6655026d703e9efb9805807cb20b7d8284ff91979f5b746c32a965ca1a268ca4

General

Target

6655026d703e9efb9805807cb20b7d8284ff91979f5b746c32a965ca1a268ca4.doc
Size

1000KB
MD5

603bebc04d98f9a62b4201c6d46f9ba6
SHA1

345fb60733a9cb98d9ec051ec3d33abf721477fc
SHA256

6655026d703e9efb9805807cb20b7d8284ff91979f5b746c32a965ca1a268ca4
SHA512

917699e9f97a13a18c7a531a1b136816ae95f647d7e41fa6b56f81ac8ff63e6de877c5672977fcbd5d2705e4a17f317c105c0d3a3d7d7b5aaff64930e6ef6aa2

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

notepad.exeWMIC.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3984	2532	notepad.exe	WINWORD.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	2232	2532	WMIC.exe	WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

3984 notepad.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

2532 WINWORD.EXE
2532 WINWORD.EXE

pid	process
3984	notepad.exe

pid	process
2532	WINWORD.EXE
2532	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

WMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2232	WMIC.exe
Token: SeSecurityPrivilege	2232	WMIC.exe
Token: SeTakeOwnershipPrivilege	2232	WMIC.exe
Token: SeLoadDriverPrivilege	2232	WMIC.exe
Token: SeSystemProfilePrivilege	2232	WMIC.exe
Token: SeSystemtimePrivilege	2232	WMIC.exe
Token: SeProfSingleProcessPrivilege	2232	WMIC.exe
Token: SeIncBasePriorityPrivilege	2232	WMIC.exe
Token: SeCreatePagefilePrivilege	2232	WMIC.exe
Token: SeBackupPrivilege	2232	WMIC.exe
Token: SeRestorePrivilege	2232	WMIC.exe
Token: SeShutdownPrivilege	2232	WMIC.exe
Token: SeDebugPrivilege	2232	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2232	WMIC.exe
Token: SeRemoteShutdownPrivilege	2232	WMIC.exe
Token: SeUndockPrivilege	2232	WMIC.exe
Token: SeManageVolumePrivilege	2232	WMIC.exe
Token: 33	2232	WMIC.exe
Token: 34	2232	WMIC.exe
Token: 35	2232	WMIC.exe
Token: 36	2232	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2232	WMIC.exe
Token: SeSecurityPrivilege	2232	WMIC.exe
Token: SeTakeOwnershipPrivilege	2232	WMIC.exe
Token: SeLoadDriverPrivilege	2232	WMIC.exe
Token: SeSystemProfilePrivilege	2232	WMIC.exe
Token: SeSystemtimePrivilege	2232	WMIC.exe
Token: SeProfSingleProcessPrivilege	2232	WMIC.exe
Token: SeIncBasePriorityPrivilege	2232	WMIC.exe
Token: SeCreatePagefilePrivilege	2232	WMIC.exe
Token: SeBackupPrivilege	2232	WMIC.exe
Token: SeRestorePrivilege	2232	WMIC.exe
Token: SeShutdownPrivilege	2232	WMIC.exe
Token: SeDebugPrivilege	2232	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2232	WMIC.exe
Token: SeRemoteShutdownPrivilege	2232	WMIC.exe
Token: SeUndockPrivilege	2232	WMIC.exe
Token: SeManageVolumePrivilege	2232	WMIC.exe
Token: 33	2232	WMIC.exe
Token: 34	2232	WMIC.exe
Token: 35	2232	WMIC.exe
Token: 36	2232	WMIC.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

2532 WINWORD.EXE
2532 WINWORD.EXE
2532 WINWORD.EXE
2532 WINWORD.EXE
2532 WINWORD.EXE
2532 WINWORD.EXE
2532 WINWORD.EXE
2532 WINWORD.EXE

pid	process
2532	WINWORD.EXE
2532	WINWORD.EXE
2532	WINWORD.EXE
2532	WINWORD.EXE
2532	WINWORD.EXE
2532	WINWORD.EXE
2532	WINWORD.EXE
2532	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 2532 wrote to memory of 3984	2532	WINWORD.EXE	notepad.exe
PID 2532 wrote to memory of 3984	2532	WINWORD.EXE	notepad.exe
PID 2532 wrote to memory of 2232	2532	WINWORD.EXE	WMIC.exe
PID 2532 wrote to memory of 2232	2532	WINWORD.EXE	WMIC.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\6655026d703e9efb9805807cb20b7d8284ff91979f5b746c32a965ca1a268ca4.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" "C:\Users\Admin\AppData\Roaming\to_show_but.txt"
2⤵
- Process spawned unexpected child process
- Opens file in notepad (likely ransom note)
PID:3984

C:\Windows\System32\wbem\WMIC.exe
"C:\Windows\System32\wbem\WMIC.exe"
2⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:2232

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\to_show_but.txt
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\to_show_but.txt
Filesize
7KB

MD5
20ea1ae158670c229a4de5b14a27b1fe

SHA1
b71dded5e1da5ae5fac20caf86058cf50a34d903

SHA256
59f9673b4397499e180674a90cc75417ecd83fe2f4b37f4c60c5cf88ea7b6595

SHA512
bd233c43541a2c91ee80c30e4edfe5c07e518b2fd4cb751ee172abdc77c045b6c949fd6216f9c7130246857b8f4ed30a0b0aa890fd1b71ef28666ab4650a0b33

Download Submit
memory/2232-139-0x0000000000000000-mapping.dmp

Download
memory/2532-130-0x00007FFA994D0000-0x00007FFA994E0000-memory.dmp

Filesize
64KB

Download
memory/2532-131-0x00007FFA994D0000-0x00007FFA994E0000-memory.dmp

Filesize
64KB

Download
memory/2532-132-0x00007FFA994D0000-0x00007FFA994E0000-memory.dmp

Filesize
64KB

Download
memory/2532-133-0x00007FFA994D0000-0x00007FFA994E0000-memory.dmp

Filesize
64KB

Download
memory/2532-134-0x00007FFA994D0000-0x00007FFA994E0000-memory.dmp

Filesize
64KB

Download
memory/2532-135-0x00007FFA97440000-0x00007FFA97450000-memory.dmp

Filesize
64KB

Download
memory/2532-136-0x00007FFA97440000-0x00007FFA97450000-memory.dmp

Filesize
64KB

Download
memory/3984-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads