Analysis
-
max time kernel
140s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 09:49
Static task
static1
Behavioral task
behavioral1
Sample
72b07835503273dc7f135f14dfe3a5ae6eae19675f19f2e3147a89123018464b.rtf
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
72b07835503273dc7f135f14dfe3a5ae6eae19675f19f2e3147a89123018464b.rtf
Resource
win10v2004-20220721-en
General
-
Target
72b07835503273dc7f135f14dfe3a5ae6eae19675f19f2e3147a89123018464b.rtf
-
Size
2.7MB
-
MD5
5d455092970ee2f4a00ac451ca4d4903
-
SHA1
3912ec755f8a40400ffb684991d2f75cb104cec6
-
SHA256
72b07835503273dc7f135f14dfe3a5ae6eae19675f19f2e3147a89123018464b
-
SHA512
0f0b442d9e51df7573b847418be5aea84b940b9d45010c3c23821ff7b8daec1408e9da2d1f4caca868f5aa76bb9448ecedd339c7892f8db3f9554a3a01fc7b23
Malware Config
Signatures
-
NirSoft MailPassView 7 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1452-94-0x0000000002570000-0x0000000002606000-memory.dmp MailPassView behavioral1/memory/1452-97-0x0000000076F90000-0x0000000077110000-memory.dmp MailPassView behavioral1/memory/1772-106-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1772-107-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/1772-110-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1772-112-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1772-122-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 7 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1452-94-0x0000000002570000-0x0000000002606000-memory.dmp WebBrowserPassView behavioral1/memory/1452-97-0x0000000076F90000-0x0000000077110000-memory.dmp WebBrowserPassView behavioral1/memory/1744-113-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1744-114-0x0000000000442628-mapping.dmp WebBrowserPassView behavioral1/memory/1744-117-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1744-118-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1744-119-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 12 IoCs
Processes:
resource yara_rule behavioral1/memory/1452-94-0x0000000002570000-0x0000000002606000-memory.dmp Nirsoft behavioral1/memory/1452-97-0x0000000076F90000-0x0000000077110000-memory.dmp Nirsoft behavioral1/memory/1772-106-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1772-107-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/1772-110-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1772-112-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1744-113-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1744-114-0x0000000000442628-mapping.dmp Nirsoft behavioral1/memory/1744-117-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1744-118-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1744-119-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1772-122-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
A.XA.Xpid process 804 A.X 1452 A.X -
Loads dropped DLL 3 IoCs
Processes:
cmd.exeA.Xpid process 320 cmd.exe 320 cmd.exe 804 A.X -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
A.Xdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" A.X -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
Drops file in System32 directory 2 IoCs
Processes:
A.Xdescription ioc process File opened for modification C:\Windows\SysWOW64\26 A.X File opened for modification C:\Windows\SysWOW64\28 A.X -
Suspicious use of SetThreadContext 3 IoCs
Processes:
A.XA.Xdescription pid process target process PID 804 set thread context of 1452 804 A.X A.X PID 1452 set thread context of 1772 1452 A.X vbc.exe PID 1452 set thread context of 1744 1452 A.X vbc.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
EXCEL.EXEexcelcnv.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor excelcnv.exe -
Launches Equation Editor 1 TTPs 2 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
Processes:
EQNEDT32.EXEEQNEDT32.EXEpid process 1760 EQNEDT32.EXE 1520 EQNEDT32.EXE -
Processes:
EXCEL.EXEWINWORD.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1340 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
