b5a82f358804fb1b59046aaba192e8159c806b627aa63a648b210c88e02f38ab

General

Target

fatti_12.01.2020.doc
Size

91KB
MD5

01d08478561aed72242e32f692701293
SHA1

0da6033daef2c2db0da17c51b8620c9cec3c1477
SHA256

b5a82f358804fb1b59046aaba192e8159c806b627aa63a648b210c88e02f38ab
SHA512

e065eff23943ff8618704e866da6cb7759d3b19701085f5cc24eccbf790421907da1c66b87f4ea2b979b736f2d5ded97daa13da7560a94b4cea2b2bc31cb1542

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ms.com

pid process

1616 ms.com
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1592 regsvr32.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

pid	process
1616	ms.com

pid	process
1592	regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeWINWORD.EXEIEXPLORE.EXEms.com

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B31CC7E1-3570-11EB-9964-C611B4A1F110} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main	ms.com
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1084 WINWORD.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1468 iexplore.exe

pid	process
1468	iexplore.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

WINWORD.EXEiexplore.exeIEXPLORE.EXE

pid	process
1084	WINWORD.EXE
1084	WINWORD.EXE
1084	WINWORD.EXE
1084	WINWORD.EXE
1084	WINWORD.EXE
1084	WINWORD.EXE
1084	WINWORD.EXE
1084	WINWORD.EXE
1084	WINWORD.EXE
1084	WINWORD.EXE
1084	WINWORD.EXE
1084	WINWORD.EXE
1084	WINWORD.EXE
1084	WINWORD.EXE
1084	WINWORD.EXE
1084	WINWORD.EXE
1468	iexplore.exe
1468	iexplore.exe
844	IEXPLORE.EXE
844	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

WINWORD.EXEms.comiexplore.exe

description	pid	process	target process
PID 1084 wrote to memory of 1460	1084	WINWORD.EXE	splwow64.exe
PID 1084 wrote to memory of 1460	1084	WINWORD.EXE	splwow64.exe
PID 1084 wrote to memory of 1460	1084	WINWORD.EXE	splwow64.exe
PID 1084 wrote to memory of 1460	1084	WINWORD.EXE	splwow64.exe
PID 1616 wrote to memory of 1592	1616	ms.com	regsvr32.exe
PID 1616 wrote to memory of 1592	1616	ms.com	regsvr32.exe
PID 1616 wrote to memory of 1592	1616	ms.com	regsvr32.exe
PID 1616 wrote to memory of 1592	1616	ms.com	regsvr32.exe
PID 1616 wrote to memory of 1592	1616	ms.com	regsvr32.exe
PID 1616 wrote to memory of 1592	1616	ms.com	regsvr32.exe
PID 1616 wrote to memory of 1592	1616	ms.com	regsvr32.exe
PID 1468 wrote to memory of 844	1468	iexplore.exe	IEXPLORE.EXE
PID 1468 wrote to memory of 844	1468	iexplore.exe	IEXPLORE.EXE
PID 1468 wrote to memory of 844	1468	iexplore.exe	IEXPLORE.EXE
PID 1468 wrote to memory of 844	1468	iexplore.exe	IEXPLORE.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\fatti_12.01.2020.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1460

C:\users\public\ms.com
C:\users\public\ms.com C:\users\public\ms.html
1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\temp.tmp
2⤵
- Loads dropped DLL
PID:1592

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1468 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\temp.tmp
MD5
5ef10b7334c3ed9f0c905339f5aa1b46

SHA1
2a3870cf287b9d24f1a9112955308eece5cdcc03

SHA256
4457d83321c2ff730f7ed316daff71b37b4ba420bf2f6af3bc9551b627ff1469

SHA512
22b05b19f5f5c25b6bd3f0d7c824381f194cf4e3e35fbe04601c50bf5f4c58e89524347f69230df7e669b5afc6d8370bbcb3b40def3033388a2956a67956c18e

Download Submit
C:\Users\Public\ms.com
MD5
abdfc692d9fe43e2ba8fe6cb5a8cb95a

SHA1
d4f0397f83083e1c6fb0894187cc72aebcf2f34f

SHA256
949485ba939953642714ae6831d7dcb261691cac7cbb8c1a9220333801f60820

SHA512
c786bfb6a2316e43cb89901fae103157ec6b65117c292dc7570dd4685891b5afbb72064789b74bf55fe012c5936ed6468876e4d2cccdeff71b4abb2d76ff395f

Download Submit
C:\users\public\ms.com
MD5
abdfc692d9fe43e2ba8fe6cb5a8cb95a

SHA1
d4f0397f83083e1c6fb0894187cc72aebcf2f34f

SHA256
949485ba939953642714ae6831d7dcb261691cac7cbb8c1a9220333801f60820

SHA512
c786bfb6a2316e43cb89901fae103157ec6b65117c292dc7570dd4685891b5afbb72064789b74bf55fe012c5936ed6468876e4d2cccdeff71b4abb2d76ff395f

Download Submit
C:\users\public\ms.html
MD5
7f908f1ee0bbb0b276589f06368a008d

SHA1
ee9d0fa4c45aeb9c75750aa003e7c0f0f22e348d

SHA256
8b23a9189fd2fe4cc89459224ed36e7a64121de9589d3ac9ceae9e4deef7f23a

SHA512
3fbebbcd1b5f2a731470037a702ba58eefbc0764874d465539e90b6fcd4ba16e93221e8eb402bf2d3b603a6b4d81e3b1a2e68ea3625a93716f4ef991fa625633

Download Submit
\Users\Admin\AppData\Local\Temp\temp.tmp
MD5
5ef10b7334c3ed9f0c905339f5aa1b46

SHA1
2a3870cf287b9d24f1a9112955308eece5cdcc03

SHA256
4457d83321c2ff730f7ed316daff71b37b4ba420bf2f6af3bc9551b627ff1469

SHA512
22b05b19f5f5c25b6bd3f0d7c824381f194cf4e3e35fbe04601c50bf5f4c58e89524347f69230df7e669b5afc6d8370bbcb3b40def3033388a2956a67956c18e

Download Submit
memory/340-10-0x000007FEF7800000-0x000007FEF7A7A000-memory.dmp

Filesize
2.5MB

Download
memory/844-16-0x0000000006590000-0x00000000065B3000-memory.dmp

Filesize
140KB

Download
memory/844-15-0x0000000000000000-mapping.dmp

Download
memory/1084-4-0x000000000047D000-0x0000000000481000-memory.dmp

Filesize
16KB

Download
memory/1084-6-0x000000000047D000-0x0000000000481000-memory.dmp

Filesize
16KB

Download
memory/1084-2-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/1084-5-0x000000000047D000-0x0000000000481000-memory.dmp

Filesize
16KB

Download
memory/1084-3-0x00000000004CB000-0x00000000004D4000-memory.dmp

Filesize
36KB

Download
memory/1460-8-0x0000000000000000-mapping.dmp

Download
memory/1592-12-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads