Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
22-10-2021 07:58
Static task
static1
Behavioral task
behavioral1
Sample
QUOTE B1018530.doc
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
QUOTE B1018530.doc
Resource
win10-en-20211014
General
-
Target
QUOTE B1018530.doc
-
Size
210KB
-
MD5
0d1e47f9c9e97439af102247df16e32f
-
SHA1
e6c179251a9ced22d13c32d8f3e7bc148347bbf1
-
SHA256
5e719cefe52f3351eeb10b2aa74d5454493bd1365ca8258867ffa2affe8a17b3
-
SHA512
4fb9412ded80376d952254fb00bca9e3faae3a9ab5d8d0ae402c2a57546bd8c6569245fb79506cb210ea9c2c3d5d1bf6b8c836261f7384142341a269268d183c
Malware Config
Extracted
formbook
4.1
mxwf
http://www.zahnimplantatangebotede.com/mxwf/
orders-cialis.info
auctionorbuy.com
meanmugsamore.com
yachtcrewmark.com
sacredkashilifestudio.net
themintyard.com
bragafoods.com
sierp.com
hausofdeme.com
anthonyjames915.com
bajardepesoencasa.com
marciaroyal.com
earringlifter.com
dsdjfhd9ddksa1as.info
bmzproekt.com
employmentbc.com
ptsdtreatment.space
vrchance.com
cnrongding.com
welovelit.com
intercourierdelivery.services
ianwhitewrite.com
afcerd.com
beneficiodemedicare.com
gatel3ess.com
salesnksportswt.top
thewellnessloft365.com
totensa.com
jessicatheisen.com
snowtographers.com
executrainpr.com
puttypaw.com
popcorntimeipad.com
heyconi.com
llanoresources.com
ibusinesshero.com
1euro1ad.com
sparkleeapp.com
zhuxiugyh.com
calvinmaphoto.com
bjmaomao.com
isaacfujiki.com
zipwhipper.com
kontrollstutzen.com
hannaheason.media
zgcbw.net
letteringdagabi.com
kitefabrics.com
andherieastoffices.com
thewellnesstravelcompany.info
ohio.works
beacharita.com
alphamillls.com
sassandvinegar.com
usauber.com
ceylonherbslk.com
richardggreenhill.com
groupdae.com
jupiterccc.com
indoovo.com
sunnytheodora.com
gxpgfz.com
shoppandaxpress.com
heiboard.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1592-73-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1592-74-0x000000000041EBA0-mapping.dmp formbook behavioral1/memory/1808-84-0x00000000000D0000-0x00000000000FE000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 5 288 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
maxhkt65743.exemaxhkt65743.exepid process 1560 maxhkt65743.exe 1592 maxhkt65743.exe -
Loads dropped DLL 1 IoCs
Processes:
EQNEDT32.EXEpid process 288 EQNEDT32.EXE -
Suspicious use of SetThreadContext 3 IoCs
Processes:
maxhkt65743.exemaxhkt65743.execmstp.exedescription pid process target process PID 1560 set thread context of 1592 1560 maxhkt65743.exe maxhkt65743.exe PID 1592 set thread context of 1264 1592 maxhkt65743.exe Explorer.EXE PID 1808 set thread context of 1264 1808 cmstp.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1868 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
maxhkt65743.execmstp.exepid process 1592 maxhkt65743.exe 1592 maxhkt65743.exe 1808 cmstp.exe 1808 cmstp.exe 1808 cmstp.exe 1808 cmstp.exe 1808 cmstp.exe 1808 cmstp.exe 1808 cmstp.exe 1808 cmstp.exe 1808 cmstp.exe 1808 cmstp.exe 1808 cmstp.exe 1808 cmstp.exe 1808 cmstp.exe 1808 cmstp.exe 1808 cmstp.exe 1808 cmstp.exe 1808 cmstp.exe 1808 cmstp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
maxhkt65743.execmstp.exepid process 1592 maxhkt65743.exe 1592 maxhkt65743.exe 1592 maxhkt65743.exe 1808 cmstp.exe 1808 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
maxhkt65743.execmstp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1592 maxhkt65743.exe Token: SeDebugPrivilege 1808 cmstp.exe Token: SeShutdownPrivilege 1264 Explorer.EXE Token: SeShutdownPrivilege 1264 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1868 WINWORD.EXE 1868 WINWORD.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
EQNEDT32.EXEWINWORD.EXEmaxhkt65743.exeExplorer.EXEcmstp.exedescription pid process target process PID 288 wrote to memory of 1560 288 EQNEDT32.EXE maxhkt65743.exe PID 288 wrote to memory of 1560 288 EQNEDT32.EXE maxhkt65743.exe PID 288 wrote to memory of 1560 288 EQNEDT32.EXE maxhkt65743.exe PID 288 wrote to memory of 1560 288 EQNEDT32.EXE maxhkt65743.exe PID 1868 wrote to memory of 1896 1868 WINWORD.EXE splwow64.exe PID 1868 wrote to memory of 1896 1868 WINWORD.EXE splwow64.exe PID 1868 wrote to memory of 1896 1868 WINWORD.EXE splwow64.exe PID 1868 wrote to memory of 1896 1868 WINWORD.EXE splwow64.exe PID 1560 wrote to memory of 1592 1560 maxhkt65743.exe maxhkt65743.exe PID 1560 wrote to memory of 1592 1560 maxhkt65743.exe maxhkt65743.exe PID 1560 wrote to memory of 1592 1560 maxhkt65743.exe maxhkt65743.exe PID 1560 wrote to memory of 1592 1560 maxhkt65743.exe maxhkt65743.exe PID 1560 wrote to memory of 1592 1560 maxhkt65743.exe maxhkt65743.exe PID 1560 wrote to memory of 1592 1560 maxhkt65743.exe maxhkt65743.exe PID 1560 wrote to memory of 1592 1560 maxhkt65743.exe maxhkt65743.exe PID 1264 wrote to memory of 1808 1264 Explorer.EXE cmstp.exe PID 1264 wrote to memory of 1808 1264 Explorer.EXE cmstp.exe PID 1264 wrote to memory of 1808 1264 Explorer.EXE cmstp.exe PID 1264 wrote to memory of 1808 1264 Explorer.EXE cmstp.exe PID 1264 wrote to memory of 1808 1264 Explorer.EXE cmstp.exe PID 1264 wrote to memory of 1808 1264 Explorer.EXE cmstp.exe PID 1264 wrote to memory of 1808 1264 Explorer.EXE cmstp.exe PID 1808 wrote to memory of 1532 1808 cmstp.exe cmd.exe PID 1808 wrote to memory of 1532 1808 cmstp.exe cmd.exe PID 1808 wrote to memory of 1532 1808 cmstp.exe cmd.exe PID 1808 wrote to memory of 1532 1808 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\QUOTE B1018530.doc"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\maxhkt65743.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\maxhkt65743.exe"C:\Users\Admin\AppData\Roaming\maxhkt65743.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\maxhkt65743.exe"C:\Users\Admin\AppData\Roaming\maxhkt65743.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\maxhkt65743.exeMD5
80838b2b8dd2a2b48b619b2eb7788138
SHA1d3c6a2dc3835768d4e103ddd34bdf016bb34a7ee
SHA2562486c4ebc2834ad7e9517107e7d7813fa1b84d5b2df4f928a0144b81d1273e8c
SHA512f33e9f6b06faa6f44f04c64c66b3c88d406b31d3514b2243f5aa7c1d5b9dcc257d07a0fd9118f8f729a043f371f7e44c385f62fdac1767846a48e151cd0c5f3e
-
C:\Users\Admin\AppData\Roaming\maxhkt65743.exeMD5
80838b2b8dd2a2b48b619b2eb7788138
SHA1d3c6a2dc3835768d4e103ddd34bdf016bb34a7ee
SHA2562486c4ebc2834ad7e9517107e7d7813fa1b84d5b2df4f928a0144b81d1273e8c
SHA512f33e9f6b06faa6f44f04c64c66b3c88d406b31d3514b2243f5aa7c1d5b9dcc257d07a0fd9118f8f729a043f371f7e44c385f62fdac1767846a48e151cd0c5f3e
-
C:\Users\Admin\AppData\Roaming\maxhkt65743.exeMD5
80838b2b8dd2a2b48b619b2eb7788138
SHA1d3c6a2dc3835768d4e103ddd34bdf016bb34a7ee
SHA2562486c4ebc2834ad7e9517107e7d7813fa1b84d5b2df4f928a0144b81d1273e8c
SHA512f33e9f6b06faa6f44f04c64c66b3c88d406b31d3514b2243f5aa7c1d5b9dcc257d07a0fd9118f8f729a043f371f7e44c385f62fdac1767846a48e151cd0c5f3e
-
\Users\Admin\AppData\Roaming\maxhkt65743.exeMD5
80838b2b8dd2a2b48b619b2eb7788138
SHA1d3c6a2dc3835768d4e103ddd34bdf016bb34a7ee
SHA2562486c4ebc2834ad7e9517107e7d7813fa1b84d5b2df4f928a0144b81d1273e8c
SHA512f33e9f6b06faa6f44f04c64c66b3c88d406b31d3514b2243f5aa7c1d5b9dcc257d07a0fd9118f8f729a043f371f7e44c385f62fdac1767846a48e151cd0c5f3e
-
memory/1264-87-0x0000000006BD0000-0x0000000006C82000-memory.dmpFilesize
712KB
-
memory/1264-79-0x00000000061E0000-0x00000000062B2000-memory.dmpFilesize
840KB
-
memory/1532-82-0x0000000000000000-mapping.dmp
-
memory/1560-70-0x0000000004320000-0x000000000436F000-memory.dmpFilesize
316KB
-
memory/1560-61-0x0000000000000000-mapping.dmp
-
memory/1560-64-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/1560-66-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/1560-67-0x00000000005B0000-0x00000000005B7000-memory.dmpFilesize
28KB
-
memory/1592-71-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1592-78-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/1592-77-0x00000000009A0000-0x0000000000CA3000-memory.dmpFilesize
3.0MB
-
memory/1592-72-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1592-73-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1592-74-0x000000000041EBA0-mapping.dmp
-
memory/1808-80-0x0000000000000000-mapping.dmp
-
memory/1808-83-0x0000000000200000-0x0000000000218000-memory.dmpFilesize
96KB
-
memory/1808-84-0x00000000000D0000-0x00000000000FE000-memory.dmpFilesize
184KB
-
memory/1808-85-0x0000000001DB0000-0x00000000020B3000-memory.dmpFilesize
3.0MB
-
memory/1808-86-0x0000000001C70000-0x0000000001D03000-memory.dmpFilesize
588KB
-
memory/1868-55-0x0000000072561000-0x0000000072564000-memory.dmpFilesize
12KB
-
memory/1868-58-0x0000000075B71000-0x0000000075B73000-memory.dmpFilesize
8KB
-
memory/1868-57-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1868-56-0x000000006FFE1000-0x000000006FFE3000-memory.dmpFilesize
8KB
-
memory/1868-88-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1896-68-0x0000000000000000-mapping.dmp
-
memory/1896-69-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmpFilesize
8KB