1000-memory.dmp

Filesize
4KB

Download
memory/1880-7-0x0000000006630000-0x0000000006631000-memory.dmp

Filesize
4KB

Download
memory/1880-8-0x000000000A320000-0x000000000A321000-memory.dmp

Filesize
4KB

Download
memory/1880-11-0x000000000A740000-0x000000000A741000-memory.dmp

Filesize
4KB

Download
memory/1880-16-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download
memory/1880-17-0x000000000A9E0000-0x000000000A9E1000-memory.dmp

Filesize
4KB

Download
memory/1880-24-0x000000000A960000-0x000000000A961000-memory.dmp

Filesize
4KB

Download
memory/1880-25-0x000000000A780000-0x000000000A781000-memory.dmp

Filesize
4KB

Download
memory/1880-39-0x000000000AAC0000-0x000000000AAC1000-memory.dmp

Filesize
4KB

Download
memory/1880-40-0x000000000AAE0000-0x000000000AAE1000-memory.dmp

Filesize
4KB

Download
memory/1880-41-0x000000000D900000-0x000000000D901000-memory.dmp

Filesize
4KB

Download
memory/1880-42-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/1880-48-0x0000000005280000-0x0000000005281000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General