A.Xpid process 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X 1452 A.X -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
A.Xdescription pid process Token: SeDebugPrivilege 1452 A.X -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
WINWORD.EXEpid process 1340 WINWORD.EXE 1340 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
WINWORD.EXEEXCEL.EXEA.Xpid process 1340 WINWORD.EXE 1340 WINWORD.EXE 1704 EXCEL.EXE 804 A.X -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
A.Xpid process 1452 A.X -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
EQNEDT32.EXEcmd.exeA.XWINWORD.EXEA.Xdescription pid process target process PID 1760 wrote to memory of 320 1760 EQNEDT32.EXE cmd.exe PID 1760 wrote to memory of 320 1760 EQNEDT32.EXE cmd.exe PID 1760 wrote to memory of 320 1760 EQNEDT32.EXE cmd.exe PID 1760 wrote to memory of 320 1760 EQNEDT32.EXE cmd.exe PID 320 wrote to memory of 804 320 cmd.exe A.X PID 320 wrote to memory of 804 320 cmd.exe A.X PID 320 wrote to memory of 804 320 cmd.exe A.X PID 320 wrote to memory of 804 320 cmd.exe A.X PID 804 wrote to memory of 1452 804 A.X A.X PID 804 wrote to memory of 1452 804 A.X A.X PID 804 wrote to memory of 1452 804 A.X A.X PID 804 wrote to memory of 1452 804 A.X A.X PID 1340 wrote to memory of 996 1340 WINWORD.EXE splwow64.exe PID 1340 wrote to memory of 996 1340 WINWORD.EXE splwow64.exe PID 1340 wrote to memory of 996 1340 WINWORD.EXE splwow64.exe PID 1340 wrote to memory of 996 1340 WINWORD.EXE splwow64.exe PID 1452 wrote to memory of 1772 1452 A.X vbc.exe PID 1452 wrote to memory of 1772 1452 A.X vbc.exe PID 1452 wrote to memory of 1772 1452 A.X vbc.exe PID 1452 wrote to memory of 1772 1452 A.X vbc.exe PID 1452 wrote to memory of 1772 1452 A.X vbc.exe PID 1452 wrote to memory of 1772 1452 A.X vbc.exe PID 1452 wrote to memory of 1772 1452 A.X vbc.exe PID 1452 wrote to memory of 1772 1452 A.X vbc.exe PID 1452 wrote to memory of 1772 1452 A.X vbc.exe PID 1452 wrote to memory of 1772 1452 A.X vbc.exe PID 1452 wrote to memory of 1744 1452 A.X vbc.exe PID 1452 wrote to memory of 1744 1452 A.X vbc.exe PID 1452 wrote to memory of 1744 1452 A.X vbc.exe PID 1452 wrote to memory of 1744 1452 A.X vbc.exe PID 1452 wrote to memory of 1744 1452 A.X vbc.exe PID 1452 wrote to memory of 1744 1452 A.X vbc.exe PID 1452 wrote to memory of 1744 1452 A.X vbc.exe PID 1452 wrote to memory of 1744 1452 A.X vbc.exe PID 1452 wrote to memory of 1744 1452 A.X vbc.exe PID 1452 wrote to memory of 1744 1452 A.X vbc.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\72b07835503273dc7f135f14dfe3a5ae6eae19675f19f2e3147a89123018464b.rtf"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" -Embedding1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c %tmp%\A.X2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\A.XC:\Users\Admin\AppData\Local\Temp\A.X3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\A.X:\Users\Admin\AppData\Local\Temp\A.X4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"5⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Launches Equation Editor
-
C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe"C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe" -Embedding1⤵
- Enumerates system info in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\A.XFilesize
1.2MB
MD5dde134749372009281daa4070762871b
SHA11f436857eafa4c42ddcf7024b247d92904ee67b0
SHA256c970b71df8bc07dbd08e4ee90bc3d6a33ca94a0895bd3a6038567c7cac1c4420
SHA5126837f4ad795a880531b2f0b7f3d080772883f75c9767fa7a7c98799e5453c48e4c26a5b71521bfb69868ffa8d9133c6fec3818b68d1fde1f795af72d3eb18812
-
C:\Users\Admin\AppData\Local\Temp\A.XFilesize
1.2MB
MD5dde134749372009281daa4070762871b
SHA11f436857eafa4c42ddcf7024b247d92904ee67b0
SHA256c970b71df8bc07dbd08e4ee90bc3d6a33ca94a0895bd3a6038567c7cac1c4420
SHA5126837f4ad795a880531b2f0b7f3d080772883f75c9767fa7a7c98799e5453c48e4c26a5b71521bfb69868ffa8d9133c6fec3818b68d1fde1f795af72d3eb18812
-
C:\Users\Admin\AppData\Local\Temp\A.XFilesize
1.2MB
MD5dde134749372009281daa4070762871b
SHA11f436857eafa4c42ddcf7024b247d92904ee67b0
SHA256c970b71df8bc07dbd08e4ee90bc3d6a33ca94a0895bd3a6038567c7cac1c4420
SHA5126837f4ad795a880531b2f0b7f3d080772883f75c9767fa7a7c98799e5453c48e4c26a5b71521bfb69868ffa8d9133c6fec3818b68d1fde1f795af72d3eb18812
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
\Users\Admin\AppData\Local\Temp\A.XFilesize
1.2MB
MD5dde134749372009281daa4070762871b
SHA11f436857eafa4c42ddcf7024b247d92904ee67b0
SHA256c970b71df8bc07dbd08e4ee90bc3d6a33ca94a0895bd3a6038567c7cac1c4420
SHA5126837f4ad795a880531b2f0b7f3d080772883f75c9767fa7a7c98799e5453c48e4c26a5b71521bfb69868ffa8d9133c6fec3818b68d1fde1f795af72d3eb18812
-
\Users\Admin\AppData\Local\Temp\A.XFilesize
1.2MB
MD5dde134749372009281daa4070762871b
SHA11f436857eafa4c42ddcf7024b247d92904ee67b0
SHA256c970b71df8bc07dbd08e4ee90bc3d6a33ca94a0895bd3a6038567c7cac1c4420
SHA5126837f4ad795a880531b2f0b7f3d080772883f75c9767fa7a7c98799e5453c48e4c26a5b71521bfb69868ffa8d9133c6fec3818b68d1fde1f795af72d3eb18812
-
\Users\Admin\AppData\Local\Temp\A.XFilesize
1.2MB
MD5dde134749372009281daa4070762871b
SHA11f436857eafa4c42ddcf7024b247d92904ee67b0
SHA256c970b71df8bc07dbd08e4ee90bc3d6a33ca94a0895bd3a6038567c7cac1c4420
SHA5126837f4ad795a880531b2f0b7f3d080772883f75c9767fa7a7c98799e5453c48e4c26a5b71521bfb69868ffa8d9133c6fec3818b68d1fde1f795af72d3eb18812
-
memory/320-65-0x0000000000000000-mapping.dmp
-
memory/804-71-0x0000000000000000-mapping.dmp
-
memory/804-82-0x00000000003F0000-0x00000000003F6000-memory.dmpFilesize
24KB
-
memory/804-98-0x0000000076F90000-0x0000000077110000-memory.dmpFilesize
1.5MB
-
memory/996-101-0x000007FEFB631000-0x000007FEFB633000-memory.dmpFilesize
8KB
-
memory/996-99-0x0000000000000000-mapping.dmp
-
memory/1340-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1340-55-0x000000006FC51000-0x000000006FC53000-memory.dmpFilesize
8KB
-
memory/1340-58-0x0000000070C3D000-0x0000000070C48000-memory.dmpFilesize
44KB
-
memory/1340-80-0x000000006AF81000-0x000000006AF83000-memory.dmpFilesize
8KB
-
memory/1340-81-0x0000000070C3D000-0x0000000070C48000-memory.dmpFilesize
44KB
-
memory/1340-105-0x0000000070C3D000-0x0000000070C48000-memory.dmpFilesize
44KB
-
memory/1340-57-0x00000000750B1000-0x00000000750B3000-memory.dmpFilesize
8KB
-
memory/1340-54-0x00000000721D1000-0x00000000721D4000-memory.dmpFilesize
12KB
-
memory/1452-91-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1452-111-0x0000000006885000-0x0000000006896000-memory.dmpFilesize
68KB
-
memory/1452-94-0x0000000002570000-0x0000000002606000-memory.dmpFilesize
600KB
-
memory/1452-97-0x0000000076F90000-0x0000000077110000-memory.dmpFilesize
1.5MB
-
memory/1452-121-0x0000000006885000-0x0000000006896000-memory.dmpFilesize
68KB
-
memory/1452-100-0x0000000069AC0000-0x000000006A06B000-memory.dmpFilesize
5.7MB
-
memory/1452-102-0x0000000076F90000-0x0000000077110000-memory.dmpFilesize
1.5MB
-
memory/1452-103-0x0000000069AC0000-0x000000006A06B000-memory.dmpFilesize
5.7MB
-
memory/1452-86-0x000000000048DBD6-mapping.dmp
-
memory/1704-73-0x0000000070C3D000-0x0000000070C48000-memory.dmpFilesize
44KB
-
memory/1704-67-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1704-62-0x0000000070C3D000-0x0000000070C48000-memory.dmpFilesize
44KB
-
memory/1704-59-0x000000002F701000-0x000000002F704000-memory.dmpFilesize
12KB
-
memory/1744-113-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1744-114-0x0000000000442628-mapping.dmp
-
memory/1744-117-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1744-118-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1744-119-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1756-77-0x000000002F651000-0x000000002F654000-memory.dmpFilesize
12KB
-
memory/1772-112-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1772-110-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1772-107-0x0000000000411654-mapping.dmp
-
memory/1772-106-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1772-122-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB