a861f29a0b1f6cc24f3090bb4260cb9388466326e9d320db378f3bdc08e7c267

General

Target

ordinare_12.01.2020.doc
Size

91KB
MD5

5cebb6813b6717852b51bb82235bf5a6
SHA1

6c465ea7366e478013f1581a2e4a57675b767f0d
SHA256

a861f29a0b1f6cc24f3090bb4260cb9388466326e9d320db378f3bdc08e7c267
SHA512

d174ee80939b84a89e69f1912ee835cfa10b9e7c79613264cc862717c27c137a861d40b7f2ddcaf90804146370c8d68b596f536434ce09035bcf1ff65c3c8342

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ms.com

pid process

820 ms.com
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1600 regsvr32.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

pid	process
820	ms.com

pid	process
1600	regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeWINWORD.EXEIEXPLORE.EXEms.com

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B24CE521-3570-11EB-ACC0-D2F6D50BABC0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main	ms.com
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

800 WINWORD.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1192 iexplore.exe

pid	process
1192	iexplore.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

WINWORD.EXEiexplore.exeIEXPLORE.EXE

pid	process
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
1192	iexplore.exe
1192	iexplore.exe
1576	IEXPLORE.EXE
1576	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

WINWORD.EXEms.comiexplore.exe

description	pid	process	target process
PID 800 wrote to memory of 1640	800	WINWORD.EXE	splwow64.exe
PID 800 wrote to memory of 1640	800	WINWORD.EXE	splwow64.exe
PID 800 wrote to memory of 1640	800	WINWORD.EXE	splwow64.exe
PID 800 wrote to memory of 1640	800	WINWORD.EXE	splwow64.exe
PID 820 wrote to memory of 1600	820	ms.com	regsvr32.exe
PID 820 wrote to memory of 1600	820	ms.com	regsvr32.exe
PID 820 wrote to memory of 1600	820	ms.com	regsvr32.exe
PID 820 wrote to memory of 1600	820	ms.com	regsvr32.exe
PID 820 wrote to memory of 1600	820	ms.com	regsvr32.exe
PID 820 wrote to memory of 1600	820	ms.com	regsvr32.exe
PID 820 wrote to memory of 1600	820	ms.com	regsvr32.exe
PID 1192 wrote to memory of 1576	1192	iexplore.exe	IEXPLORE.EXE
PID 1192 wrote to memory of 1576	1192	iexplore.exe	IEXPLORE.EXE
PID 1192 wrote to memory of 1576	1192	iexplore.exe	IEXPLORE.EXE
PID 1192 wrote to memory of 1576	1192	iexplore.exe	IEXPLORE.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ordinare_12.01.2020.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1640

C:\users\public\ms.com
C:\users\public\ms.com C:\users\public\ms.html
1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:820

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\temp.tmp
2⤵
- Loads dropped DLL
PID:1600

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1192 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\temp.tmp
MD5
5ef10b7334c3ed9f0c905339f5aa1b46

SHA1
2a3870cf287b9d24f1a9112955308eece5cdcc03

SHA256
4457d83321c2ff730f7ed316daff71b37b4ba420bf2f6af3bc9551b627ff1469

SHA512
22b05b19f5f5c25b6bd3f0d7c824381f194cf4e3e35fbe04601c50bf5f4c58e89524347f69230df7e669b5afc6d8370bbcb3b40def3033388a2956a67956c18e

Download Submit
C:\Users\Public\ms.com
MD5
abdfc692d9fe43e2ba8fe6cb5a8cb95a

SHA1
d4f0397f83083e1c6fb0894187cc72aebcf2f34f

SHA256
949485ba939953642714ae6831d7dcb261691cac7cbb8c1a9220333801f60820

SHA512
c786bfb6a2316e43cb89901fae103157ec6b65117c292dc7570dd4685891b5afbb72064789b74bf55fe012c5936ed6468876e4d2cccdeff71b4abb2d76ff395f

Download Submit
C:\users\public\ms.com
MD5
abdfc692d9fe43e2ba8fe6cb5a8cb95a

SHA1
d4f0397f83083e1c6fb0894187cc72aebcf2f34f

SHA256
949485ba939953642714ae6831d7dcb261691cac7cbb8c1a9220333801f60820

SHA512
c786bfb6a2316e43cb89901fae103157ec6b65117c292dc7570dd4685891b5afbb72064789b74bf55fe012c5936ed6468876e4d2cccdeff71b4abb2d76ff395f

Download Submit
C:\users\public\ms.html
MD5
7f908f1ee0bbb0b276589f06368a008d

SHA1
ee9d0fa4c45aeb9c75750aa003e7c0f0f22e348d

SHA256
8b23a9189fd2fe4cc89459224ed36e7a64121de9589d3ac9ceae9e4deef7f23a

SHA512
3fbebbcd1b5f2a731470037a702ba58eefbc0764874d465539e90b6fcd4ba16e93221e8eb402bf2d3b603a6b4d81e3b1a2e68ea3625a93716f4ef991fa625633

Download Submit
\Users\Admin\AppData\Local\Temp\temp.tmp
MD5
5ef10b7334c3ed9f0c905339f5aa1b46

SHA1
2a3870cf287b9d24f1a9112955308eece5cdcc03

SHA256
4457d83321c2ff730f7ed316daff71b37b4ba420bf2f6af3bc9551b627ff1469

SHA512
22b05b19f5f5c25b6bd3f0d7c824381f194cf4e3e35fbe04601c50bf5f4c58e89524347f69230df7e669b5afc6d8370bbcb3b40def3033388a2956a67956c18e

Download Submit
memory/800-5-0x0000000004C80000-0x0000000004CE5000-memory.dmp

Filesize
404KB

Download
memory/800-6-0x0000000004C80000-0x0000000004CE5000-memory.dmp

Filesize
404KB

Download
memory/800-2-0x0000000004C80000-0x0000000004CE5000-memory.dmp

Filesize
404KB

Download
memory/800-4-0x0000000004C80000-0x0000000004CE5000-memory.dmp

Filesize
404KB

Download
memory/800-3-0x0000000000556000-0x0000000000559000-memory.dmp

Filesize
12KB

Download
memory/1576-15-0x0000000000000000-mapping.dmp

Download
memory/1576-16-0x0000000005EF0000-0x0000000005F13000-memory.dmp

Filesize
140KB

Download
memory/1600-12-0x0000000000000000-mapping.dmp

Download
memory/1640-8-0x0000000000000000-mapping.dmp

Download
memory/2024-10-0x000007FEF6EA0000-0x000007FEF711A000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads