ostap | 3d0c3f3d464a8229480b6d4a024d2982c72d67942d8ee245dd91da1a26ddd22a

General

Target

3d0c3f3d464a8229480b6d4a024d2982c72d67942d8ee245dd91da1a26ddd22a.doc
Size

670KB
MD5

dfcdb189eafa87b66861d3d110e17f7a
SHA1

c05d97f19fe2defb98bad06fcfbc2af447f7e921
SHA256

3d0c3f3d464a8229480b6d4a024d2982c72d67942d8ee245dd91da1a26ddd22a
SHA512

fdaa7f8fa5276abff70a7bb0b21136e0d6780d5288cda5cc778719c54a26167db50ee16ded04c7be8ee04368d8f1ad4f1bb3ab6a427e1a6d8dc8c85d3b129a25

Score

10^/10

Malware Config

Signatures

Ostap JavaScript Downloader 1 IoCs

Ostap is a JavaScript downloader that's been active since 2016. It's used to deliver several families, inluding TrickBot

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\3d0c3f3d464a8229480b6d4a024d2982c72d67942d8ee245dd91da1a26ddd22a.doc260.bat	family_ostap

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	4816	3148	cmd.exe	WINWORD.EXE

ostap
Ostap is a JS downloader, used to deliver other families.
downloader ostap
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Contains header used in .cmd/.bat files for embedding JavaScript code 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\3d0c3f3d464a8229480b6d4a024d2982c72d67942d8ee245dd91da1a26ddd22a.doc260.bat	js_embedded

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies data under HKEY_USERS 41 IoCs

Processes:

WaaSMedicAgent.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

WINWORD.EXE

pid process

3148 WINWORD.EXE
3148 WINWORD.EXE
3148 WINWORD.EXE

pid	process
3148	WINWORD.EXE
3148	WINWORD.EXE
3148	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	1876	svchost.exe
Token: SeCreatePagefilePrivilege	1876	svchost.exe
Token: SeShutdownPrivilege	1876	svchost.exe
Token: SeCreatePagefilePrivilege	1876	svchost.exe
Token: SeShutdownPrivilege	1876	svchost.exe
Token: SeCreatePagefilePrivilege	1876	svchost.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

WINWORD.EXE

pid process

3148 WINWORD.EXE
3148 WINWORD.EXE
3148 WINWORD.EXE
3148 WINWORD.EXE
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

WINWORD.EXE

pid process

3148 WINWORD.EXE
3148 WINWORD.EXE
3148 WINWORD.EXE
3148 WINWORD.EXE
3148 WINWORD.EXE
3148 WINWORD.EXE
3148 WINWORD.EXE
3148 WINWORD.EXE
3148 WINWORD.EXE

pid	process
3148	WINWORD.EXE
3148	WINWORD.EXE
3148	WINWORD.EXE
3148	WINWORD.EXE

pid	process
3148	WINWORD.EXE
3148	WINWORD.EXE
3148	WINWORD.EXE
3148	WINWORD.EXE
3148	WINWORD.EXE
3148	WINWORD.EXE
3148	WINWORD.EXE
3148	WINWORD.EXE
3148	WINWORD.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

WINWORD.EXEcmd.exe

description	pid	process	target process
PID 3148 wrote to memory of 2736	3148	WINWORD.EXE	splwow64.exe
PID 3148 wrote to memory of 2736	3148	WINWORD.EXE	splwow64.exe
PID 3148 wrote to memory of 4816	3148	WINWORD.EXE	cmd.exe
PID 3148 wrote to memory of 4816	3148	WINWORD.EXE	cmd.exe
PID 4816 wrote to memory of 4596	4816	cmd.exe	wscript.exe
PID 4816 wrote to memory of 4596	4816	cmd.exe	wscript.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\3d0c3f3d464a8229480b6d4a024d2982c72d67942d8ee245dd91da1a26ddd22a.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3148

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:2736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\3d0c3f3d464a8229480b6d4a024d2982c72d67942d8ee245dd91da1a26ddd22a.doc260.bat" "
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4816

C:\Windows\system32\wscript.exe
wscript /e:JSCript "C:\Users\Admin\AppData\Roaming\3d0c3f3d464a8229480b6d4a024d2982c72d67942d8ee245dd91da1a26ddd22a.doc260.bat"
3⤵
PID:4596

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 3fb88505fb666e5aafc898c2952ee4c0 seL3WnZAdUG983ZOn3PCHg.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:1388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\3d0c3f3d464a8229480b6d4a024d2982c72d67942d8ee245dd91da1a26ddd22a.doc260.bat

MD5
05617edf8370a047adf08327e96794a1

SHA1
6c619797acd29659e5422e8b6f4917ec7527b156

SHA256
0457a85a8a91f25ff5d2751c7b3bec443ff138c6624b4e6b3643560eb9f193eb

SHA512
faec7790a8c81a69853dc46101fb71462a96858ce85db873547dacffd405e4754e3331c2c818a1dfe3540801dfa0d0a9e48ec5d4f4daf6f88a67dee6e1b7c9f6

Download Submit
memory/1876-136-0x000001915D3A0000-0x000001915D3B0000-memory.dmp

Filesize
64KB

Download
memory/1876-143-0x0000019160020000-0x0000019160024000-memory.dmp

Filesize
16KB

Download
memory/3148-132-0x00007FFC21630000-0x00007FFC21640000-memory.dmp

Filesize
64KB

Download
memory/3148-133-0x00007FFC21630000-0x00007FFC21640000-memory.dmp

Filesize
64KB

Download
memory/3148-134-0x00007FFC21630000-0x00007FFC21640000-memory.dmp

Filesize
64KB

Download
memory/3148-135-0x00007FFC1F460000-0x00007FFC1F470000-memory.dmp

Filesize
64KB

Download
memory/3148-130-0x00007FFC21630000-0x00007FFC21640000-memory.dmp

Filesize
64KB

Download
memory/3148-144-0x00007FFC1F460000-0x00007FFC1F470000-memory.dmp

Filesize
64KB

Download
memory/3148-131-0x00007FFC21630000-0x00007FFC21640000-memory.dmp

Filesize
64KB

Download
memory/3148-250-0x00007FFC21630000-0x00007FFC21640000-memory.dmp

Filesize
64KB

Download
memory/3148-251-0x00007FFC21630000-0x00007FFC21640000-memory.dmp

Filesize
64KB

Download
memory/3148-252-0x00007FFC21630000-0x00007FFC21640000-memory.dmp

Filesize
64KB

Download
memory/3148-253-0x00007FFC21630000-0x00007FFC21640000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads