Malware Analysis Report

2024-11-13 16:28

Sample ID 220731-fnkk3aacek
Target af54403904ac8e687184e57ff1fddf97a7b9ce196895a7da5262b90d47da915c
SHA256 af54403904ac8e687184e57ff1fddf97a7b9ce196895a7da5262b90d47da915c
Tags
betabot backdoor botnet evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

af54403904ac8e687184e57ff1fddf97a7b9ce196895a7da5262b90d47da915c

Threat Level: Known bad

The file af54403904ac8e687184e57ff1fddf97a7b9ce196895a7da5262b90d47da915c was found to be: Known bad.

Malicious Activity Summary

betabot backdoor botnet evasion persistence trojan

BetaBot

Modifies firewall policy service

Sets file execution options in registry

Executes dropped EXE

Checks BIOS information in registry

Loads dropped DLL

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

NSIS installer

Office loads VBA resources, possible macro or embedded object present

Launches Equation Editor

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

NTFS ADS

Enumerates system info in registry

Modifies Internet Explorer Protected Mode

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Kills process with taskkill

Delays execution with timeout.exe

Modifies Internet Explorer Protected Mode Banner

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-31 05:01

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-31 05:01

Reported

2022-07-31 06:49

Platform

win7-20220718-en

Max time kernel

167s

Max time network

157s

Command Line

"C:\Windows\system32\Dwm.exe"

Signatures

BetaBot

trojan backdoor botnet betabot

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\17agumo13aocy.exe\DisableExceptionChainValidation C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "ijpevxxm.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\17agumo13aocy.exe C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.0 = "C:\\ProgramData\\Google Updater 2.0\\17agumo13aocy.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.0 = "\"C:\\ProgramData\\Google Updater 2.0\\17agumo13aocy.exe\"" C:\Windows\SysWOW64\explorer.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1648 set thread context of 1576 N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe C:\Users\Admin\AppData\Local\Temp\mondi.eXe

Enumerates physical storage devices

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Office loads VBA resources, possible macro or embedded object present

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\explorer.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\explorer.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Launches Equation Editor

exploit
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE N/A

Modifies Internet Explorer Protected Mode

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer Protected Mode Banner

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Temp\gondi.doc:Zone.Identifier C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Users\Admin\AppData\Local\Temp\hondi.cmd:Zone.Identifier C:\Windows\SysWOW64\cMd.exe N/A
File created C:\Users\Admin\AppData\Local\Temp\mondi.eXe:Zone.Identifier C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\mondi.eXe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 944 wrote to memory of 1404 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Windows\SysWOW64\cMd.exe
PID 944 wrote to memory of 1404 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Windows\SysWOW64\cMd.exe
PID 944 wrote to memory of 1404 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Windows\SysWOW64\cMd.exe
PID 944 wrote to memory of 1404 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Windows\SysWOW64\cMd.exe
PID 1404 wrote to memory of 820 N/A C:\Windows\SysWOW64\cMd.exe C:\Windows\SysWOW64\cmd.exe
PID 1404 wrote to memory of 820 N/A C:\Windows\SysWOW64\cMd.exe C:\Windows\SysWOW64\cmd.exe
PID 1404 wrote to memory of 820 N/A C:\Windows\SysWOW64\cMd.exe C:\Windows\SysWOW64\cmd.exe
PID 1404 wrote to memory of 820 N/A C:\Windows\SysWOW64\cMd.exe C:\Windows\SysWOW64\cmd.exe
PID 820 wrote to memory of 1636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 820 wrote to memory of 1636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 820 wrote to memory of 1636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 820 wrote to memory of 1636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 820 wrote to memory of 1648 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\mondi.exe
PID 820 wrote to memory of 1648 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\mondi.exe
PID 820 wrote to memory of 1648 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\mondi.exe
PID 820 wrote to memory of 1648 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\mondi.exe
PID 820 wrote to memory of 1064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 820 wrote to memory of 1064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 820 wrote to memory of 1064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 820 wrote to memory of 1064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1648 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe C:\Users\Admin\AppData\Local\Temp\mondi.eXe
PID 1648 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe C:\Users\Admin\AppData\Local\Temp\mondi.eXe
PID 1648 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe C:\Users\Admin\AppData\Local\Temp\mondi.eXe
PID 1648 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe C:\Users\Admin\AppData\Local\Temp\mondi.eXe
PID 1648 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe C:\Users\Admin\AppData\Local\Temp\mondi.eXe
PID 1648 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe C:\Users\Admin\AppData\Local\Temp\mondi.eXe
PID 1648 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe C:\Users\Admin\AppData\Local\Temp\mondi.eXe
PID 1648 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe C:\Users\Admin\AppData\Local\Temp\mondi.eXe
PID 1648 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe C:\Users\Admin\AppData\Local\Temp\mondi.eXe
PID 1648 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe C:\Users\Admin\AppData\Local\Temp\mondi.eXe
PID 1648 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\mondi.exe C:\Users\Admin\AppData\Local\Temp\mondi.eXe
PID 820 wrote to memory of 1204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 820 wrote to memory of 1204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 820 wrote to memory of 1204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 820 wrote to memory of 1204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 820 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 820 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 820 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 820 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1828 wrote to memory of 860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1828 wrote to memory of 860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1828 wrote to memory of 860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1828 wrote to memory of 860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 820 wrote to memory of 1564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 820 wrote to memory of 1564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 820 wrote to memory of 1564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 820 wrote to memory of 1564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 820 wrote to memory of 1308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 820 wrote to memory of 1308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 820 wrote to memory of 1308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 820 wrote to memory of 1308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1308 wrote to memory of 976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1308 wrote to memory of 976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1308 wrote to memory of 976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1308 wrote to memory of 976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 820 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 820 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 820 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 820 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 820 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 820 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 820 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 820 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1720 wrote to memory of 1388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\af54403904ac8e687184e57ff1fddf97a7b9ce196895a7da5262b90d47da915c.rtf"

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

C:\Windows\SysWOW64\cMd.exe

cMd /k %tEmP%\dqfm.cmd ? aaaa c

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1732263797-6638808458929582021652744417-173354088279944325-1244931433-753085934"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\hondi.cmD

C:\Windows\SysWOW64\timeout.exe

TIMEOUT 1

C:\Users\Admin\AppData\Local\Temp\mondi.exe

C:\Users\Admin\AppData\Local\Temp\mondi.eXe

C:\Windows\SysWOW64\taskkill.exe

TASkKILL /F /IM winword.exe

C:\Users\Admin\AppData\Local\Temp\mondi.eXe

C:\Users\Admin\AppData\Local\Temp\mondi.eXe

C:\Windows\SysWOW64\reg.exe

reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\Resiliency /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"

C:\Windows\SysWOW64\reg.exe

REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"

C:\Windows\SysWOW64\reg.exe

reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\Resiliency /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"

C:\Windows\SysWOW64\reg.exe

REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"

C:\Windows\SysWOW64\reg.exe

reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\13.0\Word\Resiliency /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\13.0\Word\File MRU" /v "Item 1"

C:\Windows\SysWOW64\reg.exe

REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\13.0\Word\File MRU" /v "Item 1"

C:\Windows\SysWOW64\reg.exe

reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\Resiliency /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"

C:\Windows\SysWOW64\reg.exe

REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"

C:\Windows\SysWOW64\reg.exe

reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\Resiliency /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"

C:\Windows\SysWOW64\reg.exe

REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"

C:\Windows\SysWOW64\reg.exe

reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"

C:\Windows\SysWOW64\reg.exe

REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 google.com udp
NL 142.250.179.142:80 google.com tcp
US 8.8.8.8:53 pan-qroup.com udp

Files

memory/880-54-0x0000000072401000-0x0000000072404000-memory.dmp

memory/880-55-0x000000006FE81000-0x000000006FE83000-memory.dmp

memory/880-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/880-57-0x0000000075831000-0x0000000075833000-memory.dmp

memory/880-58-0x0000000070E6D000-0x0000000070E78000-memory.dmp

memory/1404-60-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\dqfm.cmd

MD5 29324996d120283c617a7a142b5ba980
SHA1 43aa940b29713a6e75f30a6b614352c3bba24d6c
SHA256 2ab6f8f8b4f358a0f821de0710c3227dcbd1a3fa31172fda39ab44052a6cf021
SHA512 21c4d36887c72d01f9d2913c61e9d443169351a1c97b81a503712f0a224d50484100493dc971121ab71343b372440c0633fb062bb4930d1e6f53d455c9352b48

C:\Users\Admin\AppData\Local\Temp\hondi.cmd:Zone.Identifier

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/820-63-0x0000000000000000-mapping.dmp

memory/1636-64-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\mondi.eXe:Zone.Identifier

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\gondi.doc:Zone.Identifier

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\Users\Admin\AppData\Local\Temp\mondi.exe

MD5 b7cd27ba473567e1427a2ec3636eb6f4
SHA1 843a1f646dd66e959897d3bdd15bd5259a38ecb3
SHA256 dd1c349f15f51a9e2d77fcfaa223a1e34833903747884d74b0cbe1a8fdd88ea6
SHA512 62e8cc91ed63f8fca4dea3bf2d24a3aa41e68065d48f122c15677fdfb98dcd51a0524a6a7453348ac82531db80d057e5e78904827297618b2669f09009dc3332

C:\Users\Admin\AppData\Local\Temp\mondi.exe

MD5 b7cd27ba473567e1427a2ec3636eb6f4
SHA1 843a1f646dd66e959897d3bdd15bd5259a38ecb3
SHA256 dd1c349f15f51a9e2d77fcfaa223a1e34833903747884d74b0cbe1a8fdd88ea6
SHA512 62e8cc91ed63f8fca4dea3bf2d24a3aa41e68065d48f122c15677fdfb98dcd51a0524a6a7453348ac82531db80d057e5e78904827297618b2669f09009dc3332

memory/1648-68-0x0000000000000000-mapping.dmp

memory/1064-71-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\aisles.dll

MD5 2bca48f9681de2a01180e3e3a4170238
SHA1 e097d8f8c9c51c777e7e1f720624ca9a0961b821
SHA256 5f2d209fb93640bf6c81cbddaa00d1c2e120228e7fa34161ad2786e3f0f8b1cb
SHA512 5860b0d09cb0393efb8ea11d34de4a78a24adcb779c516ff7657cf44e5c54fbaeb343c9d005275d5915733ac149981cdc2af2f7d3f5db5d51cbd953cae073165

\Users\Admin\AppData\Local\Temp\nsjC380.tmp\System.dll

MD5 b0c77267f13b2f87c084fd86ef51ccfc
SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

\Users\Admin\AppData\Local\Temp\mondi.exe

MD5 b7cd27ba473567e1427a2ec3636eb6f4
SHA1 843a1f646dd66e959897d3bdd15bd5259a38ecb3
SHA256 dd1c349f15f51a9e2d77fcfaa223a1e34833903747884d74b0cbe1a8fdd88ea6
SHA512 62e8cc91ed63f8fca4dea3bf2d24a3aa41e68065d48f122c15677fdfb98dcd51a0524a6a7453348ac82531db80d057e5e78904827297618b2669f09009dc3332

memory/1576-76-0x0000000000400000-0x0000000000435000-memory.dmp

memory/1576-77-0x0000000000400000-0x0000000000435000-memory.dmp

memory/1576-75-0x0000000000400000-0x0000000000435000-memory.dmp

memory/1576-79-0x0000000000400000-0x0000000000435000-memory.dmp

memory/1576-80-0x0000000000400000-0x0000000000435000-memory.dmp

memory/1576-82-0x0000000000400000-0x0000000000435000-memory.dmp

memory/1576-81-0x0000000000400000-0x0000000000435000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mondi.exe

MD5 b7cd27ba473567e1427a2ec3636eb6f4
SHA1 843a1f646dd66e959897d3bdd15bd5259a38ecb3
SHA256 dd1c349f15f51a9e2d77fcfaa223a1e34833903747884d74b0cbe1a8fdd88ea6
SHA512 62e8cc91ed63f8fca4dea3bf2d24a3aa41e68065d48f122c15677fdfb98dcd51a0524a6a7453348ac82531db80d057e5e78904827297618b2669f09009dc3332

memory/1576-83-0x00000000004015C6-mapping.dmp

memory/1576-86-0x0000000000400000-0x0000000000435000-memory.dmp

memory/1576-87-0x0000000000400000-0x0000000000435000-memory.dmp

memory/1576-90-0x0000000000440000-0x00000000004A6000-memory.dmp

memory/1576-91-0x0000000000440000-0x00000000004A6000-memory.dmp

memory/880-93-0x0000000070E6D000-0x0000000070E78000-memory.dmp

memory/1204-94-0x0000000000000000-mapping.dmp

memory/1828-95-0x0000000000000000-mapping.dmp

memory/860-96-0x0000000000000000-mapping.dmp

memory/1564-97-0x0000000000000000-mapping.dmp

memory/1308-98-0x0000000000000000-mapping.dmp

memory/976-99-0x0000000000000000-mapping.dmp

memory/2012-100-0x0000000000000000-mapping.dmp

memory/1720-101-0x0000000000000000-mapping.dmp

memory/1388-102-0x0000000000000000-mapping.dmp

memory/1364-103-0x0000000000000000-mapping.dmp

memory/1560-104-0x0000000000000000-mapping.dmp

memory/1588-105-0x0000000000000000-mapping.dmp

memory/1148-106-0x0000000000000000-mapping.dmp

memory/1260-107-0x0000000000000000-mapping.dmp

memory/1944-108-0x0000000000000000-mapping.dmp

memory/1332-109-0x0000000000000000-mapping.dmp

memory/1940-110-0x0000000000000000-mapping.dmp

memory/944-111-0x0000000000000000-mapping.dmp

memory/1576-112-0x0000000000250000-0x000000000025D000-memory.dmp

memory/1576-113-0x0000000001FA0000-0x0000000001FAC000-memory.dmp

memory/1280-114-0x0000000000000000-mapping.dmp

memory/1280-116-0x0000000074961000-0x0000000074963000-memory.dmp

memory/1280-117-0x0000000077270000-0x00000000773F0000-memory.dmp

memory/1280-118-0x0000000000090000-0x000000000014C000-memory.dmp

memory/1280-119-0x0000000000410000-0x000000000041C000-memory.dmp

memory/1576-120-0x0000000000440000-0x00000000004A6000-memory.dmp

memory/1576-121-0x0000000000400000-0x0000000000435000-memory.dmp

memory/1280-122-0x0000000077270000-0x00000000773F0000-memory.dmp

memory/1280-123-0x0000000000090000-0x000000000014C000-memory.dmp

memory/1212-124-0x00000000029E0000-0x00000000029E6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-31 05:01

Reported

2022-07-31 06:48

Platform

win10v2004-20220721-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\af54403904ac8e687184e57ff1fddf97a7b9ce196895a7da5262b90d47da915c.rtf" /o ""

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\{07BF3217-C77A-48D8-8888-D5B46F7CD39E}\gondi.doc:Zone.Identifier C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\{07BF3217-C77A-48D8-8888-D5B46F7CD39E}\dqfm.cmd:Zone.Identifier C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\{07BF3217-C77A-48D8-8888-D5B46F7CD39E}\hondi.cmd:Zone.Identifier C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\{07BF3217-C77A-48D8-8888-D5B46F7CD39E}\mondi.exe:Zone.Identifier C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\af54403904ac8e687184e57ff1fddf97a7b9ce196895a7da5262b90d47da915c.rtf" /o ""

Network

Country Destination Domain Proto
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 20.189.173.11:443 tcp
US 8.8.8.8:53 96.108.152.52.in-addr.arpa udp
BE 8.238.110.126:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
BE 8.238.110.126:80 tcp

Files

memory/2396-130-0x00007FF9074D0000-0x00007FF9074E0000-memory.dmp

memory/2396-131-0x00007FF9074D0000-0x00007FF9074E0000-memory.dmp

memory/2396-132-0x00007FF9074D0000-0x00007FF9074E0000-memory.dmp

memory/2396-133-0x00007FF9074D0000-0x00007FF9074E0000-memory.dmp

memory/2396-134-0x00007FF9074D0000-0x00007FF9074E0000-memory.dmp

memory/2396-135-0x00007FF9050D0000-0x00007FF9050E0000-memory.dmp

memory/2396-136-0x00007FF9050D0000-0x00007FF9050E0000-memory.dmp