59d433bc2b7b0462f4866a79ae09c7a0ba5f61d9a1e427a174a21ace9a428d97

General

Target

richiedere,12.20.doc
Size

145KB
MD5

f6b2953ee71d517801697bb19e31b101
SHA1

6d7f15afba0bf1bf1f2cfb9d96a711ad714cce92
SHA256

59d433bc2b7b0462f4866a79ae09c7a0ba5f61d9a1e427a174a21ace9a428d97
SHA512

706896759453cf03abdcc2d64156209434e8c674379f26308b192c62b1857cd0d270cbc6e7b534de729d2d6c6e61ccc88521e37d1af67540333b7aa2865ad008

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1688	1408	regsvr32.exe	WINWORD.EXE

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1688 regsvr32.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

pid	process
1688	regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeWINWORD.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9DB751D1-3558-11EB-8489-EE45CAFA0C11} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "313759004"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 3 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1408 WINWORD.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1076 iexplore.exe

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
1076	iexplore.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

WINWORD.EXEiexplore.exeIEXPLORE.EXE

pid	process
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1076	iexplore.exe
1076	iexplore.exe
1220	IEXPLORE.EXE
1220	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

WINWORD.EXEiexplore.exe

description	pid	process	target process
PID 1408 wrote to memory of 1688	1408	WINWORD.EXE	regsvr32.exe
PID 1408 wrote to memory of 1688	1408	WINWORD.EXE	regsvr32.exe
PID 1408 wrote to memory of 1688	1408	WINWORD.EXE	regsvr32.exe
PID 1408 wrote to memory of 1688	1408	WINWORD.EXE	regsvr32.exe
PID 1408 wrote to memory of 1688	1408	WINWORD.EXE	regsvr32.exe
PID 1408 wrote to memory of 1688	1408	WINWORD.EXE	regsvr32.exe
PID 1408 wrote to memory of 1688	1408	WINWORD.EXE	regsvr32.exe
PID 1408 wrote to memory of 1664	1408	WINWORD.EXE	splwow64.exe
PID 1408 wrote to memory of 1664	1408	WINWORD.EXE	splwow64.exe
PID 1408 wrote to memory of 1664	1408	WINWORD.EXE	splwow64.exe
PID 1408 wrote to memory of 1664	1408	WINWORD.EXE	splwow64.exe
PID 1076 wrote to memory of 1220	1076	iexplore.exe	IEXPLORE.EXE
PID 1076 wrote to memory of 1220	1076	iexplore.exe	IEXPLORE.EXE
PID 1076 wrote to memory of 1220	1076	iexplore.exe	IEXPLORE.EXE
PID 1076 wrote to memory of 1220	1076	iexplore.exe	IEXPLORE.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\richiedere,12.20.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 c:\programdata\JUreF.pdf
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
PID:1688

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1664

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1220

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\programdata\JUreF.pdf
MD5
6dc320da82bfe9f897cd02fcd83c5d9b

SHA1
6ef252db67b1a0fe9b28c01cc6b7206fcb94a731

SHA256
31ace401668e11cf7874612cc2ce412dcb2ea96428e14f55364cde9214826023

SHA512
d9fea48b54e65439c650c9fa9ce3d70a485ba541710d160ff0dbdba5d21f1c7d22f89bd2bd0fe8fd247ad50da0ed9c452f3abd77aa9e86f580d359fa9cef65e6

Download Submit
\ProgramData\JUreF.pdf
MD5
6dc320da82bfe9f897cd02fcd83c5d9b

SHA1
6ef252db67b1a0fe9b28c01cc6b7206fcb94a731

SHA256
31ace401668e11cf7874612cc2ce412dcb2ea96428e14f55364cde9214826023

SHA512
d9fea48b54e65439c650c9fa9ce3d70a485ba541710d160ff0dbdba5d21f1c7d22f89bd2bd0fe8fd247ad50da0ed9c452f3abd77aa9e86f580d359fa9cef65e6

Download Submit
memory/1220-10-0x0000000000000000-mapping.dmp

Download
memory/1220-11-0x00000000068F0000-0x0000000006913000-memory.dmp

Filesize
140KB

Download
memory/1408-2-0x0000000000745000-0x0000000000748000-memory.dmp

Filesize
12KB

Download
memory/1408-3-0x00000000006FF000-0x000000000070A000-memory.dmp

Filesize
44KB

Download
memory/1408-4-0x000000000070A000-0x000000000070E000-memory.dmp

Filesize
16KB

Download
memory/1664-8-0x0000000000000000-mapping.dmp

Download
memory/1688-5-0x0000000000000000-mapping.dmp

Download
memory/2004-9-0x000007FEF6680000-0x000007FEF68FA000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads