67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe

General

Target

67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Size

2.9MB
MD5

e36a62485f7d61b995954438236396a2
SHA1

40f309fb51d84a1b51be2beaf911304764fa15fe
SHA256

67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe
SHA512

7b84d876158522c179d3cea932b85bd145c15f16d6f82122840834bbd5711ce27cf6b007f560e015f4dcaf543ceb720cace38e2c73f94db9a67203cfe76c36e0
SSDEEP

49152:qe3aXOYXgMWa1oXoPqfrufcx/nU9luOeSwGEIvo3UU2gaTC7aaHq5CFkacYuokCg:Ey5a+Xxzx/nUDgk0UU2gBXqoTUokOlSh

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe = "11000"	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\International\CpMRU	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.12\shell\open	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.12\shell\open	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.doc	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ywsfile	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\shell\open\command	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.8\shell\open	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.8\shell\Open\yyddeexec	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.8\shell\Open\yyddeexec\	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.8\shell\open\command	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.12\shell\Open\yyddeexec	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.12\shell\Open\ddeexec	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\BrowserFlags = "2147483684"	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.12\EditFlags = "65536"	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.DocumentMacroEnabled.12	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.DocumentMacroEnabled.12\BrowserFlags = "2147483684"	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\shell\open	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.12\shell\open\command	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.8\shell\Open\ddeexec	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.docx	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.12\BrowserFlags = "2147483684"	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.12\shell\Open\yyddeexec\	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.12\shell\open\command	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\EditFlags = "65536"	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.12	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4748	WINWORD.EXE
4748	WINWORD.EXE

Suspicious behavior: SetClipboardViewer 12 IoCs

pid	Process
1796	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
1796	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
1796	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
1796	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
1796	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
1796	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
1796	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
1796	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
1796	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
1796	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
1796	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
1796	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1796	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Token: SeIncBasePriorityPrivilege	1796	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Token: 33	1796	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
Token: SeIncBasePriorityPrivilege	1796	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1796	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
1796	67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
4748	WINWORD.EXE
4748	WINWORD.EXE
4748	WINWORD.EXE

C:\Users\Admin\AppData\Local\Temp\67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe
"C:\Users\Admin\AppData\Local\Temp\67b3d7cfa8ca7a29086adc84a60204df334cd27a61da97117a378d4aff2c5fbe.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: SetClipboardViewer
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1796

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4748-132-0x00007FFA45370000-0x00007FFA45380000-memory.dmp

Filesize
64KB

Download
memory/4748-133-0x00007FFA45370000-0x00007FFA45380000-memory.dmp

Filesize
64KB

Download
memory/4748-134-0x00007FFA45370000-0x00007FFA45380000-memory.dmp

Filesize
64KB

Download
memory/4748-135-0x00007FFA45370000-0x00007FFA45380000-memory.dmp

Filesize
64KB

Download
memory/4748-136-0x00007FFA45370000-0x00007FFA45380000-memory.dmp

Filesize
64KB

Download
memory/4748-137-0x00007FFA42FA0000-0x00007FFA42FB0000-memory.dmp

Filesize
64KB

Download
memory/4748-138-0x00007FFA42FA0000-0x00007FFA42FB0000-memory.dmp

Filesize
64KB

Download
memory/4748-141-0x00007FFA45370000-0x00007FFA45380000-memory.dmp

Filesize
64KB

Download
memory/4748-140-0x00007FFA45370000-0x00007FFA45380000-memory.dmp

Filesize
64KB

Download
memory/4748-142-0x00007FFA45370000-0x00007FFA45380000-memory.dmp

Filesize
64KB

Download
memory/4748-143-0x00007FFA45370000-0x00007FFA45380000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads