Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
25-11-2021 16:57
Static task
static1
Behavioral task
behavioral1
Sample
P.O-5433ERE.doc
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
P.O-5433ERE.doc
Resource
win10-en-20211014
General
-
Target
P.O-5433ERE.doc
-
Size
21KB
-
MD5
17ca06000e92058f0d43259b2683537c
-
SHA1
db453e5125310d209fe04fb0211677d79d25f3ee
-
SHA256
3c9280552a4129fdf884414b080c80d5ffc72403079d7a5292e9b09d832ab37d
-
SHA512
3e05cc9f7284eb7a1d6756380882b0b1b2d89ce42b887e6c28c49342a9ce61157392997f7bdd96add1fbeefe3ea2ce07c14e8b1e6b245488a2c248d0b8e51148
Malware Config
Extracted
xloader
2.5
op9t
http://www.fcusd4.com/op9t/
tzjwt261888.com
top10iecasinos.com
nurotag.com
controlparental24.com
truenettnpasumo1.xyz
finsits.com
publicfigure.skin
natalispharma.com
brixbol.com
bal.group
perfectinteractivemedia.com
fascialboost.com
jgcpfb120.com
grizzlysolutionsllc.net
wearegardenersusa.com
rjsarka.com
shintoku-gsfarm.com
1oavyx.com
volunteervabetweenk.com
tdshawn.com
bandhancustomer.com
amyzingskin.com
sorbetsa.com
eadbrasil.club
directnaukri.com
alltheheads.com
elbbinandnibble.online
kaizenswinger.com
kimberleydawnwallace.com
zscyyds.xyz
ecranthermique.com
mystitched.com
shophallows.com
cachondearais.xyz
flavatdvb.quest
christendombiblecollege.com
affordalbehousing.com
engro-connect.com
lorticepttoyof2.xyz
kingslot.bet
wiseriq.com
emmaraducanu.tennis
xn--seebhnegrlitz-pmb9f.com
perfectstudio.net
thenewera.icu
com104940689794.icu
imaginative-coaching.com
campdiscount.info
waggledance.net
excellglobus.com
fssqyd.com
yalesi.net
aoliutech.com
replenish.place
nityammed.com
stanislauscountyedu.info
029saxjy.com
lttcp089.com
texaszephyr.com
sloanlakecomedy.com
axonlang.com
bhutaan.com
sevensummitclimbing.com
wolfenhawk.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1724-73-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1724-74-0x000000000041D410-mapping.dmp xloader behavioral1/memory/1724-80-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1412-86-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 5 552 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
ashlkyvc7592.exeashlkyvc7592.exepid process 1132 ashlkyvc7592.exe 1724 ashlkyvc7592.exe -
Loads dropped DLL 1 IoCs
Processes:
EQNEDT32.EXEpid process 552 EQNEDT32.EXE -
Suspicious use of SetThreadContext 4 IoCs
Processes:
ashlkyvc7592.exeashlkyvc7592.exeNAPSTAT.EXEdescription pid process target process PID 1132 set thread context of 1724 1132 ashlkyvc7592.exe ashlkyvc7592.exe PID 1724 set thread context of 1380 1724 ashlkyvc7592.exe Explorer.EXE PID 1724 set thread context of 1380 1724 ashlkyvc7592.exe Explorer.EXE PID 1412 set thread context of 1380 1412 NAPSTAT.EXE Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 808 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
ashlkyvc7592.exeNAPSTAT.EXEpid process 1724 ashlkyvc7592.exe 1724 ashlkyvc7592.exe 1724 ashlkyvc7592.exe 1412 NAPSTAT.EXE 1412 NAPSTAT.EXE 1412 NAPSTAT.EXE 1412 NAPSTAT.EXE 1412 NAPSTAT.EXE 1412 NAPSTAT.EXE 1412 NAPSTAT.EXE 1412 NAPSTAT.EXE 1412 NAPSTAT.EXE 1412 NAPSTAT.EXE 1412 NAPSTAT.EXE 1412 NAPSTAT.EXE 1412 NAPSTAT.EXE 1412 NAPSTAT.EXE 1412 NAPSTAT.EXE 1412 NAPSTAT.EXE 1412 NAPSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
ashlkyvc7592.exeNAPSTAT.EXEpid process 1724 ashlkyvc7592.exe 1724 ashlkyvc7592.exe 1724 ashlkyvc7592.exe 1724 ashlkyvc7592.exe 1412 NAPSTAT.EXE 1412 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
ashlkyvc7592.exeNAPSTAT.EXEExplorer.EXEdescription pid process Token: SeDebugPrivilege 1724 ashlkyvc7592.exe Token: SeDebugPrivilege 1412 NAPSTAT.EXE Token: SeShutdownPrivilege 1380 Explorer.EXE Token: SeShutdownPrivilege 1380 Explorer.EXE Token: SeShutdownPrivilege 1380 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 808 WINWORD.EXE 808 WINWORD.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
EQNEDT32.EXEWINWORD.EXEashlkyvc7592.exeExplorer.EXENAPSTAT.EXEdescription pid process target process PID 552 wrote to memory of 1132 552 EQNEDT32.EXE ashlkyvc7592.exe PID 552 wrote to memory of 1132 552 EQNEDT32.EXE ashlkyvc7592.exe PID 552 wrote to memory of 1132 552 EQNEDT32.EXE ashlkyvc7592.exe PID 552 wrote to memory of 1132 552 EQNEDT32.EXE ashlkyvc7592.exe PID 808 wrote to memory of 936 808 WINWORD.EXE splwow64.exe PID 808 wrote to memory of 936 808 WINWORD.EXE splwow64.exe PID 808 wrote to memory of 936 808 WINWORD.EXE splwow64.exe PID 808 wrote to memory of 936 808 WINWORD.EXE splwow64.exe PID 1132 wrote to memory of 1724 1132 ashlkyvc7592.exe ashlkyvc7592.exe PID 1132 wrote to memory of 1724 1132 ashlkyvc7592.exe ashlkyvc7592.exe PID 1132 wrote to memory of 1724 1132 ashlkyvc7592.exe ashlkyvc7592.exe PID 1132 wrote to memory of 1724 1132 ashlkyvc7592.exe ashlkyvc7592.exe PID 1132 wrote to memory of 1724 1132 ashlkyvc7592.exe ashlkyvc7592.exe PID 1132 wrote to memory of 1724 1132 ashlkyvc7592.exe ashlkyvc7592.exe PID 1132 wrote to memory of 1724 1132 ashlkyvc7592.exe ashlkyvc7592.exe PID 1380 wrote to memory of 1412 1380 Explorer.EXE NAPSTAT.EXE PID 1380 wrote to memory of 1412 1380 Explorer.EXE NAPSTAT.EXE PID 1380 wrote to memory of 1412 1380 Explorer.EXE NAPSTAT.EXE PID 1380 wrote to memory of 1412 1380 Explorer.EXE NAPSTAT.EXE PID 1412 wrote to memory of 1220 1412 NAPSTAT.EXE cmd.exe PID 1412 wrote to memory of 1220 1412 NAPSTAT.EXE cmd.exe PID 1412 wrote to memory of 1220 1412 NAPSTAT.EXE cmd.exe PID 1412 wrote to memory of 1220 1412 NAPSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\P.O-5433ERE.doc"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\ashlkyvc7592.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ashlkyvc7592.exe"C:\Users\Admin\AppData\Roaming\ashlkyvc7592.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ashlkyvc7592.exe"C:\Users\Admin\AppData\Roaming\ashlkyvc7592.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ashlkyvc7592.exeMD5
d236bb1f86caec110abb20fc2360e25b
SHA10611498ed409d30150d2a0b2a6426e5cb9504d8a
SHA2562f08f5b23a062671fba5957b98d05a728299bb1ae98695b9b5d36e75528ccab7
SHA5124f1b645a4710291c197f25e7c7258d5d4d2f710607412228deba8d7a1c172fdd6d82db2c791c6d6064e405aa577ddc1bf469d6eb8c2241a0acb068a31f3490d1
-
C:\Users\Admin\AppData\Roaming\ashlkyvc7592.exeMD5
d236bb1f86caec110abb20fc2360e25b
SHA10611498ed409d30150d2a0b2a6426e5cb9504d8a
SHA2562f08f5b23a062671fba5957b98d05a728299bb1ae98695b9b5d36e75528ccab7
SHA5124f1b645a4710291c197f25e7c7258d5d4d2f710607412228deba8d7a1c172fdd6d82db2c791c6d6064e405aa577ddc1bf469d6eb8c2241a0acb068a31f3490d1
-
C:\Users\Admin\AppData\Roaming\ashlkyvc7592.exeMD5
d236bb1f86caec110abb20fc2360e25b
SHA10611498ed409d30150d2a0b2a6426e5cb9504d8a
SHA2562f08f5b23a062671fba5957b98d05a728299bb1ae98695b9b5d36e75528ccab7
SHA5124f1b645a4710291c197f25e7c7258d5d4d2f710607412228deba8d7a1c172fdd6d82db2c791c6d6064e405aa577ddc1bf469d6eb8c2241a0acb068a31f3490d1
-
\Users\Admin\AppData\Roaming\ashlkyvc7592.exeMD5
d236bb1f86caec110abb20fc2360e25b
SHA10611498ed409d30150d2a0b2a6426e5cb9504d8a
SHA2562f08f5b23a062671fba5957b98d05a728299bb1ae98695b9b5d36e75528ccab7
SHA5124f1b645a4710291c197f25e7c7258d5d4d2f710607412228deba8d7a1c172fdd6d82db2c791c6d6064e405aa577ddc1bf469d6eb8c2241a0acb068a31f3490d1
-
memory/808-56-0x000000006FC31000-0x000000006FC33000-memory.dmpFilesize
8KB
-
memory/808-57-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/808-58-0x0000000075981000-0x0000000075983000-memory.dmpFilesize
8KB
-
memory/808-55-0x00000000721B1000-0x00000000721B4000-memory.dmpFilesize
12KB
-
memory/808-90-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/936-69-0x000007FEFB6C1000-0x000007FEFB6C3000-memory.dmpFilesize
8KB
-
memory/936-68-0x0000000000000000-mapping.dmp
-
memory/1132-67-0x0000000000BC0000-0x0000000000BC1000-memory.dmpFilesize
4KB
-
memory/1132-66-0x00000000004F0000-0x00000000004F8000-memory.dmpFilesize
32KB
-
memory/1132-70-0x0000000004E80000-0x0000000004ED9000-memory.dmpFilesize
356KB
-
memory/1132-64-0x0000000001240000-0x0000000001241000-memory.dmpFilesize
4KB
-
memory/1132-61-0x0000000000000000-mapping.dmp
-
memory/1220-84-0x0000000000000000-mapping.dmp
-
memory/1380-82-0x0000000007500000-0x0000000007665000-memory.dmpFilesize
1.4MB
-
memory/1380-79-0x00000000073C0000-0x00000000074F6000-memory.dmpFilesize
1.2MB
-
memory/1380-89-0x0000000004210000-0x00000000042AE000-memory.dmpFilesize
632KB
-
memory/1412-87-0x0000000001FF0000-0x00000000022F3000-memory.dmpFilesize
3.0MB
-
memory/1412-83-0x0000000000000000-mapping.dmp
-
memory/1412-85-0x00000000004A0000-0x00000000004E6000-memory.dmpFilesize
280KB
-
memory/1412-86-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1412-88-0x0000000001E60000-0x0000000001EF0000-memory.dmpFilesize
576KB
-
memory/1724-78-0x0000000000280000-0x0000000000291000-memory.dmpFilesize
68KB
-
memory/1724-80-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1724-81-0x00000000002D0000-0x00000000002E1000-memory.dmpFilesize
68KB
-
memory/1724-73-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1724-72-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1724-74-0x000000000041D410-mapping.dmp
-
memory/1724-77-0x0000000000800000-0x0000000000B03000-memory.dmpFilesize
3.0MB
-
memory/1724-71-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB