Analysis
-
max time kernel
140s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 21:40
Behavioral task
behavioral1
Sample
78d84f8368b44692b74500f6071788170bc2fef27363586b6d569d745d1cf2a2.doc
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
78d84f8368b44692b74500f6071788170bc2fef27363586b6d569d745d1cf2a2.doc
Resource
win10v2004-20220901-en
General
-
Target
78d84f8368b44692b74500f6071788170bc2fef27363586b6d569d745d1cf2a2.doc
-
Size
67KB
-
MD5
c075bcd452d7ff56968ed7a213459bdc
-
SHA1
dc54cdce93f54e1f4089000edfdc4e08428395dd
-
SHA256
78d84f8368b44692b74500f6071788170bc2fef27363586b6d569d745d1cf2a2
-
SHA512
ce7802282e7f000fdd07be60e6442b1099db12a48fd62d6968546a9f0fe7295c56ee047217f944cbb3850e549d5cc9be2d593208897a0c440c927255aae58fc0
-
SSDEEP
768:EPYyLPOo7UDgHdHTtQxzs9yKrGlj0+UKkj0ieAfYRpmeZtp:Eeuhtgs9Xkie8Y3H
Malware Config
Extracted
http://gmedsport.com/plugins/xmlrpc/file.exe
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 1724 1584 cmd.exe WINWORD.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4DF2D1B7-A492-4FE1-85C4-17DBC2A0F764}\2.0\FLAGS WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4DF2D1B7-A492-4FE1-85C4-17DBC2A0F764} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\TypeLib\{4DF2D1B7-A492-4FE1-85C4-17DBC2A0F764}\2.0\HELPDIR WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4DF2D1B7-A492-4FE1-85C4-17DBC2A0F764}\2.0 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01} WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4DF2D1B7-A492-4FE1-85C4-17DBC2A0F764}\2.0\HELPDIR WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\TypeLib\{4DF2D1B7-A492-4FE1-85C4-17DBC2A0F764}\2.0\0\win32 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\ = "MdcListEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip" WINWORD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1584 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 376 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 376 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1584 WINWORD.EXE 1584 WINWORD.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
WINWORD.EXEcmd.execscript.exepowershell.exedescription pid process target process PID 1584 wrote to memory of 1724 1584 WINWORD.EXE cmd.exe PID 1584 wrote to memory of 1724 1584 WINWORD.EXE cmd.exe PID 1584 wrote to memory of 1724 1584 WINWORD.EXE cmd.exe PID 1584 wrote to memory of 1724 1584 WINWORD.EXE cmd.exe PID 1584 wrote to memory of 1724 1584 WINWORD.EXE cmd.exe PID 1584 wrote to memory of 1724 1584 WINWORD.EXE cmd.exe PID 1584 wrote to memory of 1724 1584 WINWORD.EXE cmd.exe PID 1724 wrote to memory of 976 1724 cmd.exe PING.EXE PID 1724 wrote to memory of 976 1724 cmd.exe PING.EXE PID 1724 wrote to memory of 976 1724 cmd.exe PING.EXE PID 1724 wrote to memory of 976 1724 cmd.exe PING.EXE PID 1584 wrote to memory of 2032 1584 WINWORD.EXE splwow64.exe PID 1584 wrote to memory of 2032 1584 WINWORD.EXE splwow64.exe PID 1584 wrote to memory of 2032 1584 WINWORD.EXE splwow64.exe PID 1584 wrote to memory of 2032 1584 WINWORD.EXE splwow64.exe PID 1724 wrote to memory of 1564 1724 cmd.exe chcp.com PID 1724 wrote to memory of 1564 1724 cmd.exe chcp.com PID 1724 wrote to memory of 1564 1724 cmd.exe chcp.com PID 1724 wrote to memory of 1564 1724 cmd.exe chcp.com PID 1724 wrote to memory of 1436 1724 cmd.exe cscript.exe PID 1724 wrote to memory of 1436 1724 cmd.exe cscript.exe PID 1724 wrote to memory of 1436 1724 cmd.exe cscript.exe PID 1724 wrote to memory of 1436 1724 cmd.exe cscript.exe PID 1436 wrote to memory of 376 1436 cscript.exe powershell.exe PID 1436 wrote to memory of 376 1436 cscript.exe powershell.exe PID 1436 wrote to memory of 376 1436 cscript.exe powershell.exe PID 1436 wrote to memory of 376 1436 cscript.exe powershell.exe PID 376 wrote to memory of 2004 376 powershell.exe cmd.exe PID 376 wrote to memory of 2004 376 powershell.exe cmd.exe PID 376 wrote to memory of 2004 376 powershell.exe cmd.exe PID 376 wrote to memory of 2004 376 powershell.exe cmd.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\78d84f8368b44692b74500f6071788170bc2fef27363586b6d569d745d1cf2a2.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\cmd.execmd /c c:\Users\Admin\AppData\Local\Temp\adobeacd-update.bat2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\PING.EXEping 1.1.2.2 -n 23⤵
- Runs ping.exe
PID:976 -
C:\Windows\SysWOW64\chcp.comchcp 12513⤵PID:1564
-
C:\Windows\SysWOW64\cscript.execscript.exe "c:\Users\Admin\AppData\Local\Temp\adobeacd-update"".""v""bs"3⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy bypass -noprofile -file C:\Users\Admin\AppData\Local\Temp\adobeacd-update.ps14⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c c:\Users\Admin\AppData\Local\Temp\444.exe5⤵PID:2004
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2032
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\adobeacd-update.ps1Filesize
1KB
MD59436e9ec2fcbe9c496ef495fc4ad07d7
SHA105c326ac60150c4d2bd7629ba3004dd2796421da
SHA256d05f23dc2a538bd7a7a5c0b470685feaefa5b77f8c7bc1482d6ab5c48a8a08ef
SHA5125ea25a6d5b48d8b0f3bf39881c81ece5bc82918075b3595d7c5f4eda377bfe6b7612dbcbf381dec9d6fb9569d7d1c76f892d3f1924c2f21cb22cc0a8ae48263e
-
\??\c:\Users\Admin\AppData\Local\Temp\adobeacd-update.batFilesize
207B
MD5bcee45f249102dd87bc0445925e1dc65
SHA15652e6a5aa3178329def77f50e54529997e0cfad
SHA25684b6d24219105e86f42329300278bbefa03ff6b40116123f3d19ff3c20f6ec9a
SHA512c6290cc42bc452ce9d4bd284909da7f735d571dedf98e55809c1d91b0272db2a09e76865f2f476a7a2a1833126920ed7f2f9fab5d400bf2d0fb0ff381b432480
-
\??\c:\Users\Admin\AppData\Local\Temp\adobeacd-update.vbsFilesize
357B
MD54595af11d7e8f623a9c1c3169d9bf20c
SHA111874e9d2ecada1b01dd1d05a8aa835bd4a31714
SHA2564ed9c705449ec3a1a2afd425b478ae80d339c03498eb56dc19d7516fd9cadded
SHA512b4a6edff072d77f389da0e93ad834e54e7c4e078cc3c2344ea939730720d8305dc72324d4b791ea0bb833724df9f96d7facd26970c74be8d5b0ee3bafe735cf3
-
memory/376-125-0x0000000069FD0000-0x000000006A57B000-memory.dmpFilesize
5.7MB
-
memory/376-121-0x0000000069FD0000-0x000000006A57B000-memory.dmpFilesize
5.7MB
-
memory/376-120-0x00000000022E0000-0x000000000230D000-memory.dmpFilesize
180KB
-
memory/376-117-0x0000000000000000-mapping.dmp
-
memory/976-104-0x0000000000000000-mapping.dmp
-
memory/1436-114-0x0000000000000000-mapping.dmp
-
memory/1564-113-0x0000000000000000-mapping.dmp
-
memory/1584-84-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-91-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-61-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-63-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-65-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-64-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-66-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-67-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-69-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-68-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-71-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-70-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-73-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-72-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-75-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-74-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-77-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-76-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-78-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-79-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-80-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-81-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-83-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-82-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-60-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-86-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-85-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-87-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-88-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-89-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-90-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-62-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-92-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-93-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-94-0x0000000070D0D000-0x0000000070D18000-memory.dmpFilesize
44KB
-
memory/1584-96-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-97-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-102-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-100-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-101-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-99-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-98-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-106-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-105-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-108-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-107-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-110-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-109-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-111-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-59-0x0000000000515000-0x0000000000519000-memory.dmpFilesize
16KB
-
memory/1584-58-0x0000000070D0D000-0x0000000070D18000-memory.dmpFilesize
44KB
-
memory/1584-54-0x00000000722A1000-0x00000000722A4000-memory.dmpFilesize
12KB
-
memory/1584-124-0x0000000070D0D000-0x0000000070D18000-memory.dmpFilesize
44KB
-
memory/1584-123-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1584-57-0x0000000075C81000-0x0000000075C83000-memory.dmpFilesize
8KB
-
memory/1584-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1584-55-0x000000006FD21000-0x000000006FD23000-memory.dmpFilesize
8KB
-
memory/1724-95-0x0000000000000000-mapping.dmp
-
memory/2004-126-0x0000000000000000-mapping.dmp
-
memory/2032-118-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmpFilesize
8KB
-
memory/2032-112-0x0000000000000000-mapping.dmp