5505b90064bed94dfd3199e71b06f74aeed136f8a1ced57f65e604ba427016ac

General

Target

5505b90064bed94dfd3199e71b06f74aeed136f8a1ced57f65e604ba427016ac.doc
Size

548KB
MD5

46fb44acc4862a5f3c60b77153676efa
SHA1

b4ad77cf731f93a5b3cc59f152be8f39e752b99f
SHA256

5505b90064bed94dfd3199e71b06f74aeed136f8a1ced57f65e604ba427016ac
SHA512

999724485843a39e0ea7e801fe5ff4ffd4700e139c7a4cde80e59dd2e3b76f84c7d3d4a9863d22f09d6f5f604342ab330b651b58249b0fa4d33f8ce77f43e461

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

notepad.exeWMIC.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	4616	3044	notepad.exe	WINWORD.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	2744	3044	WMIC.exe	WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

4616 notepad.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3044 WINWORD.EXE
3044 WINWORD.EXE

pid	process
4616	notepad.exe

pid	process
3044	WINWORD.EXE
3044	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

WMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2744	WMIC.exe
Token: SeSecurityPrivilege	2744	WMIC.exe
Token: SeTakeOwnershipPrivilege	2744	WMIC.exe
Token: SeLoadDriverPrivilege	2744	WMIC.exe
Token: SeSystemProfilePrivilege	2744	WMIC.exe
Token: SeSystemtimePrivilege	2744	WMIC.exe
Token: SeProfSingleProcessPrivilege	2744	WMIC.exe
Token: SeIncBasePriorityPrivilege	2744	WMIC.exe
Token: SeCreatePagefilePrivilege	2744	WMIC.exe
Token: SeBackupPrivilege	2744	WMIC.exe
Token: SeRestorePrivilege	2744	WMIC.exe
Token: SeShutdownPrivilege	2744	WMIC.exe
Token: SeDebugPrivilege	2744	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2744	WMIC.exe
Token: SeRemoteShutdownPrivilege	2744	WMIC.exe
Token: SeUndockPrivilege	2744	WMIC.exe
Token: SeManageVolumePrivilege	2744	WMIC.exe
Token: 33	2744	WMIC.exe
Token: 34	2744	WMIC.exe
Token: 35	2744	WMIC.exe
Token: 36	2744	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2744	WMIC.exe
Token: SeSecurityPrivilege	2744	WMIC.exe
Token: SeTakeOwnershipPrivilege	2744	WMIC.exe
Token: SeLoadDriverPrivilege	2744	WMIC.exe
Token: SeSystemProfilePrivilege	2744	WMIC.exe
Token: SeSystemtimePrivilege	2744	WMIC.exe
Token: SeProfSingleProcessPrivilege	2744	WMIC.exe
Token: SeIncBasePriorityPrivilege	2744	WMIC.exe
Token: SeCreatePagefilePrivilege	2744	WMIC.exe
Token: SeBackupPrivilege	2744	WMIC.exe
Token: SeRestorePrivilege	2744	WMIC.exe
Token: SeShutdownPrivilege	2744	WMIC.exe
Token: SeDebugPrivilege	2744	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2744	WMIC.exe
Token: SeRemoteShutdownPrivilege	2744	WMIC.exe
Token: SeUndockPrivilege	2744	WMIC.exe
Token: SeManageVolumePrivilege	2744	WMIC.exe
Token: 33	2744	WMIC.exe
Token: 34	2744	WMIC.exe
Token: 35	2744	WMIC.exe
Token: 36	2744	WMIC.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

3044 WINWORD.EXE
3044 WINWORD.EXE
3044 WINWORD.EXE
3044 WINWORD.EXE
3044 WINWORD.EXE
3044 WINWORD.EXE
3044 WINWORD.EXE
3044 WINWORD.EXE

pid	process
3044	WINWORD.EXE
3044	WINWORD.EXE
3044	WINWORD.EXE
3044	WINWORD.EXE
3044	WINWORD.EXE
3044	WINWORD.EXE
3044	WINWORD.EXE
3044	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 3044 wrote to memory of 4616	3044	WINWORD.EXE	notepad.exe
PID 3044 wrote to memory of 4616	3044	WINWORD.EXE	notepad.exe
PID 3044 wrote to memory of 2744	3044	WINWORD.EXE	WMIC.exe
PID 3044 wrote to memory of 2744	3044	WINWORD.EXE	WMIC.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5505b90064bed94dfd3199e71b06f74aeed136f8a1ced57f65e604ba427016ac.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Roaming\most_acutely_did.txt
2⤵
- Process spawned unexpected child process
- Opens file in notepad (likely ransom note)
PID:4616

C:\Windows\System32\wbem\WMIC.exe
"C:\Windows\System32\wbem\WMIC.exe"
2⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:2744

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\most_acutely_did.txt
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/2744-140-0x0000000000000000-mapping.dmp

Download
memory/3044-130-0x00007FFBB2A70000-0x00007FFBB2A80000-memory.dmp

Filesize
64KB

Download
memory/3044-131-0x00007FFBB2A70000-0x00007FFBB2A80000-memory.dmp

Filesize
64KB

Download
memory/3044-132-0x00007FFBB2A70000-0x00007FFBB2A80000-memory.dmp

Filesize
64KB

Download
memory/3044-133-0x00007FFBB2A70000-0x00007FFBB2A80000-memory.dmp

Filesize
64KB

Download
memory/3044-134-0x00007FFBB2A70000-0x00007FFBB2A80000-memory.dmp

Filesize
64KB

Download
memory/3044-135-0x00007FFBB08B0000-0x00007FFBB08C0000-memory.dmp

Filesize
64KB

Download
memory/3044-136-0x00007FFBB08B0000-0x00007FFBB08C0000-memory.dmp

Filesize
64KB

Download
memory/3044-137-0x000001B0A3F0F000-0x000001B0A3F11000-memory.dmp

Filesize
8KB

Download
memory/4616-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads