27af92b73c22902d7e65731e6e3542d3e1effdad815df018f65cca6440f4d16d

General

Target

intelligence_07.27.2021.doc
Size

72KB
MD5

84b78d80895fe5083e2ff0ffe168552f
SHA1

3baa771fb2fcee216745d52fd770c7def5772ebd
SHA256

daaa7914f4ef2d951bd89f50803160bba1ac86e6ae3d66798c35e262f20587d9
SHA512

995b08b4a9013ce7e2fb5baa91582b37b1ae960b572c8f30b80fd8464116405bcb18c7e80de766d290b8f7644ddbe562c03e9e4605c593b9db7b978c9f6315b1

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1712	1040	cmd.exe	WINWORD.EXE

Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

7 1556 mshta.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

flow	pid	process
7	1556	mshta.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXEmshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1040 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1040 WINWORD.EXE
1040 WINWORD.EXE

pid	process
1040	WINWORD.EXE

pid	process
1040	WINWORD.EXE
1040	WINWORD.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

WINWORD.EXEcmd.exemshta.exe

description	pid	process	target process
PID 1040 wrote to memory of 1712	1040	WINWORD.EXE	cmd.exe
PID 1040 wrote to memory of 1712	1040	WINWORD.EXE	cmd.exe
PID 1040 wrote to memory of 1712	1040	WINWORD.EXE	cmd.exe
PID 1040 wrote to memory of 1712	1040	WINWORD.EXE	cmd.exe
PID 1712 wrote to memory of 1556	1712	cmd.exe	mshta.exe
PID 1712 wrote to memory of 1556	1712	cmd.exe	mshta.exe
PID 1712 wrote to memory of 1556	1712	cmd.exe	mshta.exe
PID 1712 wrote to memory of 1556	1712	cmd.exe	mshta.exe
PID 1556 wrote to memory of 1604	1556	mshta.exe	regsvr32.exe
PID 1556 wrote to memory of 1604	1556	mshta.exe	regsvr32.exe
PID 1556 wrote to memory of 1604	1556	mshta.exe	regsvr32.exe
PID 1556 wrote to memory of 1604	1556	mshta.exe	regsvr32.exe
PID 1556 wrote to memory of 1604	1556	mshta.exe	regsvr32.exe
PID 1556 wrote to memory of 1604	1556	mshta.exe	regsvr32.exe
PID 1556 wrote to memory of 1604	1556	mshta.exe	regsvr32.exe
PID 1040 wrote to memory of 1472	1040	WINWORD.EXE	splwow64.exe
PID 1040 wrote to memory of 1472	1040	WINWORD.EXE	splwow64.exe
PID 1040 wrote to memory of 1472	1040	WINWORD.EXE	splwow64.exe
PID 1040 wrote to memory of 1472	1040	WINWORD.EXE	splwow64.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\intelligence_07.27.2021.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\programdata\htmlCoreCode.hta
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\programdata\htmlCoreCode.hta"
3⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" c:\users\public\htmlCoreCode.jpg
4⤵
PID:1604

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1472

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\programdata\htmlCoreCode.hta
MD5
731a2fa48b5afb2a83011c9362d5aeb8

SHA1
4cc03587f43f8c3381b6715effda841bffba5f73

SHA256
b2d4c83861333f33b0ea498137a8135cf28561fbf7dbf2fb4f8bd6beaab38c9b

SHA512
7fd27fe39a77964092c81b7f1e77741c2413019856acd88b74b6e0dbf84294de15f8dfe1f228eb309034da7d272b5008008589099d2cc7f0bb8f4e35ea2939fe

Download Submit
memory/1040-60-0x0000000072491000-0x0000000072494000-memory.dmp

Filesize
12KB

Download
memory/1040-61-0x000000006FF11000-0x000000006FF13000-memory.dmp

Filesize
8KB

Download
memory/1040-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1040-63-0x0000000074F31000-0x0000000074F33000-memory.dmp

Filesize
8KB

Download
memory/1040-73-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1472-71-0x0000000000000000-mapping.dmp

Download
memory/1472-72-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

Filesize
8KB

Download
memory/1556-67-0x0000000000000000-mapping.dmp

Download
memory/1604-68-0x0000000000000000-mapping.dmp

Download
memory/1604-70-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/1712-64-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads