2966d4d96bf053a15a2665464327f3fd5165bd03587679452b1db4f3f03946e9

General

Target

OmeksBlank.doc
Size

37KB
MD5

51f6b8678de15611bf15e7544dc87c87
SHA1

4d04e4490d3bb3590d94bb2dc8038011fadfbec4
SHA256

2966d4d96bf053a15a2665464327f3fd5165bd03587679452b1db4f3f03946e9
SHA512

fdef0c2194c02d39372f6c3e80ddfb27fa35700cda378af60073c017da30df5b8d8dadb022851edf777c69b84fd4e9a754c1fd823fae5408a3e795f2d2b930b0

Score

8^/10

pyinstaller

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

OfficePresentation.exeOfficePresentation.exe

pid	Process
852	OfficePresentation.exe
840	OfficePresentation.exe

Loads dropped DLL 3 IoCs

Processes:

OfficePresentation.exe

pid	Process
1516
840	OfficePresentation.exe
1200

Drops file in Program Files directory 1 IoCs

Processes:

WINWORD.EXE

description	ioc	Process
File created	C:\Program Files\Windows Media Player\OfficePresentation.exe	WINWORD.EXE

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Detects Pyinstaller 5 IoCs

pyinstaller

Processes:

resource	yara_rule
behavioral1/files/0x00030000000130ec-7.dat	pyinstaller
behavioral1/files/0x00030000000130ec-8.dat	pyinstaller
behavioral1/files/0x00030000000130ec-9.dat	pyinstaller
behavioral1/files/0x00030000000130ec-11.dat	pyinstaller
behavioral1/files/0x00030000000130ec-15.dat	pyinstaller

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid	Process
384	WINWORD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OfficePresentation.exe

pid	Process
840	OfficePresentation.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid	Process
384	WINWORD.EXE
384	WINWORD.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

WINWORD.EXEOfficePresentation.exe

description	pid	Process	procid_target
PID 384 wrote to memory of 2032	384	WINWORD.EXE	26
PID 384 wrote to memory of 2032	384	WINWORD.EXE	26
PID 384 wrote to memory of 2032	384	WINWORD.EXE	26
PID 384 wrote to memory of 2032	384	WINWORD.EXE	26
PID 852 wrote to memory of 840	852	OfficePresentation.exe	33
PID 852 wrote to memory of 840	852	OfficePresentation.exe	33
PID 852 wrote to memory of 840	852	OfficePresentation.exe	33

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\OmeksBlank.doc"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2032

C:\Program Files\Windows Media Player\OfficePresentation.exe
"C:/Program Files/Windows Media Player/OfficePresentation.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852
- C:\Program Files\Windows Media Player\OfficePresentation.exe
  "C:/Program Files/Windows Media Player/OfficePresentation.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Media Player\OfficePresentation.exe

MD5
de6717de7bd1daa595c0b00887c25f05

SHA1
f70cc94796e6f89499a3958d7fd2001e50a984f0

SHA256
95cfd76bfea8839d2c545cc10d1c94131868471d51ccb8a4525058f591f92b44

SHA512
eca079d83bd0c0e57e64479dcaf4437c0029a13e1506d117a6f4a139439e4dfacc2b5271822d8b1fc08219bebee9f2c788284290f74aca3d0ac77184e804303b

Download Submit
C:\Program Files\Windows Media Player\OfficePresentation.exe

MD5
de6717de7bd1daa595c0b00887c25f05

SHA1
f70cc94796e6f89499a3958d7fd2001e50a984f0

SHA256
95cfd76bfea8839d2c545cc10d1c94131868471d51ccb8a4525058f591f92b44

SHA512
eca079d83bd0c0e57e64479dcaf4437c0029a13e1506d117a6f4a139439e4dfacc2b5271822d8b1fc08219bebee9f2c788284290f74aca3d0ac77184e804303b

Download Submit
C:\Program Files\Windows Media Player\OfficePresentation.exe

MD5
de6717de7bd1daa595c0b00887c25f05

SHA1
f70cc94796e6f89499a3958d7fd2001e50a984f0

SHA256
95cfd76bfea8839d2c545cc10d1c94131868471d51ccb8a4525058f591f92b44

SHA512
eca079d83bd0c0e57e64479dcaf4437c0029a13e1506d117a6f4a139439e4dfacc2b5271822d8b1fc08219bebee9f2c788284290f74aca3d0ac77184e804303b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8522\python39.dll

MD5
c4b75218b11808db4a04255574b2eb33

SHA1
f4a3497fb6972037fb271cfdc5b404a4b28ccf07

SHA256
53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2

SHA512
0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

Download Submit
\Program Files\Windows Media Player\OfficePresentation.exe

MD5
de6717de7bd1daa595c0b00887c25f05

SHA1
f70cc94796e6f89499a3958d7fd2001e50a984f0

SHA256
95cfd76bfea8839d2c545cc10d1c94131868471d51ccb8a4525058f591f92b44

SHA512
eca079d83bd0c0e57e64479dcaf4437c0029a13e1506d117a6f4a139439e4dfacc2b5271822d8b1fc08219bebee9f2c788284290f74aca3d0ac77184e804303b

Download Submit
\Program Files\Windows Media Player\OfficePresentation.exe

MD5
de6717de7bd1daa595c0b00887c25f05

SHA1
f70cc94796e6f89499a3958d7fd2001e50a984f0

SHA256
95cfd76bfea8839d2c545cc10d1c94131868471d51ccb8a4525058f591f92b44

SHA512
eca079d83bd0c0e57e64479dcaf4437c0029a13e1506d117a6f4a139439e4dfacc2b5271822d8b1fc08219bebee9f2c788284290f74aca3d0ac77184e804303b

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI8522\python39.dll

MD5
c4b75218b11808db4a04255574b2eb33

SHA1
f4a3497fb6972037fb271cfdc5b404a4b28ccf07

SHA256
53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2

SHA512
0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

Download Submit
memory/384-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/384-2-0x0000000072581000-0x0000000072584000-memory.dmp

Filesize
12KB

Download
memory/384-3-0x0000000070001000-0x0000000070003000-memory.dmp

Filesize
8KB

Download
memory/840-10-0x0000000000000000-mapping.dmp

Download
memory/2032-5-0x0000000000000000-mapping.dmp

Download
memory/2032-6-0x000007FEFB9D1000-0x000007FEFB9D3000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads