772c897ffdfb824b31d70ea360224714ab9bb83659bd431897cc74dd2defc2f3

General

Target

0113_35727287.doc
Size

633KB
MD5

e688ebdab6916fc89610c89ccb94ce16
SHA1

a91447a728148e321fc576c6b55b3e9ba886bb8a
SHA256

772c897ffdfb824b31d70ea360224714ab9bb83659bd431897cc74dd2defc2f3
SHA512

7ec1f08fff2ae185421ddf6e1089349b1e9a0c0123c75d147b80c5ae0fc18938c2f781fc44d84e8abe0c4e251dbdfe3ea9499087345c39291fa96b9d18a39bf2

Score

10^/10

spyware

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	1268	744	rundll32.exe	WINWORD.EXE

Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

29 776 rundll32.exe
31 776 rundll32.exe
37 776 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

776 rundll32.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

28 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 776 set thread context of 3088 776 rundll32.exe svchost.exe

flow	pid	process
29	776	rundll32.exe
31	776	rundll32.exe
37	776	rundll32.exe

pid	process
776	rundll32.exe

flow	ioc
28	api.ipify.org

description	pid	process	target process
PID 776 set thread context of 3088	776	rundll32.exe	svchost.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEsvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

NTFS ADS 1 IoCs

Processes:

WINWORD.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{4DCB2932-F441-44F4-AD56-55653042DB93}\0fiasS.tmp:Zone.Identifier	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

744 WINWORD.EXE
744 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exesvchost.exe

pid process

776 rundll32.exe
776 rundll32.exe
3088 svchost.exe
3088 svchost.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

744 WINWORD.EXE
744 WINWORD.EXE
744 WINWORD.EXE
744 WINWORD.EXE
744 WINWORD.EXE
744 WINWORD.EXE
744 WINWORD.EXE

pid	process
744	WINWORD.EXE
744	WINWORD.EXE

pid	process
776	rundll32.exe
776	rundll32.exe
3088	svchost.exe
3088	svchost.exe

pid	process
744	WINWORD.EXE
744	WINWORD.EXE
744	WINWORD.EXE
744	WINWORD.EXE
744	WINWORD.EXE
744	WINWORD.EXE
744	WINWORD.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

WINWORD.EXErundll32.exerundll32.exe

description	pid	process	target process
PID 744 wrote to memory of 1224	744	WINWORD.EXE	splwow64.exe
PID 744 wrote to memory of 1224	744	WINWORD.EXE	splwow64.exe
PID 744 wrote to memory of 1268	744	WINWORD.EXE	rundll32.exe
PID 744 wrote to memory of 1268	744	WINWORD.EXE	rundll32.exe
PID 1268 wrote to memory of 776	1268	rundll32.exe	rundll32.exe
PID 1268 wrote to memory of 776	1268	rundll32.exe	rundll32.exe
PID 1268 wrote to memory of 776	1268	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 3088	776	rundll32.exe	svchost.exe
PID 776 wrote to memory of 3088	776	rundll32.exe	svchost.exe
PID 776 wrote to memory of 3088	776	rundll32.exe	svchost.exe
PID 776 wrote to memory of 3088	776	rundll32.exe	svchost.exe
PID 776 wrote to memory of 3088	776	rundll32.exe	svchost.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0113_35727287.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1224

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Templates\W0rd.dll,DllUnregisterServer
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Templates\W0rd.dll,DllUnregisterServer
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\svchost.exe
C:\Windows\System32\svchost.exe
4⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3088

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\W0rd.dll
MD5
42110f172919873c9223905914aa5d50

SHA1
8d4f5109d6a415208c9040a11e1349ff7485f4b0

SHA256
288fdf9c64da0251107df7f1c3283f328279ad581710a9cf71f67e53b0b1684d

SHA512
3b5e9cabe445891663926e8c21eac6634c5de7487863179965b1b5ecaff3a664427894d3e1f7d45203c7cb593f26c2786d47c77f8ab7b5ae8bbe726677b19501

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Templates\W0rd.dll
MD5
42110f172919873c9223905914aa5d50

SHA1
8d4f5109d6a415208c9040a11e1349ff7485f4b0

SHA256
288fdf9c64da0251107df7f1c3283f328279ad581710a9cf71f67e53b0b1684d

SHA512
3b5e9cabe445891663926e8c21eac6634c5de7487863179965b1b5ecaff3a664427894d3e1f7d45203c7cb593f26c2786d47c77f8ab7b5ae8bbe726677b19501

Download Submit
memory/744-2-0x00007FFF69620000-0x00007FFF69C57000-memory.dmp

Filesize
6.2MB

Download
memory/776-7-0x0000000000000000-mapping.dmp

Download
memory/1224-3-0x0000000000000000-mapping.dmp

Download
memory/1224-4-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/1268-5-0x0000000000000000-mapping.dmp

Download
memory/3088-9-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3088-10-0x0000000000401480-mapping.dmp

Download
memory/3088-11-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads