46ef92741b21febd56c2545e500972f7ec4b8e7a87428164711c50d889564a93

General

Target

46ef92741b21febd56c2545e500972f7ec4b8e7a87428164711c50d889564a93.doc
Size

524KB
MD5

b8eb611067136ae5f8b758f016a18f60
SHA1

b731dc4669e547e78941f393f585fada97836a3d
SHA256

46ef92741b21febd56c2545e500972f7ec4b8e7a87428164711c50d889564a93
SHA512

c39773a745b633722a17da7c758721a21d69615c23376951a8eedd4ea3f5b9dc3b8936c431363c538d47491c29c79bb61a525f5beaf47ed64bca2ad137b8cc4a

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

notepad.exeWMIC.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	440	532	notepad.exe	WINWORD.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	800	532	WMIC.exe	WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

440 notepad.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

532 WINWORD.EXE
532 WINWORD.EXE

pid	process
440	notepad.exe

pid	process
532	WINWORD.EXE
532	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

WMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	800	WMIC.exe
Token: SeSecurityPrivilege	800	WMIC.exe
Token: SeTakeOwnershipPrivilege	800	WMIC.exe
Token: SeLoadDriverPrivilege	800	WMIC.exe
Token: SeSystemProfilePrivilege	800	WMIC.exe
Token: SeSystemtimePrivilege	800	WMIC.exe
Token: SeProfSingleProcessPrivilege	800	WMIC.exe
Token: SeIncBasePriorityPrivilege	800	WMIC.exe
Token: SeCreatePagefilePrivilege	800	WMIC.exe
Token: SeBackupPrivilege	800	WMIC.exe
Token: SeRestorePrivilege	800	WMIC.exe
Token: SeShutdownPrivilege	800	WMIC.exe
Token: SeDebugPrivilege	800	WMIC.exe
Token: SeSystemEnvironmentPrivilege	800	WMIC.exe
Token: SeRemoteShutdownPrivilege	800	WMIC.exe
Token: SeUndockPrivilege	800	WMIC.exe
Token: SeManageVolumePrivilege	800	WMIC.exe
Token: 33	800	WMIC.exe
Token: 34	800	WMIC.exe
Token: 35	800	WMIC.exe
Token: 36	800	WMIC.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

532 WINWORD.EXE
532 WINWORD.EXE
532 WINWORD.EXE
532 WINWORD.EXE
532 WINWORD.EXE
532 WINWORD.EXE
532 WINWORD.EXE
532 WINWORD.EXE

pid	process
532	WINWORD.EXE
532	WINWORD.EXE
532	WINWORD.EXE
532	WINWORD.EXE
532	WINWORD.EXE
532	WINWORD.EXE
532	WINWORD.EXE
532	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 532 wrote to memory of 440	532	WINWORD.EXE	notepad.exe
PID 532 wrote to memory of 440	532	WINWORD.EXE	notepad.exe
PID 532 wrote to memory of 800	532	WINWORD.EXE	WMIC.exe
PID 532 wrote to memory of 800	532	WINWORD.EXE	WMIC.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\46ef92741b21febd56c2545e500972f7ec4b8e7a87428164711c50d889564a93.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:532

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Roaming\after_seeing_how.txt
2⤵
- Process spawned unexpected child process
- Opens file in notepad (likely ransom note)
PID:440

C:\Windows\System32\wbem\WMIC.exe
"C:\Windows\System32\wbem\WMIC.exe"
2⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:800

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\after_seeing_how.txt
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/440-138-0x0000000000000000-mapping.dmp

Download
memory/532-130-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmp

Filesize
64KB

Download
memory/532-131-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmp

Filesize
64KB

Download
memory/532-132-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmp

Filesize
64KB

Download
memory/532-133-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmp

Filesize
64KB

Download
memory/532-134-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmp

Filesize
64KB

Download
memory/532-135-0x00007FFAA2CD0000-0x00007FFAA2CE0000-memory.dmp

Filesize
64KB

Download
memory/532-136-0x00007FFAA2CD0000-0x00007FFAA2CE0000-memory.dmp

Filesize
64KB

Download
memory/532-137-0x00000189C4D29000-0x00000189C4D2B000-memory.dmp

Filesize
8KB

Download
memory/800-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads