Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
10-11-2021 07:33
Static task
static1
Behavioral task
behavioral1
Sample
100197.doc
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
100197.doc
Resource
win10-en-20211104
General
-
Target
100197.doc
-
Size
190KB
-
MD5
a51beb4cee3604bc8ab1c7c9f5e7d5c1
-
SHA1
22d24e750b96783e24da802dcac3e4367d83befa
-
SHA256
59de39d60fee5b2a853c4e4bd62ce6ea5054373938b8afbb159d60102f88e989
-
SHA512
c406ee9bfb3425caf97e26626dbba30aa7a305be0f1732f2a7b4225e877468a0b12aa531d0c495bb3aac6f192966e92daa419ec01ec94e5f5ef50a8f851fc543
Malware Config
Extracted
xloader
2.5
unzn
http://www.davanamays.com/unzn/
xiulf.com
highcountrymortar.com
523561.com
marketingagency.tools
ganmovie.net
nationaalcontactpunt.com
sirrbter.com
begizas.xyz
missimi-fashion.com
munixc.info
daas.support
spaceworbc.com
faithtruthresolve.com
gymkub.com
thegrayverse.xyz
artisanmakefurniture.com
029tryy.com
ijuubx.biz
iphone13promax.club
techuniversus.com
samrgov.xyz
grownupcurl.com
sj0755.net
beekeeperkit.com
richessesabondantes.com
xclgjgjh.net
webworkscork.com
vedepviet365.com
bretabeameven.com
cdzsmhw.com
clearperspective.biz
tigrg5g784sh.biz
bbezan011.xyz
mycar.store
mansooralobeidli.com
ascensionmemberszoom.com
unlimitedrehab.com
wozka.top
askylarkgoods.com
rj793.com
prosvalor.com
primetimeexpress.com
boixosnoisperu.com
mmasportgear.com
concertiranian.net
hyponymys.info
maila.one
yti0fyic.xyz
shashiprayag.com
speedprosmotorsports.com
westchestercountyjunkcars.com
patienceinmypocket.com
rausachbaoloc.com
plexregroup.com
outsydercs.com
foodandflour.com
lenacrypto.xyz
homeservicetoday.net
marthaperry.com
vmtcyd4q8.com
shamefulguys.com
loccssol.store
gnarledportra.xyz
042atk.xyz
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2032-75-0x000000000041D430-mapping.dmp xloader behavioral1/memory/2032-74-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2032-81-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1980-87-0x0000000000070000-0x0000000000099000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 5 540 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
serverbjk7861.exeserverbjk7861.exeserverbjk7861.exepid process 1768 serverbjk7861.exe 1988 serverbjk7861.exe 2032 serverbjk7861.exe -
Loads dropped DLL 1 IoCs
Processes:
EQNEDT32.EXEpid process 540 EQNEDT32.EXE -
Suspicious use of SetThreadContext 4 IoCs
Processes:
serverbjk7861.exeserverbjk7861.exewscript.exedescription pid process target process PID 1768 set thread context of 2032 1768 serverbjk7861.exe serverbjk7861.exe PID 2032 set thread context of 1304 2032 serverbjk7861.exe Explorer.EXE PID 2032 set thread context of 1304 2032 serverbjk7861.exe Explorer.EXE PID 1980 set thread context of 1304 1980 wscript.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1692 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
serverbjk7861.exeserverbjk7861.exewscript.exepid process 1768 serverbjk7861.exe 1768 serverbjk7861.exe 2032 serverbjk7861.exe 2032 serverbjk7861.exe 2032 serverbjk7861.exe 1980 wscript.exe 1980 wscript.exe 1980 wscript.exe 1980 wscript.exe 1980 wscript.exe 1980 wscript.exe 1980 wscript.exe 1980 wscript.exe 1980 wscript.exe 1980 wscript.exe 1980 wscript.exe 1980 wscript.exe 1980 wscript.exe 1980 wscript.exe 1980 wscript.exe 1980 wscript.exe 1980 wscript.exe 1980 wscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1304 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
serverbjk7861.exewscript.exepid process 2032 serverbjk7861.exe 2032 serverbjk7861.exe 2032 serverbjk7861.exe 2032 serverbjk7861.exe 1980 wscript.exe 1980 wscript.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
serverbjk7861.exeserverbjk7861.exewscript.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1768 serverbjk7861.exe Token: SeDebugPrivilege 2032 serverbjk7861.exe Token: SeDebugPrivilege 1980 wscript.exe Token: SeShutdownPrivilege 1304 Explorer.EXE Token: SeShutdownPrivilege 1304 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1692 WINWORD.EXE 1692 WINWORD.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
EQNEDT32.EXEWINWORD.EXEserverbjk7861.exeserverbjk7861.exewscript.exedescription pid process target process PID 540 wrote to memory of 1768 540 EQNEDT32.EXE serverbjk7861.exe PID 540 wrote to memory of 1768 540 EQNEDT32.EXE serverbjk7861.exe PID 540 wrote to memory of 1768 540 EQNEDT32.EXE serverbjk7861.exe PID 540 wrote to memory of 1768 540 EQNEDT32.EXE serverbjk7861.exe PID 1692 wrote to memory of 552 1692 WINWORD.EXE splwow64.exe PID 1692 wrote to memory of 552 1692 WINWORD.EXE splwow64.exe PID 1692 wrote to memory of 552 1692 WINWORD.EXE splwow64.exe PID 1692 wrote to memory of 552 1692 WINWORD.EXE splwow64.exe PID 1768 wrote to memory of 1988 1768 serverbjk7861.exe serverbjk7861.exe PID 1768 wrote to memory of 1988 1768 serverbjk7861.exe serverbjk7861.exe PID 1768 wrote to memory of 1988 1768 serverbjk7861.exe serverbjk7861.exe PID 1768 wrote to memory of 1988 1768 serverbjk7861.exe serverbjk7861.exe PID 1768 wrote to memory of 2032 1768 serverbjk7861.exe serverbjk7861.exe PID 1768 wrote to memory of 2032 1768 serverbjk7861.exe serverbjk7861.exe PID 1768 wrote to memory of 2032 1768 serverbjk7861.exe serverbjk7861.exe PID 1768 wrote to memory of 2032 1768 serverbjk7861.exe serverbjk7861.exe PID 1768 wrote to memory of 2032 1768 serverbjk7861.exe serverbjk7861.exe PID 1768 wrote to memory of 2032 1768 serverbjk7861.exe serverbjk7861.exe PID 1768 wrote to memory of 2032 1768 serverbjk7861.exe serverbjk7861.exe PID 2032 wrote to memory of 1980 2032 serverbjk7861.exe wscript.exe PID 2032 wrote to memory of 1980 2032 serverbjk7861.exe wscript.exe PID 2032 wrote to memory of 1980 2032 serverbjk7861.exe wscript.exe PID 2032 wrote to memory of 1980 2032 serverbjk7861.exe wscript.exe PID 1980 wrote to memory of 1820 1980 wscript.exe cmd.exe PID 1980 wrote to memory of 1820 1980 wscript.exe cmd.exe PID 1980 wrote to memory of 1820 1980 wscript.exe cmd.exe PID 1980 wrote to memory of 1820 1980 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\100197.doc"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\serverbjk7861.exe"C:\Users\Admin\AppData\Roaming\serverbjk7861.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\serverbjk7861.exe"C:\Users\Admin\AppData\Roaming\serverbjk7861.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\serverbjk7861.exe"C:\Users\Admin\AppData\Roaming\serverbjk7861.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\serverbjk7861.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\serverbjk7861.exeMD5
1dadf13b8e0441e370eacb0b774c64e9
SHA1ad139b332854cdb6afb1c25548c72e5f59cda993
SHA256211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e
SHA512e086f7238871070896e2454e1ab6c6f7248039742d67089f8e7c14fabbc890ca23b3ca1d240881f386af316f15f9192f20df85b15bf4d9c7b27ce4305098eb50
-
C:\Users\Admin\AppData\Roaming\serverbjk7861.exeMD5
1dadf13b8e0441e370eacb0b774c64e9
SHA1ad139b332854cdb6afb1c25548c72e5f59cda993
SHA256211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e
SHA512e086f7238871070896e2454e1ab6c6f7248039742d67089f8e7c14fabbc890ca23b3ca1d240881f386af316f15f9192f20df85b15bf4d9c7b27ce4305098eb50
-
C:\Users\Admin\AppData\Roaming\serverbjk7861.exeMD5
1dadf13b8e0441e370eacb0b774c64e9
SHA1ad139b332854cdb6afb1c25548c72e5f59cda993
SHA256211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e
SHA512e086f7238871070896e2454e1ab6c6f7248039742d67089f8e7c14fabbc890ca23b3ca1d240881f386af316f15f9192f20df85b15bf4d9c7b27ce4305098eb50
-
C:\Users\Admin\AppData\Roaming\serverbjk7861.exeMD5
1dadf13b8e0441e370eacb0b774c64e9
SHA1ad139b332854cdb6afb1c25548c72e5f59cda993
SHA256211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e
SHA512e086f7238871070896e2454e1ab6c6f7248039742d67089f8e7c14fabbc890ca23b3ca1d240881f386af316f15f9192f20df85b15bf4d9c7b27ce4305098eb50
-
\Users\Admin\AppData\Roaming\serverbjk7861.exeMD5
1dadf13b8e0441e370eacb0b774c64e9
SHA1ad139b332854cdb6afb1c25548c72e5f59cda993
SHA256211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e
SHA512e086f7238871070896e2454e1ab6c6f7248039742d67089f8e7c14fabbc890ca23b3ca1d240881f386af316f15f9192f20df85b15bf4d9c7b27ce4305098eb50
-
memory/552-69-0x000007FEFC441000-0x000007FEFC443000-memory.dmpFilesize
8KB
-
memory/552-68-0x0000000000000000-mapping.dmp
-
memory/1304-83-0x0000000004110000-0x00000000041CC000-memory.dmpFilesize
752KB
-
memory/1304-80-0x00000000071D0000-0x00000000072F4000-memory.dmpFilesize
1.1MB
-
memory/1304-90-0x0000000006950000-0x0000000006A43000-memory.dmpFilesize
972KB
-
memory/1692-55-0x0000000072F31000-0x0000000072F34000-memory.dmpFilesize
12KB
-
memory/1692-91-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1692-58-0x0000000075B71000-0x0000000075B73000-memory.dmpFilesize
8KB
-
memory/1692-56-0x00000000709B1000-0x00000000709B3000-memory.dmpFilesize
8KB
-
memory/1692-57-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1768-66-0x00000000004A0000-0x00000000004A1000-memory.dmpFilesize
4KB
-
memory/1768-61-0x0000000000000000-mapping.dmp
-
memory/1768-67-0x00000000009B0000-0x00000000009B7000-memory.dmpFilesize
28KB
-
memory/1768-70-0x0000000000E60000-0x0000000000EA6000-memory.dmpFilesize
280KB
-
memory/1768-64-0x0000000001190000-0x0000000001191000-memory.dmpFilesize
4KB
-
memory/1820-88-0x0000000000000000-mapping.dmp
-
memory/1980-89-0x00000000003B0000-0x0000000000440000-memory.dmpFilesize
576KB
-
memory/1980-87-0x0000000000070000-0x0000000000099000-memory.dmpFilesize
164KB
-
memory/1980-86-0x0000000002010000-0x0000000002313000-memory.dmpFilesize
3.0MB
-
memory/1980-85-0x0000000000530000-0x0000000000556000-memory.dmpFilesize
152KB
-
memory/1980-84-0x0000000000000000-mapping.dmp
-
memory/2032-73-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2032-82-0x00000000001E0000-0x00000000001F1000-memory.dmpFilesize
68KB
-
memory/2032-81-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2032-78-0x00000000009E0000-0x0000000000CE3000-memory.dmpFilesize
3.0MB
-
memory/2032-79-0x0000000000180000-0x0000000000191000-memory.dmpFilesize
68KB
-
memory/2032-74-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2032-75-0x000000000041D430-mapping.dmp
-
memory/2032-72-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB