033f7c5026b14321459c602761b3895de0631218d63e1104e7a8f891c6d8f32c

General

Target

033f7c5026b14321459c602761b3895de0631218d63e1104e7a8f891c6d8f32c.exe
Size

849KB
MD5

dd7ef9a28e6c7710a15e0237d56f503f
SHA1

25886a0775680d668f9b3aa38bf0419d3c318100
SHA256

033f7c5026b14321459c602761b3895de0631218d63e1104e7a8f891c6d8f32c
SHA512

712b7159ef442a499b79b08d480f2c15d1eea75cbdc155af2d7ecfc03c502f6cb18cd00db85d48c395e24606027f38f6966b02a5221be28cb9a47ad3f249712f

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

033f7c5026b14321459c602761b3895de0631218d63e1104e7a8f891c6d8f32c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ms.word = "C:\\Users\\Admin\\AppData\\Roaming\\WINWORD.EXE"	033f7c5026b14321459c602761b3895de0631218d63e1104e7a8f891c6d8f32c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies registry class 1 IoCs

Processes:

033f7c5026b14321459c602761b3895de0631218d63e1104e7a8f891c6d8f32c.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	033f7c5026b14321459c602761b3895de0631218d63e1104e7a8f891c6d8f32c.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

1168 WINWORD.EXE
1168 WINWORD.EXE

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

WINWORD.EXE

pid	process
1168	WINWORD.EXE
1168	WINWORD.EXE
1168	WINWORD.EXE
1168	WINWORD.EXE
1168	WINWORD.EXE
1168	WINWORD.EXE
1168	WINWORD.EXE
1168	WINWORD.EXE
1168	WINWORD.EXE
1168	WINWORD.EXE
1168	WINWORD.EXE
1168	WINWORD.EXE
1168	WINWORD.EXE
1168	WINWORD.EXE
1168	WINWORD.EXE
1168	WINWORD.EXE
1168	WINWORD.EXE
1168	WINWORD.EXE
1168	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

033f7c5026b14321459c602761b3895de0631218d63e1104e7a8f891c6d8f32c.exe

description	pid	process	target process
PID 4048 wrote to memory of 1168	4048	033f7c5026b14321459c602761b3895de0631218d63e1104e7a8f891c6d8f32c.exe	WINWORD.EXE
PID 4048 wrote to memory of 1168	4048	033f7c5026b14321459c602761b3895de0631218d63e1104e7a8f891c6d8f32c.exe	WINWORD.EXE

C:\Users\Admin\AppData\Local\Temp\033f7c5026b14321459c602761b3895de0631218d63e1104e7a8f891c6d8f32c.exe
"C:\Users\Admin\AppData\Local\Temp\033f7c5026b14321459c602761b3895de0631218d63e1104e7a8f891c6d8f32c.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4048

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\033f7c5026b14321459c602761b3895de0631218d63e1104e7a8f891c6d8f32c.exe.doc" /o ""
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1168

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\033f7c5026b14321459c602761b3895de0631218d63e1104e7a8f891c6d8f32c.exe.doc
MD5
13fa837b598154256b7aca4168752ce6

SHA1
8f087f230e28fa88101d0d5bd2c0c84c094a485b

SHA256
3f91f495051aed0eaf8a03039c824d41a0760f112e944868b24ba7df62c1d581

SHA512
b4358e576b998b0abdef4aaf696d25b2c53d7212d7c32315eca6dfdd58c8615020b9569a954cf9ac0581395932e2f20efdeba2eebd4bcaef6c447ad1268817b8

Download Submit
memory/1168-115-0x0000000000000000-mapping.dmp

Download
memory/1168-116-0x00007FFDA2790000-0x00007FFDA27A0000-memory.dmp

Filesize
64KB

Download
memory/1168-117-0x00007FFDA2790000-0x00007FFDA27A0000-memory.dmp

Filesize
64KB

Download
memory/1168-118-0x00007FFDA2790000-0x00007FFDA27A0000-memory.dmp

Filesize
64KB

Download
memory/1168-119-0x00007FFDA2790000-0x00007FFDA27A0000-memory.dmp

Filesize
64KB

Download
memory/1168-121-0x00007FFDA2790000-0x00007FFDA27A0000-memory.dmp

Filesize
64KB

Download
memory/1168-120-0x00007FFDC36C0000-0x00007FFDC61E3000-memory.dmp

Filesize
43.1MB

Download
memory/1168-124-0x00007FFDBDFC0000-0x00007FFDBF0AE000-memory.dmp

Filesize
16.9MB

Download
memory/1168-125-0x00007FFDBC0C0000-0x00007FFDBDFB5000-memory.dmp

Filesize
31.0MB

Download
memory/4048-114-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads