133eaec108dcdf485a65616e0b26d8ffe1781e795b49bef6021c51679bf92c7a

General

Target
legal agreement-06.28.2021.doc
Size 50KB
Sample210629-pblb27tkc2
SHA256 133eaec108dcdf485a65616e0b26d8ffe1781e795b49bef6021c51679bf92c7a
MD5 ffad9afed8f30d780cac0808da1c5d3f
SHA1 b838575fe38390f411e85505607023b6764101a1
SHA512 91823ef5ca872eb7dd93b5419de870aaa4e44086b5f0adbb277d2c08d40536146a71378cce8600af82880d5771d6311ce0b9e227795270ac1f83a1c5352b30e0
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	2008	1852	cmd.exe	24

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	1736	mshta.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1852	WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2008	1852	WINWORD.EXE	26
PID 1852 wrote to memory of 2008	1852	WINWORD.EXE	26
PID 1852 wrote to memory of 2008	1852	WINWORD.EXE	26
PID 1852 wrote to memory of 2008	1852	WINWORD.EXE	26
PID 2008 wrote to memory of 1736	2008	cmd.exe	29
PID 2008 wrote to memory of 1736	2008	cmd.exe	29
PID 2008 wrote to memory of 1736	2008	cmd.exe	29
PID 2008 wrote to memory of 1736	2008	cmd.exe	29
PID 1852 wrote to memory of 1608	1852	WINWORD.EXE	30
PID 1852 wrote to memory of 1608	1852	WINWORD.EXE	30
PID 1852 wrote to memory of 1608	1852	WINWORD.EXE	30
PID 1852 wrote to memory of 1608	1852	WINWORD.EXE	30
PID 1736 wrote to memory of 1744	1736	mshta.exe	37
PID 1736 wrote to memory of 1744	1736	mshta.exe	37
PID 1736 wrote to memory of 1744	1736	mshta.exe	37
PID 1736 wrote to memory of 1744	1736	mshta.exe	37
PID 1736 wrote to memory of 1744	1736	mshta.exe	37
PID 1736 wrote to memory of 1744	1736	mshta.exe	37
PID 1736 wrote to memory of 1744	1736	mshta.exe	37

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\legal agreement-06.28.2021.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\\users\\public\\doubleBorderInt.hta
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\users\public\doubleBorderInt.hta"
    3⤵
    - Blocklisted process makes network request
    - Modifies Internet Explorer settings
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" c:\users\public\doubleBorderInt.jpg
      4⤵
      PID:1744
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1608

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1608-67-0x000007FEFC471000-0x000007FEFC473000-memory.dmp

Download

memory/1744-71-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/1852-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/1852-59-0x0000000072F71000-0x0000000072F74000-memory.dmp

Download

memory/1852-60-0x00000000709F1000-0x00000000709F3000-memory.dmp

Download

memory/1852-72-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/2008-63-0x0000000076A81000-0x0000000076A83000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads