453e7a4314783ccee4547d5be1f17bd841599bebe9f9f6d8d3ba0b05be7cb059

General

Target

instrument indenture.05.06.2021.doc
Size

79KB
MD5

c4b0617006900fdfdd3eaa762c68a8ef
SHA1

4ce54af01029c685759fe181dcc80633a0044630
SHA256

453e7a4314783ccee4547d5be1f17bd841599bebe9f9f6d8d3ba0b05be7cb059
SHA512

242fc7ce5d65647fd920d782d17427dec9e4cdd3e43f001fbb8dd04e35784e94bce2a4a7f7e76f1ebfa4675bdee7f5d426f2be54aa0e2a01781deb20199d0e12

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

explorer.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	2608	3872	explorer.exe	WINWORD.EXE

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 2496 created 1792 2496 WerFault.exe mshta.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3952 1792 WerFault.exe mshta.exe
2496 1792 WerFault.exe mshta.exe

description	pid	process	target process
PID 2496 created 1792	2496	WerFault.exe	mshta.exe

pid	pid_target	process	target process
3952	1792	WerFault.exe	mshta.exe
2496	1792	WerFault.exe	mshta.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings explorer.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3872 WINWORD.EXE
3872 WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

WerFault.exe

pid	process
3952	WerFault.exe
3952	WerFault.exe
3952	WerFault.exe
3952	WerFault.exe
3952	WerFault.exe
3952	WerFault.exe
3952	WerFault.exe
3952	WerFault.exe
3952	WerFault.exe
3952	WerFault.exe
3952	WerFault.exe
3952	WerFault.exe
3952	WerFault.exe
3952	WerFault.exe
3952	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3952 WerFault.exe
Token: SeBackupPrivilege 3952 WerFault.exe
Token: SeDebugPrivilege 3952 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3952	WerFault.exe
Token: SeBackupPrivilege	3952	WerFault.exe
Token: SeDebugPrivilege	3952	WerFault.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

WINWORD.EXE

pid	process
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE
3872	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

WINWORD.EXEexplorer.exe

description	pid	process	target process
PID 3872 wrote to memory of 2608	3872	WINWORD.EXE	explorer.exe
PID 3872 wrote to memory of 2608	3872	WINWORD.EXE	explorer.exe
PID 1224 wrote to memory of 1792	1224	explorer.exe	mshta.exe
PID 1224 wrote to memory of 1792	1224	explorer.exe	mshta.exe
PID 1224 wrote to memory of 1792	1224	explorer.exe	mshta.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\instrument indenture.05.06.2021.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\explorer.exe
  explorer c:\users\public\tableClass.hta
  2⤵
  - Process spawned unexpected child process
  PID:2608

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Public\tableClass.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  PID:1792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 1352
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 1640
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    PID:2496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\tableClass.hta

MD5
3edaf8f29179448fc445417f5ace1785

SHA1
ac6ff9d8e00f7c84a76eb07951dbb424b5a3650d

SHA256
d18098b682a7fc9c75f0424cc2c0b0d55738bbb09d183787be82da2e96c3c2bf

SHA512
8043e1ec41de704307ed14915ac1426839683b1e05c99173b0a7736180570466a8e29352470f17b1f6e804a0fb6bc5bb6618bb8dcee8517c850206121332b0dc

Download Submit
memory/1792-182-0x0000000000000000-mapping.dmp

Download
memory/2608-179-0x0000000000000000-mapping.dmp

Download
memory/3872-114-0x00007FF8C8B00000-0x00007FF8C8B10000-memory.dmp

Filesize
64KB

Download
memory/3872-115-0x00007FF8C8B00000-0x00007FF8C8B10000-memory.dmp

Filesize
64KB

Download
memory/3872-116-0x00007FF8C8B00000-0x00007FF8C8B10000-memory.dmp

Filesize
64KB

Download
memory/3872-117-0x00007FF8C8B00000-0x00007FF8C8B10000-memory.dmp

Filesize
64KB

Download
memory/3872-119-0x00007FF8C8B00000-0x00007FF8C8B10000-memory.dmp

Filesize
64KB

Download
memory/3872-118-0x00007FF8EA690000-0x00007FF8ED1B3000-memory.dmp

Filesize
43.1MB

Download
memory/3872-122-0x00007FF8E3360000-0x00007FF8E444E000-memory.dmp

Filesize
16.9MB

Download
memory/3872-123-0x00007FF8E1460000-0x00007FF8E3355000-memory.dmp

Filesize
31.0MB

Download
memory/3872-180-0x000001AC257E0000-0x000001AC257E4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads