25368ee6e7d6c2f666080dcc0ec72dab4fb3c5d4756e41d7533d54611df5a485

General

Target

specifics-05.06.2021.doc
Size

79KB
MD5

8dcba9f16d2602c09ccc7bba8463357a
SHA1

e10dd38a0e372a1f5cd100e36926227ad54613ae
SHA256

25368ee6e7d6c2f666080dcc0ec72dab4fb3c5d4756e41d7533d54611df5a485
SHA512

6f55b1b5675d3389c018befa483988c73f2d91c0fe24679239a94bff46a63342d95f036042ad832d7ed07a7d2ce39684a6453ab994e2ede15ecd7a271a5f32b0

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

explorer.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3972	472	explorer.exe	WINWORD.EXE

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

688 1496 WerFault.exe mshta.exe

pid	pid_target	process	target process
688	1496	WerFault.exe	mshta.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings explorer.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

472 WINWORD.EXE
472 WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

WerFault.exe

pid	process
688	WerFault.exe
688	WerFault.exe
688	WerFault.exe
688	WerFault.exe
688	WerFault.exe
688	WerFault.exe
688	WerFault.exe
688	WerFault.exe
688	WerFault.exe
688	WerFault.exe
688	WerFault.exe
688	WerFault.exe
688	WerFault.exe
688	WerFault.exe
688	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 688 WerFault.exe
Token: SeBackupPrivilege 688 WerFault.exe
Token: SeDebugPrivilege 688 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	688	WerFault.exe
Token: SeBackupPrivilege	688	WerFault.exe
Token: SeDebugPrivilege	688	WerFault.exe

Suspicious use of SetWindowsHookEx 23 IoCs

Processes:

WINWORD.EXE

pid	process
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE
472	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

WINWORD.EXEexplorer.exe

description	pid	process	target process
PID 472 wrote to memory of 3972	472	WINWORD.EXE	explorer.exe
PID 472 wrote to memory of 3972	472	WINWORD.EXE	explorer.exe
PID 4060 wrote to memory of 1496	4060	explorer.exe	mshta.exe
PID 4060 wrote to memory of 1496	4060	explorer.exe	mshta.exe
PID 4060 wrote to memory of 1496	4060	explorer.exe	mshta.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\specifics-05.06.2021.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472

C:\Windows\explorer.exe
explorer c:\users\public\funcQuery.hta
2⤵
- Process spawned unexpected child process
PID:3972

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4060

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Public\funcQuery.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
2⤵
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 1324
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:688

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\funcQuery.hta
MD5
9bce99ef6921875dfb3b6ab88dc6c5af

SHA1
93e5f71348f8a45df83600c2489ec8c9b2180e22

SHA256
a3bfb7e7111afcbc9ea9193545a18f7986c6ef4d1dd8d4b1f0c62266769d5e31

SHA512
d5764b8cb93dba7a0f913979bba0141100887b6a0358863b357af1643396c21995ba0635983796829de2491bebfe8858d03b6afb82114ed42eeec3654adc203e

Download Submit
memory/472-114-0x00007FFEB3A10000-0x00007FFEB3A20000-memory.dmp

Filesize
64KB

Download
memory/472-115-0x00007FFEB3A10000-0x00007FFEB3A20000-memory.dmp

Filesize
64KB

Download
memory/472-116-0x00007FFEB3A10000-0x00007FFEB3A20000-memory.dmp

Filesize
64KB

Download
memory/472-117-0x00007FFEB3A10000-0x00007FFEB3A20000-memory.dmp

Filesize
64KB

Download
memory/472-119-0x00007FFEB3A10000-0x00007FFEB3A20000-memory.dmp

Filesize
64KB

Download
memory/472-118-0x00007FFED4CB0000-0x00007FFED77D3000-memory.dmp

Filesize
43.1MB

Download
memory/472-122-0x00007FFED0020000-0x00007FFED110E000-memory.dmp

Filesize
16.9MB

Download
memory/472-123-0x00007FFECD690000-0x00007FFECF585000-memory.dmp

Filesize
31.0MB

Download
memory/472-180-0x00000228A3830000-0x00000228A3834000-memory.dmp

Filesize
16KB

Download
memory/1496-182-0x0000000000000000-mapping.dmp

Download
memory/3972-179-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads