Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
11-01-2022 14:00
Static task
static1
Behavioral task
behavioral1
Sample
Proof of payment.doc.rtf
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Proof of payment.doc.rtf
Resource
win10-en-20211208
General
-
Target
Proof of payment.doc.rtf
-
Size
25KB
-
MD5
72b5faa2facec80772b70a01bae1c0b0
-
SHA1
86bbe9fbc76392d2e7faa5815b3bd134b3e5b50c
-
SHA256
cec9a413c1844c029f7801e4d74e941215d8f328169ccb37fb909c73651bde6b
-
SHA512
15206180022ec808a7d3d68677b162af126a4d5a1fb5967ce43e2d9163ea98c78409ad6159edbc5c3686da6799f95cd75f57ed4f067e56205580322b2521f7fc
Malware Config
Extracted
formbook
4.1
a83r
comercializadoralonso.com
durhamschoolservces.com
onegreencapital.com
smartcities24.com
maquinas.store
brianlovesbonsai.com
xin41518s.com
moneyearnus.xyz
be-mix.com
fengyat.club
inspectdecided.xyz
paksafpakistan.com
orhidlnt.top
princesuraj.com
vietnamvodka.com
renewnow.site
imageservices.xyz
luxurytravelfranchise.com
kp112.red
royalyorkfirewood.com
azharrizvi.com
mtvamazon.com
stlouisplatinumhomes.com
ke6rkmtn.xyz
roomviser.xyz
rollcalloutfitters.com
jlautoparts.net
swipyy.xyz
handymansaltlakecity.com
tuespr.com
prelink.xyz
whrpky037.xyz
yoga-4-health.com
silvermoonandcompany.com
meg-roh.com
81218121.com
prayerteamusa.com
ocejxu.com
lopeyhomeimporvementservice.com
dcosearchandconnect.xyz
md-newspages.online
elinmex.online
traineriq.com
feministecologies.com
gyltogether.com
polyversed.com
rodolforios.com
bcfs0l.com
51dmm.com
metaverselivecasinos.com
csjsgk.com
impactincentivesregistry.com
firekim.space
jdzn.xyz
d6ybf7yj.xyz
sturt.xyz
serious-cam.com
stihl-gms.com
gentleman5.xyz
rustbeltcoders.net
hmarketsed96.com
cricfreelive.com
wellyounow.com
fwdrow.com
hstolchsjybyl.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/696-73-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/696-74-0x000000000041F170-mapping.dmp formbook behavioral1/memory/696-80-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1620-85-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 5 332 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
aguercn9684.exeaguercn9684.exepid process 1676 aguercn9684.exe 696 aguercn9684.exe -
Loads dropped DLL 1 IoCs
Processes:
EQNEDT32.EXEpid process 332 EQNEDT32.EXE -
Suspicious use of SetThreadContext 4 IoCs
Processes:
aguercn9684.exeaguercn9684.exesvchost.exedescription pid process target process PID 1676 set thread context of 696 1676 aguercn9684.exe aguercn9684.exe PID 696 set thread context of 1224 696 aguercn9684.exe Explorer.EXE PID 696 set thread context of 1224 696 aguercn9684.exe Explorer.EXE PID 1620 set thread context of 1224 1620 svchost.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1504 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
aguercn9684.exesvchost.exepid process 696 aguercn9684.exe 696 aguercn9684.exe 696 aguercn9684.exe 1620 svchost.exe 1620 svchost.exe 1620 svchost.exe 1620 svchost.exe 1620 svchost.exe 1620 svchost.exe 1620 svchost.exe 1620 svchost.exe 1620 svchost.exe 1620 svchost.exe 1620 svchost.exe 1620 svchost.exe 1620 svchost.exe 1620 svchost.exe 1620 svchost.exe 1620 svchost.exe 1620 svchost.exe 1620 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
aguercn9684.exesvchost.exepid process 696 aguercn9684.exe 696 aguercn9684.exe 696 aguercn9684.exe 696 aguercn9684.exe 1620 svchost.exe 1620 svchost.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
aguercn9684.exesvchost.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 696 aguercn9684.exe Token: SeDebugPrivilege 1620 svchost.exe Token: SeShutdownPrivilege 1224 Explorer.EXE Token: SeShutdownPrivilege 1224 Explorer.EXE Token: SeShutdownPrivilege 1224 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1504 WINWORD.EXE 1504 WINWORD.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
EQNEDT32.EXEWINWORD.EXEaguercn9684.exeExplorer.EXEsvchost.exedescription pid process target process PID 332 wrote to memory of 1676 332 EQNEDT32.EXE aguercn9684.exe PID 332 wrote to memory of 1676 332 EQNEDT32.EXE aguercn9684.exe PID 332 wrote to memory of 1676 332 EQNEDT32.EXE aguercn9684.exe PID 332 wrote to memory of 1676 332 EQNEDT32.EXE aguercn9684.exe PID 1504 wrote to memory of 1088 1504 WINWORD.EXE splwow64.exe PID 1504 wrote to memory of 1088 1504 WINWORD.EXE splwow64.exe PID 1504 wrote to memory of 1088 1504 WINWORD.EXE splwow64.exe PID 1504 wrote to memory of 1088 1504 WINWORD.EXE splwow64.exe PID 1676 wrote to memory of 696 1676 aguercn9684.exe aguercn9684.exe PID 1676 wrote to memory of 696 1676 aguercn9684.exe aguercn9684.exe PID 1676 wrote to memory of 696 1676 aguercn9684.exe aguercn9684.exe PID 1676 wrote to memory of 696 