Analysis
-
max time kernel
148s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
10-11-2021 03:12
Static task
static1
Behavioral task
behavioral1
Sample
Scan005.doc
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
Scan005.doc
Resource
win10-en-20211014
General
-
Target
Scan005.doc
-
Size
122KB
-
MD5
4ac56961be249ab2a1f4afca472cd66a
-
SHA1
03c8e060a7839be00dc23d00e7e43f7f9f5eea8a
-
SHA256
5a6beeb95af6b3cad843e2e482e2eafeb64c82a5040174bd3f93bd798295b9e6
-
SHA512
efa8fd556db1b98c6ef3d4ab67769a7bf0bda291e2ba1084c77d92b50320542bcf0f595d4d802d764077aa17fbb8720001412a1e7077445b6bc13484fdc699f0
Malware Config
Extracted
formbook
4.1
s18y
http://www.agentpathleurre.space/s18y/
jokes-online.com
dzzdjn.com
lizzieerhardtebnaryepptts.com
interfacehand.xyz
sale-m.site
block-facebook.com
dicasdamadrinha.com
maythewind.com
hasari.net
omnists.com
thevalley-eg.com
rdfj.xyz
szhfcy.com
alkalineage.club
fdf.xyz
absorplus.com
poldolongo.com
badassshirts.club
ferienwohnungenmv.com
bilboondokoak.com
ambrosiaaudio.com
lifeneurologyclub.com
femboys.world
blehmails.com
gametimebg.com
duytienauto.net
owerful.com
amedicalsupplyco.com
americonnlogistics.com
ateamautoglassga.com
clickstool.com
fzdzcnj.com
txtgo.xyz
izassist.com
3bangzhu.com
myesstyle.com
aek181129aek.xyz
daoxinghumaotest.com
jxdg.xyz
restorationculturecon.com
thenaturalnutrient.com
sportsandgames.info
spiderwebinar.net
erqgseidx.com
donutmastermind.com
aidatislemleri-govtr.com
weetsist.com
sunsetschoolportaits.com
exodusguarant.tech
gsnbls.top
huangdashi33.xyz
amazonretoure.net
greathomeinlakewood.com
lenovoidc.com
qiuhenglawfirm.com
surveyorslimited.com
carterscts.com
helmosy.online
bakersfieldlaughingstock.com
as-payjrku.icu
mr-exclusive.com
givepy.info
ifvita.com
obesocarpinteria.online
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1076-74-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1076-75-0x000000000041F120-mapping.dmp formbook behavioral1/memory/432-83-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 5 1660 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
seasonjkg6874.exeseasonjkg6874.exepid process 1704 seasonjkg6874.exe 1076 seasonjkg6874.exe -
Loads dropped DLL 1 IoCs
Processes:
EQNEDT32.EXEpid process 1660 EQNEDT32.EXE -
Suspicious use of SetThreadContext 3 IoCs
Processes:
seasonjkg6874.exeseasonjkg6874.exewuapp.exedescription pid process target process PID 1704 set thread context of 1076 1704 seasonjkg6874.exe seasonjkg6874.exe PID 1076 set thread context of 1392 1076 seasonjkg6874.exe Explorer.EXE PID 432 set thread context of 1392 432 wuapp.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 320 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
seasonjkg6874.exewuapp.exepid process 1076 seasonjkg6874.exe 1076 seasonjkg6874.exe 432 wuapp.exe 432 wuapp.exe 432 wuapp.exe 432 wuapp.exe 432 wuapp.exe 432 wuapp.exe 432 wuapp.exe 432 wuapp.exe 432 wuapp.exe 432 wuapp.exe 432 wuapp.exe 432 wuapp.exe 432 wuapp.exe 432 wuapp.exe 432 wuapp.exe 432 wuapp.exe 432 wuapp.exe 432 wuapp.exe 432 wuapp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1392 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
seasonjkg6874.exewuapp.exepid process 1076 seasonjkg6874.exe 1076 seasonjkg6874.exe 1076 seasonjkg6874.exe 432 wuapp.exe 432 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
seasonjkg6874.exewuapp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1076 seasonjkg6874.exe Token: SeDebugPrivilege 432 wuapp.exe Token: SeShutdownPrivilege 1392 Explorer.EXE Token: SeShutdownPrivilege 1392 Explorer.EXE Token: SeShutdownPrivilege 1392 Explorer.EXE Token: SeShutdownPrivilege 1392 Explorer.EXE Token: SeShutdownPrivilege 1392 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 320 WINWORD.EXE 320 WINWORD.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
EQNEDT32.EXEWINWORD.EXEseasonjkg6874.exeExplorer.EXEwuapp.exedescription pid process target process PID 1660 wrote to memory of 1704 1660 EQNEDT32.EXE seasonjkg6874.exe PID 1660 wrote to memory of 1704 1660 EQNEDT32.EXE seasonjkg6874.exe PID 1660 wrote to memory of 1704 1660 EQNEDT32.EXE seasonjkg6874.exe PID 1660 wrote to memory of 1704 1660 EQNEDT32.EXE seasonjkg6874.exe PID 320 wrote to memory of 908 320 WINWORD.EXE splwow64.exe PID 320 wrote to memory of 908 320 WINWORD.EXE splwow64.exe PID 320 wrote to memory of 908 320 WINWORD.EXE splwow64.exe PID 320 wrote to memory of 908 320 WINWORD.EXE splwow64.exe PID 1704 wrote to memory of 1076 1704 seasonjkg6874.exe seasonjkg6874.exe PID 1704 wrote to memory of 1076 1704 seasonjkg6874.exe seasonjkg6874.exe PID 1704 wrote to memory of 1076 1704 seasonjkg6874.exe seasonjkg6874.exe PID 1704 wrote to memory of 1076 1704 seasonjkg6874.exe seasonjkg6874.exe PID 1704 wrote to memory of 1076 1704 seasonjkg6874.exe seasonjkg6874.exe PID 1704 wrote to memory of 1076 1704 seasonjkg6874.exe seasonjkg6874.exe PID 1704 wrote to memory of 1076 1704 seasonjkg6874.exe seasonjkg6874.exe PID 1392 wrote to memory of 432 1392 Explorer.EXE wuapp.exe PID 1392 wrote to memory of 432 1392 Explorer.EXE wuapp.exe PID 1392 wrote to memory of 432 1392 Explorer.EXE wuapp.exe PID 1392 wrote to memory of 432 1392 Explorer.EXE wuapp.exe PID 1392 wrote to memory of 432 1392 Explorer.EXE wuapp.exe PID 1392 wrote to memory of 432 1392 Explorer.EXE wuapp.exe PID 1392 wrote to memory of 432 1392 Explorer.EXE wuapp.exe PID 432 wrote to memory of 992 432 wuapp.exe cmd.exe PID 432 wrote to memory of 992 432 wuapp.exe cmd.exe PID 432 wrote to memory of 992 432 wuapp.exe cmd.exe PID 432 wrote to memory of 992 432 wuapp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Scan005.doc"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\seasonjkg6874.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\seasonjkg6874.exe"C:\Users\Admin\AppData\Roaming\seasonjkg6874.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\seasonjkg6874.exe"C:\Users\Admin\AppData\Roaming\seasonjkg6874.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\seasonjkg6874.exeMD5
ac0ff10a492ecdc35a120afd52b662b1
SHA16c499a2fd35af6821fb6e123fa56562b6879f9ef
SHA256a1e65a31e941c40e59341fcb6b82e7d217772ba1277f2e85bde09963e42dff10
SHA512c445d01d82f11c91d4d99a0cf8d076315658f67356c2ca44d569159f34b9ac774fb33492b955c33705946ee73578c652a4fc002a8bffa497551cf56f8ba360e5
-
C:\Users\Admin\AppData\Roaming\seasonjkg6874.exeMD5
ac0ff10a492ecdc35a120afd52b662b1
SHA16c499a2fd35af6821fb6e123fa56562b6879f9ef
SHA256a1e65a31e941c40e59341fcb6b82e7d217772ba1277f2e85bde09963e42dff10
SHA512c445d01d82f11c91d4d99a0cf8d076315658f67356c2ca44d569159f34b9ac774fb33492b955c33705946ee73578c652a4fc002a8bffa497551cf56f8ba360e5
-
C:\Users\Admin\AppData\Roaming\seasonjkg6874.exeMD5
ac0ff10a492ecdc35a120afd52b662b1
SHA16c499a2fd35af6821fb6e123fa56562b6879f9ef
SHA256a1e65a31e941c40e59341fcb6b82e7d217772ba1277f2e85bde09963e42dff10
SHA512c445d01d82f11c91d4d99a0cf8d076315658f67356c2ca44d569159f34b9ac774fb33492b955c33705946ee73578c652a4fc002a8bffa497551cf56f8ba360e5
-
\Users\Admin\AppData\Roaming\seasonjkg6874.exeMD5
ac0ff10a492ecdc35a120afd52b662b1
SHA16c499a2fd35af6821fb6e123fa56562b6879f9ef
SHA256a1e65a31e941c40e59341fcb6b82e7d217772ba1277f2e85bde09963e42dff10
SHA512c445d01d82f11c91d4d99a0cf8d076315658f67356c2ca44d569159f34b9ac774fb33492b955c33705946ee73578c652a4fc002a8bffa497551cf56f8ba360e5
-
memory/320-55-0x0000000072F11000-0x0000000072F14000-memory.dmpFilesize
12KB
-
memory/320-56-0x0000000070991000-0x0000000070993000-memory.dmpFilesize
8KB
-
memory/320-57-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/320-58-0x0000000075AB1000-0x0000000075AB3000-memory.dmpFilesize
8KB
-
memory/320-88-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/432-86-0x0000000000310000-0x00000000003A3000-memory.dmpFilesize
588KB
-
memory/432-83-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/432-85-0x00000000020B0000-0x00000000023B3000-memory.dmpFilesize
3.0MB
-
memory/432-82-0x0000000000980000-0x000000000098B000-memory.dmpFilesize
44KB
-
memory/432-81-0x0000000000000000-mapping.dmp
-
memory/908-69-0x0000000000000000-mapping.dmp
-
memory/908-70-0x000007FEFC5C1000-0x000007FEFC5C3000-memory.dmpFilesize
8KB
-
memory/992-84-0x0000000000000000-mapping.dmp
-
memory/1076-72-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1076-75-0x000000000041F120-mapping.dmp
-
memory/1076-78-0x0000000000850000-0x0000000000B53000-memory.dmpFilesize
3.0MB
-
memory/1076-79-0x00000000000F0000-0x0000000000104000-memory.dmpFilesize
80KB
-
memory/1076-74-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1076-73-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1392-80-0x00000000064F0000-0x00000000065F0000-memory.dmpFilesize
1024KB
-
memory/1392-87-0x0000000007EF0000-0x000000000807A000-memory.dmpFilesize
1.5MB
-
memory/1704-71-0x0000000004830000-0x000000000487C000-memory.dmpFilesize
304KB
-
memory/1704-68-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/1704-67-0x00000000003B0000-0x00000000003B7000-memory.dmpFilesize
28KB
-
memory/1704-64-0x0000000000BC0000-0x0000000000BC1000-memory.dmpFilesize
4KB
-
memory/1704-61-0x0000000000000000-mapping.dmp