Analysis
-
max time kernel
100s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-06-2022 14:38
Static task
static1
Behavioral task
behavioral1
Sample
5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe
Resource
win7-20220414-en
General
-
Target
5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe
-
Size
218KB
-
MD5
eb6009f8d970345d2bda321bda243b06
-
SHA1
0d77001fd776db124b2e01abfef61720d3708763
-
SHA256
5f0798cdb628b90fa0507427cfad23ac606c781d630526e15c20e0150a9ece04
-
SHA512
01fac880e92ead6fe3127a680549b4ecae013a0bab95c086b4c1399cfc892deee16af6dddf2edd8d20f8b62891dfae3a909023b4940ef010e07fadcc7b2f4059
Malware Config
Extracted
pony
http://dinom.spb.ru/api/index.php
Signatures
-
CrypVault
Ransomware family which makes encrypted files look like they have been quarantined by AV.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1432 2036 cmd.exe 50 -
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 872 bcdedit.exe 1592 bcdedit.exe -
Executes dropped EXE 2 IoCs
pid Process 892 0150CEAF8E32.exe 1568 0150CEAF8E32.exe -
resource yara_rule behavioral1/memory/1568-72-0x0000000000400000-0x0000000000E28000-memory.dmp upx behavioral1/memory/1568-74-0x0000000000400000-0x0000000000E28000-memory.dmp upx behavioral1/memory/1568-75-0x0000000000400000-0x0000000000E28000-memory.dmp upx behavioral1/memory/1568-77-0x0000000000400000-0x0000000000E28000-memory.dmp upx behavioral1/memory/1568-78-0x0000000000400000-0x0000000000E28000-memory.dmp upx behavioral1/memory/1568-83-0x0000000000400000-0x0000000000E28000-memory.dmp upx behavioral1/memory/1568-84-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1568-85-0x0000000000400000-0x0000000000E28000-memory.dmp upx behavioral1/memory/1568-95-0x0000000000400000-0x000000000041A000-memory.dmp upx -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta 0150CEAF8E32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta 0150CEAF8E32.exe -
Loads dropped DLL 3 IoCs
pid Process 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 892 0150CEAF8E32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 0150CEAF8E32.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 0150CEAF8E32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 892 set thread context of 1568 892 0150CEAF8E32.exe 41 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1116 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 672 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 892 0150CEAF8E32.exe 1568 0150CEAF8E32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeImpersonatePrivilege 1568 0150CEAF8E32.exe Token: SeTcbPrivilege 1568 0150CEAF8E32.exe Token: SeChangeNotifyPrivilege 1568 0150CEAF8E32.exe Token: SeCreateTokenPrivilege 1568 0150CEAF8E32.exe Token: SeBackupPrivilege 1568 0150CEAF8E32.exe Token: SeRestorePrivilege 1568 0150CEAF8E32.exe Token: SeIncreaseQuotaPrivilege 1568 0150CEAF8E32.exe Token: SeAssignPrimaryTokenPrivilege 1568 0150CEAF8E32.exe Token: SeIncreaseQuotaPrivilege 1204 WMIC.exe Token: SeSecurityPrivilege 1204 WMIC.exe Token: SeTakeOwnershipPrivilege 1204 WMIC.exe Token: SeLoadDriverPrivilege 1204 WMIC.exe Token: SeSystemProfilePrivilege 1204 WMIC.exe Token: SeSystemtimePrivilege 1204 WMIC.exe Token: SeProfSingleProcessPrivilege 1204 WMIC.exe Token: SeIncBasePriorityPrivilege 1204 WMIC.exe Token: SeCreatePagefilePrivilege 1204 WMIC.exe Token: SeBackupPrivilege 1204 WMIC.exe Token: SeRestorePrivilege 1204 WMIC.exe Token: SeShutdownPrivilege 1204 WMIC.exe Token: SeDebugPrivilege 1204 WMIC.exe Token: SeSystemEnvironmentPrivilege 1204 WMIC.exe Token: SeRemoteShutdownPrivilege 1204 WMIC.exe Token: SeUndockPrivilege 1204 WMIC.exe Token: SeManageVolumePrivilege 1204 WMIC.exe Token: 33 1204 WMIC.exe Token: 34 1204 WMIC.exe Token: 35 1204 WMIC.exe Token: SeIncreaseQuotaPrivilege 1204 WMIC.exe Token: SeSecurityPrivilege 1204 WMIC.exe Token: SeTakeOwnershipPrivilege 1204 WMIC.exe Token: SeLoadDriverPrivilege 1204 WMIC.exe Token: SeSystemProfilePrivilege 1204 WMIC.exe Token: SeSystemtimePrivilege 1204 WMIC.exe Token: SeProfSingleProcessPrivilege 1204 WMIC.exe Token: SeIncBasePriorityPrivilege 1204 WMIC.exe Token: SeCreatePagefilePrivilege 1204 WMIC.exe Token: SeBackupPrivilege 1204 WMIC.exe Token: SeRestorePrivilege 1204 WMIC.exe Token: SeShutdownPrivilege 1204 WMIC.exe Token: SeDebugPrivilege 1204 WMIC.exe Token: SeSystemEnvironmentPrivilege 1204 WMIC.exe Token: SeRemoteShutdownPrivilege 1204 WMIC.exe Token: SeUndockPrivilege 1204 WMIC.exe Token: SeManageVolumePrivilege 1204 WMIC.exe Token: 33 1204 WMIC.exe Token: 34 1204 WMIC.exe Token: 35 1204 WMIC.exe Token: SeBackupPrivilege 588 vssvc.exe Token: SeRestorePrivilege 588 vssvc.exe Token: SeAuditPrivilege 588 vssvc.exe Token: SeImpersonatePrivilege 1568 0150CEAF8E32.exe Token: SeTcbPrivilege 1568 0150CEAF8E32.exe Token: SeChangeNotifyPrivilege 1568 0150CEAF8E32.exe Token: SeCreateTokenPrivilege 1568 0150CEAF8E32.exe Token: SeBackupPrivilege 1568 0150CEAF8E32.exe Token: SeRestorePrivilege 1568 0150CEAF8E32.exe Token: SeIncreaseQuotaPrivilege 1568 0150CEAF8E32.exe Token: SeAssignPrimaryTokenPrivilege 1568 0150CEAF8E32.exe Token: SeImpersonatePrivilege 1568 0150CEAF8E32.exe Token: SeTcbPrivilege 1568 0150CEAF8E32.exe Token: SeChangeNotifyPrivilege 1568 0150CEAF8E32.exe Token: SeCreateTokenPrivilege 1568 0150CEAF8E32.exe Token: SeBackupPrivilege 1568 0150CEAF8E32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 892 0150CEAF8E32.exe 892 0150CEAF8E32.exe 672 WINWORD.EXE 672 WINWORD.EXE 672 WINWORD.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1988 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 28 PID 1732 wrote to memory of 1988 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 28 PID 1732 wrote to memory of 1988 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 28 PID 1732 wrote to memory of 1988 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 28 PID 1732 wrote to memory of 1276 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 30 PID 1732 wrote to memory of 1276 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 30 PID 1732 wrote to memory of 1276 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 30 PID 1732 wrote to memory of 1276 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 30 PID 1732 wrote to memory of 888 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 32 PID 1732 wrote to memory of 888 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 32 PID 1732 wrote to memory of 888 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 32 PID 1732 wrote to memory of 888 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 32 PID 1732 wrote to memory of 1692 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 34 PID 1732 wrote to memory of 1692 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 34 PID 1732 wrote to memory of 1692 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 34 PID 1732 wrote to memory of 1692 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 34 PID 1732 wrote to memory of 892 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 36 PID 1732 wrote to memory of 892 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 36 PID 1732 wrote to memory of 892 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 36 PID 1732 wrote to memory of 892 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 36 PID 1732 wrote to memory of 1888 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 37 PID 1732 wrote to memory of 1888 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 37 PID 1732 wrote to memory of 1888 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 37 PID 1732 wrote to memory of 1888 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 37 PID 1732 wrote to memory of 1868 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 39 PID 1732 wrote to memory of 1868 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 39 PID 1732 wrote to memory of 1868 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 39 PID 1732 wrote to memory of 1868 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 39 PID 892 wrote to memory of 1568 892 0150CEAF8E32.exe 41 PID 892 wrote to memory of 1568 892 0150CEAF8E32.exe 41 PID 892 wrote to memory of 1568 892 0150CEAF8E32.exe 41 PID 892 wrote to memory of 1568 892 0150CEAF8E32.exe 41 PID 892 wrote to memory of 1568 892 0150CEAF8E32.exe 41 PID 892 wrote to memory of 1568 892 0150CEAF8E32.exe 41 PID 892 wrote to memory of 1568 892 0150CEAF8E32.exe 41 PID 892 wrote to memory of 1568 892 0150CEAF8E32.exe 41 PID 892 wrote to memory of 1568 892 0150CEAF8E32.exe 41 PID 892 wrote to memory of 1568 892 0150CEAF8E32.exe 41 PID 892 wrote to memory of 1568 892 0150CEAF8E32.exe 41 PID 1732 wrote to memory of 672 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 42 PID 1732 wrote to memory of 672 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 42 PID 1732 wrote to memory of 672 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 42 PID 1732 wrote to memory of 672 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 42 PID 1732 wrote to memory of 1644 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 44 PID 1732 wrote to memory of 1644 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 44 PID 1732 wrote to memory of 1644 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 44 PID 1732 wrote to memory of 1644 1732 5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe 44 PID 1568 wrote to memory of 1940 1568 0150CEAF8E32.exe 45 PID 1568 wrote to memory of 1940 1568 0150CEAF8E32.exe 45 PID 1568 wrote to memory of 1940 1568 0150CEAF8E32.exe 45 PID 1568 wrote to memory of 1940 1568 0150CEAF8E32.exe 45 PID 1568 wrote to memory of 1204 1568 0150CEAF8E32.exe 47 PID 1568 wrote to memory of 1204 1568 0150CEAF8E32.exe 47 PID 1568 wrote to memory of 1204 1568 0150CEAF8E32.exe 47 PID 1568 wrote to memory of 1204 1568 0150CEAF8E32.exe 47 PID 1432 wrote to memory of 1116 1432 cmd.exe 53 PID 1432 wrote to memory of 1116 1432 cmd.exe 53 PID 1432 wrote to memory of 1116 1432 cmd.exe 53 PID 1432 wrote to memory of 872 1432 cmd.exe 56 PID 1432 wrote to memory of 872 1432 cmd.exe 56 PID 1432 wrote to memory of 872 1432 cmd.exe 56 PID 1432 wrote to memory of 1592 1432 cmd.exe 57 PID 1432 wrote to memory of 1592 1432 cmd.exe 57 PID 1432 wrote to memory of 1592 1432 cmd.exe 57 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 0150CEAF8E32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe"C:\Users\Admin\AppData\Local\Temp\5F0798CDB628B90FA0507427CFAD23AC606C781D63052.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 0150CEAF8E322⤵PID:1988
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 3319E073582⤵PID:1276
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\0150CEAF8E32" 0150CEAF8E32.exe2⤵PID:888
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 0150CEAF8E322⤵PID:1692
-
-
C:\Users\Admin\AppData\Local\Temp\0150CEAF8E32.exe"C:\Users\Admin\AppData\Local\Temp\0150CEAF8E32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\0150CEAF8E32.exeC:\Users\Admin\AppData\Local\Temp\0150CEAF8E32.exe3⤵
- Executes dropped EXE
- Drops startup file
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:1568 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\VAULT.hta"4⤵
- Modifies Internet Explorer settings
PID:1940
-
-
C:\Windows\SysWOW64\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" process call create "cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1204
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\3319E07358" 3319E07358.doc2⤵PID:1888
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 0150CEAF8E322⤵PID:1868
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\3319E07358.doc"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:672 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1948
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 0150CEAF8E323319E073582⤵PID:1644
-
-
C:\Windows\system32\cmd.execmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1116
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no2⤵
- Modifies boot configuration data using bcdedit
PID:872
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:1592
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:588
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
MD5d1f6d486c4afb6aca38ee45ed8ae4e3c
SHA13343a6203db587c257252d5b493ea16d5ac93e13
SHA256d7430680c994bc488209aa05c2e72de9ffe5d858111404a2ffb7715bae4f0758
SHA512634e77f6dc9ff159742cabb90d9c3ce62c5f392b96f2cb01b93d86989369e374e9a473327ece255fc784348e9c3ac710a9e18192b686fc3b264793470d36208d
-
Filesize
148KB
MD5d1f6d486c4afb6aca38ee45ed8ae4e3c
SHA13343a6203db587c257252d5b493ea16d5ac93e13
SHA256d7430680c994bc488209aa05c2e72de9ffe5d858111404a2ffb7715bae4f0758
SHA512634e77f6dc9ff159742cabb90d9c3ce62c5f392b96f2cb01b93d86989369e374e9a473327ece255fc784348e9c3ac710a9e18192b686fc3b264793470d36208d
-
Filesize
148KB
MD5d1f6d486c4afb6aca38ee45ed8ae4e3c
SHA13343a6203db587c257252d5b493ea16d5ac93e13
SHA256d7430680c994bc488209aa05c2e72de9ffe5d858111404a2ffb7715bae4f0758
SHA512634e77f6dc9ff159742cabb90d9c3ce62c5f392b96f2cb01b93d86989369e374e9a473327ece255fc784348e9c3ac710a9e18192b686fc3b264793470d36208d
-
Filesize
23KB
MD53d495e763086f50096365b14d0037cb0
SHA1bf29341e57e15abf6d3433ebbaf7c3ecda33fa71
SHA256bfe141ce37886121d25e706cc9217d8311e104016162eb23509d178f43fc2a46
SHA512e896016bfbd30fa00ed3ea89062c51a6d490d54c543930d3b655c3270a5240a64c50ad0a42649f8e1621a429d6274f7c9e88aa168ba0178722acb669352da267
-
Filesize
4KB
MD5b71751d104ed8f256ae64a7d02821be0
SHA1bc3e6ac19bf1431a5872597684b2982b8ba07d87
SHA2566a37244fbabb6238f178c7b769b3d0f15c93d70fece941b416c8e71140538004
SHA512b3bee8dd51f874f5677dbb37989077776d0169d97760395d38ab52ac422ce3a9db78df3970a6c1ac6e18538d8e014fc72f3481964976a5f26b2c7e63efe0ffdf
-
Filesize
148KB
MD5d1f6d486c4afb6aca38ee45ed8ae4e3c
SHA13343a6203db587c257252d5b493ea16d5ac93e13
SHA256d7430680c994bc488209aa05c2e72de9ffe5d858111404a2ffb7715bae4f0758
SHA512634e77f6dc9ff159742cabb90d9c3ce62c5f392b96f2cb01b93d86989369e374e9a473327ece255fc784348e9c3ac710a9e18192b686fc3b264793470d36208d
-
Filesize
148KB
MD5d1f6d486c4afb6aca38ee45ed8ae4e3c
SHA13343a6203db587c257252d5b493ea16d5ac93e13
SHA256d7430680c994bc488209aa05c2e72de9ffe5d858111404a2ffb7715bae4f0758
SHA512634e77f6dc9ff159742cabb90d9c3ce62c5f392b96f2cb01b93d86989369e374e9a473327ece255fc784348e9c3ac710a9e18192b686fc3b264793470d36208d
-
Filesize
148KB
MD5d1f6d486c4afb6aca38ee45ed8ae4e3c
SHA13343a6203db587c257252d5b493ea16d5ac93e13
SHA256d7430680c994bc488209aa05c2e72de9ffe5d858111404a2ffb7715bae4f0758
SHA512634e77f6dc9ff159742cabb90d9c3ce62c5f392b96f2cb01b93d86989369e374e9a473327ece255fc784348e9c3ac710a9e18192b686fc3b264793470d36208d