aa148483dfb6570d166b18430f7a1e6b0496ef687589b38ba5ab1b2b5bdff682

General

Target

3f717df21dee2bd51394424c8be036fe.doc
Size

365KB
MD5

3f717df21dee2bd51394424c8be036fe
SHA1

d20436e843e4159f29737fab5e812406eb6512d4
SHA256

aa148483dfb6570d166b18430f7a1e6b0496ef687589b38ba5ab1b2b5bdff682
SHA512

f79b8d1f53b243929fa307560aa605d522c5c71c606166557cd9bf095c8393c188bab9aaaff38456552e8a9b08457c36ca522369f40e2ccc097e86ee369ecad9

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1964	1204	powershell.exe	WINWORD.EXE

Executes dropped EXE 1 IoCs

Processes:

803d76071.exe

pid process

1064 803d76071.exe
Loads dropped DLL 4 IoCs

Processes:

powershell.exe

pid process

1964 powershell.exe
1964 powershell.exe
1964 powershell.exe
1964 powershell.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

pid	process
1064	803d76071.exe

pid	process
1964	powershell.exe
1964	powershell.exe
1964	powershell.exe
1964	powershell.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1204 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1964 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1964 powershell.exe

pid	process
1964	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1964	powershell.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE

pid	process
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

WINWORD.EXEpowershell.exe

description	pid	process	target process
PID 1204 wrote to memory of 1964	1204	WINWORD.EXE	powershell.exe
PID 1204 wrote to memory of 1964	1204	WINWORD.EXE	powershell.exe
PID 1204 wrote to memory of 1964	1204	WINWORD.EXE	powershell.exe
PID 1204 wrote to memory of 1964	1204	WINWORD.EXE	powershell.exe
PID 1204 wrote to memory of 1772	1204	WINWORD.EXE	splwow64.exe
PID 1204 wrote to memory of 1772	1204	WINWORD.EXE	splwow64.exe
PID 1204 wrote to memory of 1772	1204	WINWORD.EXE	splwow64.exe
PID 1204 wrote to memory of 1772	1204	WINWORD.EXE	splwow64.exe
PID 1964 wrote to memory of 1064	1964	powershell.exe	803d76071.exe
PID 1964 wrote to memory of 1064	1964	powershell.exe	803d76071.exe
PID 1964 wrote to memory of 1064	1964	powershell.exe	803d76071.exe
PID 1964 wrote to memory of 1064	1964	powershell.exe	803d76071.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\3f717df21dee2bd51394424c8be036fe.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -noexit -ep bypass -c .\aaa.ps1
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964

C:\programdata\803d76071.exe
"C:\programdata\803d76071.exe"
3⤵
- Executes dropped EXE
PID:1064

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1772

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\803d76071.exe
MD5
bef2bcb61c1fa9af265659c4123c11ac

SHA1
76993db88b0f0c3ed6252b114636cf39a30220d6

SHA256
14dce17f99955f86b05970aa13e35680e879aaa190e598bdcdc4dbf54ee90734

SHA512
9072c3eb4f1ef3a8f15807db618af9180dd0b02bfaa9c0fc2191f9ec548f1e8ea837f14aeedda30e95781a5935e134f8ee40aa5c4ff0df5a32a0382ebc6af7eb

Download Submit
C:\programdata\803d76071.aaa
MD5
2bb165a96a9d2e77aa202b9ed6f30c48

SHA1
7120be00500f70ebceb9e24cdc692d390054a9e5

SHA256
bae2b1fe61602413ca6b39f7f8f35fcfcdd593c976f246942143313527dfe27f

SHA512
ba4a1c6360de1fdda0ae17afe7f441140620c7569842fdf407f9126e268dd436d478670d901648e2969b7fefaff9f15c0e4f4bd0ac282bc59871a8ebb1507567

Download Submit
C:\programdata\803d76071.exe
MD5
bef2bcb61c1fa9af265659c4123c11ac

SHA1
76993db88b0f0c3ed6252b114636cf39a30220d6

SHA256
14dce17f99955f86b05970aa13e35680e879aaa190e598bdcdc4dbf54ee90734

SHA512
9072c3eb4f1ef3a8f15807db618af9180dd0b02bfaa9c0fc2191f9ec548f1e8ea837f14aeedda30e95781a5935e134f8ee40aa5c4ff0df5a32a0382ebc6af7eb

Download Submit
C:\programdata\aaa.ps1
MD5
810a730741e2488360ec31da9103fe9c

SHA1
906010043149b15f38f40f8c98ef9e679a56b43a

SHA256
412a5f3572bfa31a27749c54b12c26302d75acfc2630c8627c9488b706e5327e

SHA512
125b5e8d34de6b6f3219ce89951570672857be92af8b8127344c0bdb1b1a5e8afa937cfc1e5e7e82772484d258214ae5e8a4f049d4dd5242d039995b71238c69

Download Submit
\ProgramData\803d76071.exe
MD5
bef2bcb61c1fa9af265659c4123c11ac

SHA1
76993db88b0f0c3ed6252b114636cf39a30220d6

SHA256
14dce17f99955f86b05970aa13e35680e879aaa190e598bdcdc4dbf54ee90734

SHA512
9072c3eb4f1ef3a8f15807db618af9180dd0b02bfaa9c0fc2191f9ec548f1e8ea837f14aeedda30e95781a5935e134f8ee40aa5c4ff0df5a32a0382ebc6af7eb

Download Submit
\ProgramData\803d76071.exe
MD5
bef2bcb61c1fa9af265659c4123c11ac

SHA1
76993db88b0f0c3ed6252b114636cf39a30220d6

SHA256
14dce17f99955f86b05970aa13e35680e879aaa190e598bdcdc4dbf54ee90734

SHA512
9072c3eb4f1ef3a8f15807db618af9180dd0b02bfaa9c0fc2191f9ec548f1e8ea837f14aeedda30e95781a5935e134f8ee40aa5c4ff0df5a32a0382ebc6af7eb

Download Submit
\ProgramData\803d76071.exe
MD5
bef2bcb61c1fa9af265659c4123c11ac

SHA1
76993db88b0f0c3ed6252b114636cf39a30220d6

SHA256
14dce17f99955f86b05970aa13e35680e879aaa190e598bdcdc4dbf54ee90734

SHA512
9072c3eb4f1ef3a8f15807db618af9180dd0b02bfaa9c0fc2191f9ec548f1e8ea837f14aeedda30e95781a5935e134f8ee40aa5c4ff0df5a32a0382ebc6af7eb

Download Submit
\ProgramData\803d76071.exe
MD5
bef2bcb61c1fa9af265659c4123c11ac

SHA1
76993db88b0f0c3ed6252b114636cf39a30220d6

SHA256
14dce17f99955f86b05970aa13e35680e879aaa190e598bdcdc4dbf54ee90734

SHA512
9072c3eb4f1ef3a8f15807db618af9180dd0b02bfaa9c0fc2191f9ec548f1e8ea837f14aeedda30e95781a5935e134f8ee40aa5c4ff0df5a32a0382ebc6af7eb

Download Submit
memory/1064-32-0x0000000000000000-mapping.dmp

Download
memory/1204-2-0x0000000000703000-0x0000000000707000-memory.dmp

Filesize
16KB

Download
memory/1772-4-0x0000000000000000-mapping.dmp

Download
memory/1964-8-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/1964-27-0x0000000006410000-0x0000000006411000-memory.dmp

Filesize
4KB

Download
memory/1964-20-0x0000000006520000-0x0000000006521000-memory.dmp

Filesize
4KB

Download
memory/1964-18-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download
memory/1964-13-0x0000000005750000-0x0000000005751000-memory.dmp

Filesize
4KB

Download
memory/1964-9-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download
memory/1964-7-0x00000000048F0000-0x00000000048F1000-memory.dmp

Filesize
4KB

Download
memory/1964-6-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/1964-5-0x000000006AAA0000-0x000000006B18E000-memory.dmp

Filesize
6.9MB

Download
memory/1964-3-0x0000000000000000-mapping.dmp

Download
memory/1964-36-0x0000000006370000-0x0000000006371000-memory.dmp

Filesize
4KB

Download
memory/1964-50-0x0000000006880000-0x0000000006881000-memory.dmp

Filesize
4KB

Download
memory/1964-51-0x0000000006890000-0x0000000006891000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads