d020a1c7f108b06f6539c5f49d869d527758188736a36ae91b7659051acd4793

Analysis

max time kernel
109s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO_97309373_Karl_Meinz_Gen._Co.doc.exe
Size

791KB
MD5

ba51fb93aed8c9bb74990ab647dabd53
SHA1

d15c1724ea659527cfdeba0ec0c4a07a9cdba5a1
SHA256

214167e1feb613503ca6053634ac634f1f7acf688ba1b79534984e9c2cff2844
SHA512

352674fc850d821a71f7194caf8b74c80a8876deae008d98bb5f1884d0f5abfa16b0b8cf661378244e934961494823ca7290e1b5d4cf8bfd9248841a48399774
SSDEEP

24576:tt24wzbUct6DVLMmRzfDn3mes+W8lqLzaFmqj:JucJTJfbmesV6qLzaFmqj

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

umsmr.comumsmr.com

pid process

1868 umsmr.com
1984 umsmr.com

pid	process
1868	umsmr.com
1984	umsmr.com

Loads dropped DLL 5 IoCs

Processes:

PO_97309373_Karl_Meinz_Gen._Co.doc.exeumsmr.com

pid	process
1784	PO_97309373_Karl_Meinz_Gen._Co.doc.exe
1784	PO_97309373_Karl_Meinz_Gen._Co.doc.exe
1784	PO_97309373_Karl_Meinz_Gen._Co.doc.exe
1784	PO_97309373_Karl_Meinz_Gen._Co.doc.exe
1868	umsmr.com

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

umsmr.com

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	umsmr.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsRuntime = "C:\\Users\\Admin\\AppData\\Roaming\\nvmvk\\umsmr.com C:\\Users\\Admin\\AppData\\Roaming\\nvmvk\\ccsiv.hsw"	umsmr.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

umsmr.com

description pid process target process

PID 1984 set thread context of 1868 1984 umsmr.com RegSvcs.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1860 taskkill.exe

description	pid	process	target process
PID 1984 set thread context of 1868	1984	umsmr.com	RegSvcs.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
1860	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1536 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

umsmr.com

pid process

1984 umsmr.com
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 1860 taskkill.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1536 WINWORD.EXE
1536 WINWORD.EXE

pid	process
1536	WINWORD.EXE

pid	process
1984	umsmr.com

description	pid	process
Token: SeDebugPrivilege	1860	taskkill.exe

pid	process
1536	WINWORD.EXE
1536	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

PO_97309373_Karl_Meinz_Gen._Co.doc.exeumsmr.comWINWORD.EXEumsmr.com

description	pid	process	target process
PID 1784 wrote to memory of 1536	1784	PO_97309373_Karl_Meinz_Gen._Co.doc.exe	WINWORD.EXE
PID 1784 wrote to memory of 1536	1784	PO_97309373_Karl_Meinz_Gen._Co.doc.exe	WINWORD.EXE
PID 1784 wrote to memory of 1536	1784	PO_97309373_Karl_Meinz_Gen._Co.doc.exe	WINWORD.EXE
PID 1784 wrote to memory of 1536	1784	PO_97309373_Karl_Meinz_Gen._Co.doc.exe	WINWORD.EXE
PID 1784 wrote to memory of 1536	1784	PO_97309373_Karl_Meinz_Gen._Co.doc.exe	WINWORD.EXE
PID 1784 wrote to memory of 1536	1784	PO_97309373_Karl_Meinz_Gen._Co.doc.exe	WINWORD.EXE
PID 1784 wrote to memory of 1536	1784	PO_97309373_Karl_Meinz_Gen._Co.doc.exe	WINWORD.EXE
PID 1784 wrote to memory of 1868	1784	PO_97309373_Karl_Meinz_Gen._Co.doc.exe	umsmr.com
PID 1784 wrote to memory of 1868	1784	PO_97309373_Karl_Meinz_Gen._Co.doc.exe	umsmr.com
PID 1784 wrote to memory of 1868	1784	PO_97309373_Karl_Meinz_Gen._Co.doc.exe	umsmr.com
PID 1784 wrote to memory of 1868	1784	PO_97309373_Karl_Meinz_Gen._Co.doc.exe	umsmr.com
PID 1784 wrote to memory of 1868	1784	PO_97309373_Karl_Meinz_Gen._Co.doc.exe	umsmr.com
PID 1784 wrote to memory of 1868	1784	PO_97309373_Karl_Meinz_Gen._Co.doc.exe	umsmr.com
PID 1784 wrote to memory of 1868	1784	PO_97309373_Karl_Meinz_Gen._Co.doc.exe	umsmr.com
PID 1868 wrote to memory of 1984	1868	umsmr.com	umsmr.com
PID 1868 wrote to memory of 1984	1868	umsmr.com	umsmr.com
PID 1868 wrote to memory of 1984	1868	umsmr.com	umsmr.com
PID 1868 wrote to memory of 1984	1868	umsmr.com	umsmr.com
PID 1868 wrote to memory of 1984	1868	umsmr.com	umsmr.com
PID 1868 wrote to memory of 1984	1868	umsmr.com	umsmr.com
PID 1868 wrote to memory of 1984	1868	umsmr.com	umsmr.com
PID 1536 wrote to memory of 1492	1536	WINWORD.EXE	splwow64.exe
PID 1536 wrote to memory of 1492	1536	WINWORD.EXE	splwow64.exe
PID 1536 wrote to memory of 1492	1536	WINWORD.EXE	splwow64.exe
PID 1536 wrote to memory of 1492	1536	WINWORD.EXE	splwow64.exe
PID 1984 wrote to memory of 1924	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1924	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1924	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1924	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1924	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1924	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1924	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1120	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1120	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1120	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1120	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1120	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1120	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1120	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 2040	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 2040	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 2040	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 2040	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 2040	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 2040	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 2040	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 2008	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 2008	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 2008	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 2008	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 2008	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 2008	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 2008	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1208	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1208	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1208	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1208	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1208	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1208	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 1208	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 432	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 432	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 432	1984	umsmr.com	mshta.exe
PID 1984 wrote to memory of 432	1984	umsmr.com	mshta.exe

C:\Users\Admin\AppData\Local\Temp\PO_97309373_Karl_Meinz_Gen._Co.doc.exe
"C:\Users\Admin\AppData\Local\Temp\PO_97309373_Karl_Meinz_Gen._Co.doc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1784

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\nvmvk\Purchase order.doc"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:1492

C:\Users\Admin\AppData\Roaming\nvmvk\umsmr.com
"C:\Users\Admin\AppData\Roaming\nvmvk\umsmr.com" ccsiv.hsw
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1868

C:\Users\Admin\AppData\Roaming\nvmvk\umsmr.com
C:\Users\Admin\AppData\Roaming\nvmvk\umsmr.com C:\Users\Admin\AppData\Roaming\nvmvk\JKKRU
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe"
4⤵
PID:1924

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe"
4⤵
PID:1120

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe"
4⤵
PID:2040

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe"
4⤵
PID:2008

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe"
4⤵
PID:1208

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe"
4⤵
PID:432

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe"
4⤵
PID:1452

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C taskkill /f /IM mshta.exe
4⤵
PID:1616

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /IM mshta.exe
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
4⤵
PID:1868

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\nvmvk\JKKRU
Filesize
117KB

MD5
26b4a17150fd293003f10de5e27585b8

SHA1
59a4e7426526b0a18158b4163eed8e2d5a2561d6

SHA256
082b41f71cc5a5118e1f70f49e059763d48fc072e7fc28f8efb11076537461f3

SHA512
231ae48c34ae97d14b0205ee7dcf7c04cb37f222647a8e5c449d230a538c92be10d1783bb398b0e28e845de6b5eb4060ade962927f7aa92dca18edeb4cc6723f

Download Submit
C:\Users\Admin\AppData\Roaming\nvmvk\Purchase order.doc
Filesize
47KB

MD5
90e6379ae7b00aa812a1416222791530

SHA1
a5709b5e55bcdfe2c0dad1a9cc1e6a3696123023

SHA256
8b5779bce8aeaed0cadb20c814d79279ab91363bcfc1fbbd59ab888fdad12a39

SHA512
d4bd9a430ea0a36e20312c1326f672e6f46f7b209ee322459466a70079d140be3340250ce860d3124cd6522fca4eeb9aff055a704198371b7d171cc83f96db0d

Download Submit
C:\Users\Admin\AppData\Roaming\nvmvk\YMQGIX
Filesize
33KB

MD5
b7869e01ac4bf487efc16c4d7ea50cef

SHA1
f242def3b2400b0feead481fc4977eaa3a0edcb6

SHA256
d0400ed0c3590e325b056fbf6a1b718fbcc5c644db59bcab56bc490ae84a0fa5

SHA512
8b525ee668195047b14709dc8259c05f53fb6bc6e0c8092e8be44c2e029006bc15165ea15ce5bc5886d4520a99f32b53b10035d125fffa632311dee88c020c9b

Download Submit
C:\Users\Admin\AppData\Roaming\nvmvk\ccsiv.hsw
Filesize
115KB

MD5
f0b969dad556c428a35c962d73682ccf

SHA1
d7f3eff148925c54354c06324fbdc0ca2b363a09

SHA256
3bc5b85f3700606a8b5b3dfdb17f7774936258c3df4b8f8800eed18b14568c80

SHA512
6cb6c2ca2cb62e8ae1d614f65eb2b4f4c1a7426fed418a8c91dc246b8a08ed8c596ad6bcc4e0c3bc8ca075c09906f2c56ee2e5970a5595c39f9fdc90f6226f38

Download Submit
C:\Users\Admin\AppData\Roaming\nvmvk\nogsm.uxo
Filesize
117KB

MD5
c494b12717cf1b923cee39393db9d01e

SHA1
21e81e970c91801231d90a4f5cbfadd1429b7856

SHA256
2815cce3c1d7d3383ec24eb89878487f9c8e482216cf4fd508c338269fd20519

SHA512
55d058d212ee64e1971bd7912276973ae6703afca4c1c732f6e98a979b5f8b3c6cc354b30c5f0f4e4be0b71285123cd195f7cf6855abaab2f448a7cf352c9733

Download Submit
C:\Users\Admin\AppData\Roaming\nvmvk\uguhi
Filesize
68KB

MD5
b5f6ead0902f100c40ad5fd8ecfc7729

SHA1
a4b4b7b7018587f495b43f289beec0e5a08ec2eb

SHA256
70d7270b6b3dbd922ffcf6296b5c90a3276bebe902b7eca3b29aaa84a5397dd0

SHA512
1779c93c6a80270cab4a884ca4c2d5cd72461b0e5e774ee807a040d00deca9bb4c08de6da6eb6d6d422527ec62d6e450700021da309f72ceb656f23f449ce138

Download Submit
C:\Users\Admin\AppData\Roaming\nvmvk\umsmr.com
Filesize
732KB

MD5
6cf9a0d989715773d49d5ff3ad601db3

SHA1
ecd328e049e23c9a826505335c0e2b9f64e7ec5e

SHA256
0984d3bc6ce07e701241aa785fa057e8bba7eb2503a5bef726a06a8bd2d2f349

SHA512
6043c05fb23cda3c831db65e080eea4f0e680eab5cd47c13d32cee777e3e877e1223d2b71d713db37d9b6c9111407cbb615fcec5fc3d63d14e82cec10ae83343

Download Submit
C:\Users\Admin\AppData\Roaming\nvmvk\umsmr.com
Filesize
732KB

MD5
6cf9a0d989715773d49d5ff3ad601db3

SHA1
ecd328e049e23c9a826505335c0e2b9f64e7ec5e

SHA256
0984d3bc6ce07e701241aa785fa057e8bba7eb2503a5bef726a06a8bd2d2f349

SHA512
6043c05fb23cda3c831db65e080eea4f0e680eab5cd47c13d32cee777e3e877e1223d2b71d713db37d9b6c9111407cbb615fcec5fc3d63d14e82cec10ae83343

Download Submit
C:\Users\Admin\AppData\Roaming\nvmvk\umsmr.com
Filesize
732KB

MD5
6cf9a0d989715773d49d5ff3ad601db3

SHA1
ecd328e049e23c9a826505335c0e2b9f64e7ec5e

SHA256
0984d3bc6ce07e701241aa785fa057e8bba7eb2503a5bef726a06a8bd2d2f349

SHA512
6043c05fb23cda3c831db65e080eea4f0e680eab5cd47c13d32cee777e3e877e1223d2b71d713db37d9b6c9111407cbb615fcec5fc3d63d14e82cec10ae83343

Download Submit
\Users\Admin\AppData\Roaming\nvmvk\umsmr.com
Filesize
732KB

MD5
6cf9a0d989715773d49d5ff3ad601db3

SHA1
ecd328e049e23c9a826505335c0e2b9f64e7ec5e

SHA256
0984d3bc6ce07e701241aa785fa057e8bba7eb2503a5bef726a06a8bd2d2f349

SHA512
6043c05fb23cda3c831db65e080eea4f0e680eab5cd47c13d32cee777e3e877e1223d2b71d713db37d9b6c9111407cbb615fcec5fc3d63d14e82cec10ae83343

Download Submit
\Users\Admin\AppData\Roaming\nvmvk\umsmr.com
Filesize
732KB

MD5
6cf9a0d989715773d49d5ff3ad601db3

SHA1
ecd328e049e23c9a826505335c0e2b9f64e7ec5e

SHA256
0984d3bc6ce07e701241aa785fa057e8bba7eb2503a5bef726a06a8bd2d2f349

SHA512
6043c05fb23cda3c831db65e080eea4f0e680eab5cd47c13d32cee777e3e877e1223d2b71d713db37d9b6c9111407cbb615fcec5fc3d63d14e82cec10ae83343

Download Submit
\Users\Admin\AppData\Roaming\nvmvk\umsmr.com
Filesize
732KB

MD5
6cf9a0d989715773d49d5ff3ad601db3

SHA1
ecd328e049e23c9a826505335c0e2b9f64e7ec5e

SHA256
0984d3bc6ce07e701241aa785fa057e8bba7eb2503a5bef726a06a8bd2d2f349

SHA512
6043c05fb23cda3c831db65e080eea4f0e680eab5cd47c13d32cee777e3e877e1223d2b71d713db37d9b6c9111407cbb615fcec5fc3d63d14e82cec10ae83343

Download Submit
\Users\Admin\AppData\Roaming\nvmvk\umsmr.com
Filesize
732KB

MD5
6cf9a0d989715773d49d5ff3ad601db3

SHA1
ecd328e049e23c9a826505335c0e2b9f64e7ec5e

SHA256
0984d3bc6ce07e701241aa785fa057e8bba7eb2503a5bef726a06a8bd2d2f349

SHA512
6043c05fb23cda3c831db65e080eea4f0e680eab5cd47c13d32cee777e3e877e1223d2b71d713db37d9b6c9111407cbb615fcec5fc3d63d14e82cec10ae83343

Download Submit
\Users\Admin\AppData\Roaming\nvmvk\umsmr.com
Filesize
732KB

MD5
6cf9a0d989715773d49d5ff3ad601db3

SHA1
ecd328e049e23c9a826505335c0e2b9f64e7ec5e

SHA256
0984d3bc6ce07e701241aa785fa057e8bba7eb2503a5bef726a06a8bd2d2f349

SHA512
6043c05fb23cda3c831db65e080eea4f0e680eab5cd47c13d32cee777e3e877e1223d2b71d713db37d9b6c9111407cbb615fcec5fc3d63d14e82cec10ae83343

Download Submit
memory/432-91-0x0000000000000000-mapping.dmp

Download
memory/1120-83-0x0000000000000000-mapping.dmp

Download
memory/1208-89-0x0000000000000000-mapping.dmp

Download
memory/1452-93-0x0000000000000000-mapping.dmp

Download
memory/1492-79-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmp

Filesize
8KB

Download
memory/1492-78-0x0000000000000000-mapping.dmp

Download
memory/1536-75-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1536-64-0x0000000072FD1000-0x0000000072FD4000-memory.dmp

Filesize
12KB

Download
memory/1536-103-0x0000000071A3D000-0x0000000071A48000-memory.dmp

Filesize
44KB

Download
memory/1536-80-0x0000000071A3D000-0x0000000071A48000-memory.dmp

Filesize
44KB

Download
memory/1536-102-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1536-73-0x0000000070A51000-0x0000000070A53000-memory.dmp

Filesize
8KB

Download
memory/1536-55-0x0000000000000000-mapping.dmp

Download
memory/1536-76-0x0000000071A3D000-0x0000000071A48000-memory.dmp

Filesize
44KB

Download
memory/1616-95-0x0000000000000000-mapping.dmp

Download
memory/1784-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1860-97-0x0000000000000000-mapping.dmp

Download
memory/1868-61-0x0000000000000000-mapping.dmp

Download
memory/1868-101-0x0000000000401F8F-mapping.dmp

Download
memory/1924-81-0x0000000000000000-mapping.dmp

Download
memory/1984-70-0x0000000000000000-mapping.dmp

Download
memory/2008-87-0x0000000000000000-mapping.dmp

Download
memory/2040-85-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads