Analysis
-
max time kernel
156s -
max time network
118s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
02-02-2022 08:19
Static task
static1
Behavioral task
behavioral1
Sample
orderYHu2022Q1 SMS 0124C4.rtf
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
orderYHu2022Q1 SMS 0124C4.rtf
Resource
win10v2004-en-20220113
General
-
Target
orderYHu2022Q1 SMS 0124C4.rtf
-
Size
12KB
-
MD5
1aa236116a153753d97549e50e0e3eb4
-
SHA1
f91ada10ffb9b8a4ddc496b93428c38a668fcc8b
-
SHA256
d95fbaa4ed83505726f05c48e7c5fb02d875fc6ac5971ce3fbfa8f2fe4b9f70a
-
SHA512
b370445046cfd541e26fa12469344a35b1ed964c95098b5203ab4325d947183e8a0812e57c5f1484f006845c834b300dd74346bf6045e23e61c2d3f5b588b092
Malware Config
Extracted
formbook
4.1
d7ln
bulut-imza.com
gotastebuds.com
shutupmags.com
clocksport.com
toweryachtcounsel.com
kingcopier.com
pluspersona.com
inchallahe.com
unclonedconsulting.com
ccdt168.com
tonyzheng.xyz
voiceoftheepeople.com
cicapital.xyz
offxpro.com
loyatiproductions.com
makemebuystuff.com
incuba8labs.com
remparka.com
newstft.com
bgame.pro
croniesnft.xyz
petaouchnock.site
gavesett.com
smarthousegroup.net
kkqdqj.mobi
glatdelate.quest
sharpmage.com
penis.today
squidscatter.com
digfinancial.com
imx.fund
bigbet3269.com
leatherlidinserts.net
eyecollection-nishigifu.com
wagyuchefs.com
cafeandbakecestbon.com
appsy.tech
johnmaxwelltam.com
eternity-warm.com
naebidynamic.com
landgrunt.com
chap-immo.com
wgzywz.com
zawovu.com
shortsvault.com
squidgameoutfitsss.com
keaneoil.com
v44881.com
spartanboardgames.com
rotcid.xyz
qvconsultants.com
reinorshine.com
turkeyetrade.com
webcomprei.com
00010shou.com
tiffanyandjose.com
todd4mayor.com
designbydb.com
higherj.com
delicatmnl.com
huamanishop.com
pinkle-store.com
gatewaytothegreatoceanroad.com
felerritst.quest
mottpolis.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/924-72-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1948-79-0x0000000000100000-0x000000000012F000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 5 1036 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
darlinth461.exedarlinth461.exedarlinth461.exepid process 1116 darlinth461.exe 296 darlinth461.exe 924 darlinth461.exe -
Loads dropped DLL 1 IoCs
Processes:
EQNEDT32.EXEpid process 1036 EQNEDT32.EXE -
Suspicious use of SetThreadContext 3 IoCs
Processes:
darlinth461.exedarlinth461.exewlanext.exedescription pid process target process PID 1116 set thread context of 924 1116 darlinth461.exe darlinth461.exe PID 924 set thread context of 1276 924 darlinth461.exe Explorer.EXE PID 1948 set thread context of 1276 1948 wlanext.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1520 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
darlinth461.exedarlinth461.exewlanext.exepid process 1116 darlinth461.exe 1116 darlinth461.exe 924 darlinth461.exe 924 darlinth461.exe 1948 wlanext.exe 1948 wlanext.exe 1948 wlanext.exe 1948 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
darlinth461.exewlanext.exepid process 924 darlinth461.exe 924 darlinth461.exe 924 darlinth461.exe 1948 wlanext.exe 1948 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
darlinth461.exedarlinth461.exewlanext.exedescription pid process Token: SeDebugPrivilege 1116 darlinth461.exe Token: SeDebugPrivilege 924 darlinth461.exe Token: SeDebugPrivilege 1948 wlanext.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1520 WINWORD.EXE 1520 WINWORD.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
EQNEDT32.EXEWINWORD.EXEdarlinth461.exeExplorer.EXEwlanext.exedescription pid process target process PID 1036 wrote to memory of 1116 1036 EQNEDT32.EXE darlinth461.exe PID 1036 wrote to memory of 1116 1036 EQNEDT32.EXE darlinth461.exe PID 1036 wrote to memory of 1116 1036 EQNEDT32.EXE darlinth461.exe PID 1036 wrote to memory of 1116 1036 EQNEDT32.EXE darlinth461.exe PID 1520 wrote to memory of 1712 1520 WINWORD.EXE splwow64.exe PID 1520 wrote to memory of 1712 1520 WINWORD.EXE splwow64.exe PID 1520 wrote to memory of 1712 1520 WINWORD.EXE splwow64.exe PID 1520 wrote to memory of 1712 1520 WINWORD.EXE splwow64.exe PID 1116 wrote to memory of 296 1116 darlinth461.exe darlinth461.exe PID 1116 wrote to memory of 296 1116 darlinth461.exe darlinth461.exe PID 1116 wrote to memory of 296 1116 darlinth461.exe darlinth461.exe PID 1116 wrote to memory of 296 1116 darlinth461.exe darlinth461.exe PID 1116 wrote to memory of 924 1116 darlinth461.exe darlinth461.exe PID 1116 wrote to memory of 924 1116 darlinth461.exe darlinth461.exe PID 1116 wrote to memory of 924 1116 darlinth461.exe darlinth461.exe PID 1116 wrote to memory of 924 1116 darlinth461.exe darlinth461.exe PID 1116 wrote to memory of 924 1116 darlinth461.exe darlinth461.exe PID 1116 wrote to memory of 924 1116 darlinth461.exe darlinth461.exe PID 1116 wrote to memory of 924 1116 darlinth461.exe darlinth461.exe PID 1276 wrote to memory of 1948 1276 Explorer.EXE wlanext.exe PID 1276 wrote to memory of 1948 1276 Explorer.EXE wlanext.exe PID 1276 wrote to memory of 1948 1276 Explorer.EXE wlanext.exe PID 1276 wrote to memory of 1948 1276 Explorer.EXE wlanext.exe PID 1948 wrote to memory of 1808 1948 wlanext.exe cmd.exe PID 1948 wrote to memory of 1808 1948 wlanext.exe cmd.exe PID 1948 wrote to memory of 1808 1948 wlanext.exe cmd.exe PID 1948 wrote to memory of 1808 1948 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\orderYHu2022Q1 SMS 0124C4.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\darlinth461.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\darlinth461.exe"C:\Users\Admin\AppData\Roaming\darlinth461.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\darlinth461.exe"C:\Users\Admin\AppData\Roaming\darlinth461.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\darlinth461.exe"C:\Users\Admin\AppData\Roaming\darlinth461.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\darlinth461.exeMD5
58ccf85be4da1381ad293a5cd574a392
SHA11819c67bf112c0bcf45a94d2159b0bc9bce1b325
SHA25623e036670b0b92bfe6dc815ae97ae208cfce3762186015b2ac3fa943594d192b
SHA512f1ffcac036a949ca9fc31796b476d092ad32e8f909c10520668deb804fa84ca1c10f0b10bf065781493ef1e3b38b7a3e5305f54fc4d95556c8b8df4a78f39651
-
C:\Users\Admin\AppData\Roaming\darlinth461.exeMD5
58ccf85be4da1381ad293a5cd574a392
SHA11819c67bf112c0bcf45a94d2159b0bc9bce1b325
SHA25623e036670b0b92bfe6dc815ae97ae208cfce3762186015b2ac3fa943594d192b
SHA512f1ffcac036a949ca9fc31796b476d092ad32e8f909c10520668deb804fa84ca1c10f0b10bf065781493ef1e3b38b7a3e5305f54fc4d95556c8b8df4a78f39651
-
C:\Users\Admin\AppData\Roaming\darlinth461.exeMD5
58ccf85be4da1381ad293a5cd574a392
SHA11819c67bf112c0bcf45a94d2159b0bc9bce1b325
SHA25623e036670b0b92bfe6dc815ae97ae208cfce3762186015b2ac3fa943594d192b
SHA512f1ffcac036a949ca9fc31796b476d092ad32e8f909c10520668deb804fa84ca1c10f0b10bf065781493ef1e3b38b7a3e5305f54fc4d95556c8b8df4a78f39651
-
C:\Users\Admin\AppData\Roaming\darlinth461.exeMD5
58ccf85be4da1381ad293a5cd574a392
SHA11819c67bf112c0bcf45a94d2159b0bc9bce1b325
SHA25623e036670b0b92bfe6dc815ae97ae208cfce3762186015b2ac3fa943594d192b
SHA512f1ffcac036a949ca9fc31796b476d092ad32e8f909c10520668deb804fa84ca1c10f0b10bf065781493ef1e3b38b7a3e5305f54fc4d95556c8b8df4a78f39651
-
\Users\Admin\AppData\Roaming\darlinth461.exeMD5
58ccf85be4da1381ad293a5cd574a392
SHA11819c67bf112c0bcf45a94d2159b0bc9bce1b325
SHA25623e036670b0b92bfe6dc815ae97ae208cfce3762186015b2ac3fa943594d192b
SHA512f1ffcac036a949ca9fc31796b476d092ad32e8f909c10520668deb804fa84ca1c10f0b10bf065781493ef1e3b38b7a3e5305f54fc4d95556c8b8df4a78f39651
-
memory/924-74-0x0000000000870000-0x0000000000C73000-memory.dmpFilesize
4.0MB
-
memory/924-72-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/924-76-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/924-70-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/924-71-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1116-62-0x00000000002F0000-0x000000000036A000-memory.dmpFilesize
488KB
-
memory/1116-64-0x00000000022D0000-0x00000000022D1000-memory.dmpFilesize
4KB
-
memory/1116-65-0x0000000000240000-0x0000000000254000-memory.dmpFilesize
80KB
-
memory/1116-68-0x0000000005260000-0x00000000052C6000-memory.dmpFilesize
408KB
-
memory/1276-82-0x0000000006C20000-0x0000000006D44000-memory.dmpFilesize
1.1MB
-
memory/1276-77-0x0000000006AF0000-0x0000000006C1A000-memory.dmpFilesize
1.2MB
-
memory/1520-55-0x0000000070931000-0x0000000070933000-memory.dmpFilesize
8KB
-
memory/1520-57-0x00000000766D1000-0x00000000766D3000-memory.dmpFilesize
8KB
-
memory/1520-54-0x0000000072EB1000-0x0000000072EB4000-memory.dmpFilesize
12KB
-
memory/1520-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1520-67-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1712-66-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmpFilesize
8KB
-
memory/1948-78-0x0000000000BB0000-0x0000000000BC6000-memory.dmpFilesize
88KB
-
memory/1948-79-0x0000000000100000-0x000000000012F000-memory.dmpFilesize
188KB
-
memory/1948-80-0x0000000001FD0000-0x00000000022D3000-memory.dmpFilesize
3.0MB
-
memory/1948-81-0x0000000000490000-0x0000000000A31000-memory.dmpFilesize
5.6MB