1676 aguercn9684.exe aguercn9684.exe PID 1676 wrote to memory of 696 1676 aguercn9684.exe aguercn9684.exe PID 1676 wrote to memory of 696 1676 aguercn9684.exe aguercn9684.exe PID 1676 wrote to memory of 696 1676 aguercn9684.exe aguercn9684.exe PID 1224 wrote to memory of 1620 1224 Explorer.EXE svchost.exe PID 1224 wrote to memory of 1620 1224 Explorer.EXE svchost.exe PID 1224 wrote to memory of 1620 1224 Explorer.EXE svchost.exe PID 1224 wrote to memory of 1620 1224 Explorer.EXE svchost.exe PID 1620 wrote to memory of 316 1620 svchost.exe cmd.exe PID 1620 wrote to memory of 316 1620 svchost.exe cmd.exe PID 1620 wrote to memory of 316 1620 svchost.exe cmd.exe PID 1620 wrote to memory of 316 1620 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Proof of payment.doc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\aguercn9684.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\aguercn9684.exe"C:\Users\Admin\AppData\Roaming\aguercn9684.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\aguercn9684.exe"C:\Users\Admin\AppData\Roaming\aguercn9684.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\aguercn9684.exeMD5
6d43ab36d6096de0614efff10a85e18b
SHA12550cddf1cb6dc60362b8b66adbe85c1d0a599b5
SHA25695e46ac69b189a47167d193f4d43756f9cf965deba4ae6608ea20115209090e2
SHA51251b08340e078826f5f100b49e9979df3a5cf3a751000141d7681bba4c52852ecf424c44821f897ca9eae8cdaa80f81bdef98606dfcd0dc0dbcd1e412d41f8231
-
C:\Users\Admin\AppData\Roaming\aguercn9684.exeMD5
6d43ab36d6096de0614efff10a85e18b
SHA12550cddf1cb6dc60362b8b66adbe85c1d0a599b5
SHA25695e46ac69b189a47167d193f4d43756f9cf965deba4ae6608ea20115209090e2
SHA51251b08340e078826f5f100b49e9979df3a5cf3a751000141d7681bba4c52852ecf424c44821f897ca9eae8cdaa80f81bdef98606dfcd0dc0dbcd1e412d41f8231
-
C:\Users\Admin\AppData\Roaming\aguercn9684.exeMD5
6d43ab36d6096de0614efff10a85e18b
SHA12550cddf1cb6dc60362b8b66adbe85c1d0a599b5
SHA25695e46ac69b189a47167d193f4d43756f9cf965deba4ae6608ea20115209090e2
SHA51251b08340e078826f5f100b49e9979df3a5cf3a751000141d7681bba4c52852ecf424c44821f897ca9eae8cdaa80f81bdef98606dfcd0dc0dbcd1e412d41f8231
-
\Users\Admin\AppData\Roaming\aguercn9684.exeMD5
6d43ab36d6096de0614efff10a85e18b
SHA12550cddf1cb6dc60362b8b66adbe85c1d0a599b5
SHA25695e46ac69b189a47167d193f4d43756f9cf965deba4ae6608ea20115209090e2
SHA51251b08340e078826f5f100b49e9979df3a5cf3a751000141d7681bba4c52852ecf424c44821f897ca9eae8cdaa80f81bdef98606dfcd0dc0dbcd1e412d41f8231
-
memory/316-87-0x0000000000000000-mapping.dmp
-
memory/696-74-0x000000000041F170-mapping.dmp
-
memory/696-71-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/696-81-0x00000000004B0000-0x00000000004C4000-memory.dmpFilesize
80KB
-
memory/696-80-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/696-77-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/696-78-0x0000000000460000-0x0000000000474000-memory.dmpFilesize
80KB
-
memory/696-73-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/696-72-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1088-68-0x0000000000000000-mapping.dmp
-
memory/1088-69-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmpFilesize
8KB
-
memory/1224-82-0x00000000065B0000-0x00000000066C5000-memory.dmpFilesize
1.1MB
-
memory/1224-92-0x000007FF45B00000-0x000007FF45B0A000-memory.dmpFilesize
40KB
-
memory/1224-89-0x0000000006BB0000-0x0000000006CAE000-memory.dmpFilesize
1016KB
-
memory/1224-79-0x0000000007550000-0x0000000007674000-memory.dmpFilesize
1.1MB
-
memory/1224-91-0x000007FEF5F40000-0x000007FEF6083000-memory.dmpFilesize
1.3MB
-
memory/1504-54-0x0000000072DA1000-0x0000000072DA4000-memory.dmpFilesize
12KB
-
memory/1504-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1504-55-0x0000000070821000-0x0000000070823000-memory.dmpFilesize
8KB
-
memory/1504-90-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1504-57-0x0000000076451000-0x0000000076453000-memory.dmpFilesize
8KB
-
memory/1620-84-0x0000000000A70000-0x0000000000A78000-memory.dmpFilesize
32KB
-
memory/1620-83-0x0000000000000000-mapping.dmp
-
memory/1620-85-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1620-86-0x0000000000740000-0x0000000000A43000-memory.dmpFilesize
3.0MB
-
memory/1620-88-0x00000000002F0000-0x0000000000383000-memory.dmpFilesize
588KB
-
memory/1676-70-0x00000000050E0000-0x0000000005146000-memory.dmpFilesize
408KB
-
memory/1676-67-0x00000000003B0000-0x00000000003BE000-memory.dmpFilesize
56KB
-
memory/1676-66-0x0000000004630000-0x0000000004631000-memory.dmpFilesize
4KB
-
memory/1676-64-0x0000000000EA0000-0x0000000000F1C000-memory.dmpFilesize
496KB
-
memory/1676-63-0x0000000000EA0000-0x0000000000F1C000-memory.dmpFilesize
496KB
-
memory/1676-60-0x0000000000000000-mapping.dmp