1c8510cc804544d09e584e45cc4983264bef6839988e7eb160f4d57873b5eb7d

General

Target

Information_29100132893.doc
Size

524KB
MD5

b8eb611067136ae5f8b758f016a18f60
SHA1

b731dc4669e547e78941f393f585fada97836a3d
SHA256

46ef92741b21febd56c2545e500972f7ec4b8e7a87428164711c50d889564a93
SHA512

c39773a745b633722a17da7c758721a21d69615c23376951a8eedd4ea3f5b9dc3b8936c431363c538d47491c29c79bb61a525f5beaf47ed64bca2ad137b8cc4a

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

notepad.exeWMIC.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	2672	916	notepad.exe	WINWORD.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	1656	916	WMIC.exe	WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

2672 notepad.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

916 WINWORD.EXE
916 WINWORD.EXE

pid	process
2672	notepad.exe

pid	process
916	WINWORD.EXE
916	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

WMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1656	WMIC.exe
Token: SeSecurityPrivilege	1656	WMIC.exe
Token: SeTakeOwnershipPrivilege	1656	WMIC.exe
Token: SeLoadDriverPrivilege	1656	WMIC.exe
Token: SeSystemProfilePrivilege	1656	WMIC.exe
Token: SeSystemtimePrivilege	1656	WMIC.exe
Token: SeProfSingleProcessPrivilege	1656	WMIC.exe
Token: SeIncBasePriorityPrivilege	1656	WMIC.exe
Token: SeCreatePagefilePrivilege	1656	WMIC.exe
Token: SeBackupPrivilege	1656	WMIC.exe
Token: SeRestorePrivilege	1656	WMIC.exe
Token: SeShutdownPrivilege	1656	WMIC.exe
Token: SeDebugPrivilege	1656	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1656	WMIC.exe
Token: SeRemoteShutdownPrivilege	1656	WMIC.exe
Token: SeUndockPrivilege	1656	WMIC.exe
Token: SeManageVolumePrivilege	1656	WMIC.exe
Token: 33	1656	WMIC.exe
Token: 34	1656	WMIC.exe
Token: 35	1656	WMIC.exe
Token: 36	1656	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1656	WMIC.exe
Token: SeSecurityPrivilege	1656	WMIC.exe
Token: SeTakeOwnershipPrivilege	1656	WMIC.exe
Token: SeLoadDriverPrivilege	1656	WMIC.exe
Token: SeSystemProfilePrivilege	1656	WMIC.exe
Token: SeSystemtimePrivilege	1656	WMIC.exe
Token: SeProfSingleProcessPrivilege	1656	WMIC.exe
Token: SeIncBasePriorityPrivilege	1656	WMIC.exe
Token: SeCreatePagefilePrivilege	1656	WMIC.exe
Token: SeBackupPrivilege	1656	WMIC.exe
Token: SeRestorePrivilege	1656	WMIC.exe
Token: SeShutdownPrivilege	1656	WMIC.exe
Token: SeDebugPrivilege	1656	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1656	WMIC.exe
Token: SeRemoteShutdownPrivilege	1656	WMIC.exe
Token: SeUndockPrivilege	1656	WMIC.exe
Token: SeManageVolumePrivilege	1656	WMIC.exe
Token: 33	1656	WMIC.exe
Token: 34	1656	WMIC.exe
Token: 35	1656	WMIC.exe
Token: 36	1656	WMIC.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

916 WINWORD.EXE
916 WINWORD.EXE
916 WINWORD.EXE
916 WINWORD.EXE
916 WINWORD.EXE
916 WINWORD.EXE
916 WINWORD.EXE
916 WINWORD.EXE

pid	process
916	WINWORD.EXE
916	WINWORD.EXE
916	WINWORD.EXE
916	WINWORD.EXE
916	WINWORD.EXE
916	WINWORD.EXE
916	WINWORD.EXE
916	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 916 wrote to memory of 2672	916	WINWORD.EXE	notepad.exe
PID 916 wrote to memory of 2672	916	WINWORD.EXE	notepad.exe
PID 916 wrote to memory of 1656	916	WINWORD.EXE	WMIC.exe
PID 916 wrote to memory of 1656	916	WINWORD.EXE	WMIC.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Information_29100132893.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Roaming\after_seeing_how.txt
2⤵
- Process spawned unexpected child process
- Opens file in notepad (likely ransom note)
PID:2672

C:\Windows\System32\wbem\WMIC.exe
"C:\Windows\System32\wbem\WMIC.exe"
2⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:1656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\after_seeing_how.txt
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\after_seeing_how.txt
Filesize
7KB

MD5
9a5d5b44d4be6b66d7206ba0c9077cf3

SHA1
7dd2c5227c9b304b5c4afff676ec3a167252549c

SHA256
8af6ed8f57b2296ca55bb5f3e40bc0de10260ca94e7c2f2c997778662c6110e2

SHA512
e3ae8ffc5556c2d5222f4a164f7fddd38d08f8496f2cb148248f51430ec23a94f4bd40334c07352ce50cbcf969132d41a1f8c14a4c6b0b432c60c2a3439f155b

Download Submit
memory/916-130-0x00007FF81D730000-0x00007FF81D740000-memory.dmp

Filesize
64KB

Download
memory/916-131-0x00007FF81D730000-0x00007FF81D740000-memory.dmp

Filesize
64KB

Download
memory/916-132-0x00007FF81D730000-0x00007FF81D740000-memory.dmp

Filesize
64KB

Download
memory/916-133-0x00007FF81D730000-0x00007FF81D740000-memory.dmp

Filesize
64KB

Download
memory/916-134-0x00007FF81D730000-0x00007FF81D740000-memory.dmp

Filesize
64KB

Download
memory/916-135-0x00007FF81B520000-0x00007FF81B530000-memory.dmp

Filesize
64KB

Download
memory/916-136-0x00007FF81B520000-0x00007FF81B530000-memory.dmp

Filesize
64KB

Download
memory/916-141-0x000001CACC3C0000-0x000001CACC3C2000-memory.dmp

Filesize
8KB

Download
memory/1656-139-0x0000000000000000-mapping.dmp

Download
memory/2672-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads