0616f04ec50d2745f50b40b3ff6c7bf99924f8dea084569afa6fb3b971114b41

Analysis

max time kernel
104s
max time network
171s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0616f04ec50d2745f50b40b3ff6c7bf99924f8dea084569afa6fb3b971114b41.doc
Size

61KB
MD5

97f6d88dcfe5fdcbf6cde2a588ad48bc
SHA1

e17474fe19a3a6b5364d8502b9b436ac703e16c4
SHA256

0616f04ec50d2745f50b40b3ff6c7bf99924f8dea084569afa6fb3b971114b41
SHA512

c8fdab0cec9071f184e724eb98b8e4d614d3b67a1232ec71724f461e0d8bab22d6d3393cbb12870d79dce42c3c6ad945f1f1015dc6c9e1d7c7499c514eaadbe8
SSDEEP

768:S++if7UQ9k8Wyvtr3OL8rKMpI+Ujsene8WXZkryaiYnTo9ED:2pQDWkR3OLbH7ymnC

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://91.220.131.29/upd/install.exe

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1068	1928	cmd.exe	WINWORD.EXE

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 1560 powershell.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

flow	pid	process
4	1560	powershell.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\TypeLib\{C4433083-F8EF-4F31-8ED8-FCD4CBF80D95}\2.0\FLAGS\ = "6"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents9"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents9"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}\ = "Tabs"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\TypeLib\{C4433083-F8EF-4F31-8ED8-FCD4CBF80D95}\2.0\0	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText"	WINWORD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2008 PING.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1928 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1560 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1560 powershell.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1928 WINWORD.EXE
1928 WINWORD.EXE

pid	process
2008	PING.EXE

pid	process
1928	WINWORD.EXE

pid	process
1560	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1560	powershell.exe

pid	process
1928	WINWORD.EXE
1928	WINWORD.EXE

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

WINWORD.EXEcmd.execscript.exepowershell.exe

description	pid	process	target process
PID 1928 wrote to memory of 1068	1928	WINWORD.EXE	cmd.exe
PID 1928 wrote to memory of 1068	1928	WINWORD.EXE	cmd.exe
PID 1928 wrote to memory of 1068	1928	WINWORD.EXE	cmd.exe
PID 1928 wrote to memory of 1068	1928	WINWORD.EXE	cmd.exe
PID 1928 wrote to memory of 1068	1928	WINWORD.EXE	cmd.exe
PID 1928 wrote to memory of 1068	1928	WINWORD.EXE	cmd.exe
PID 1928 wrote to memory of 1068	1928	WINWORD.EXE	cmd.exe
PID 1068 wrote to memory of 2008	1068	cmd.exe	PING.EXE
PID 1068 wrote to memory of 2008	1068	cmd.exe	PING.EXE
PID 1068 wrote to memory of 2008	1068	cmd.exe	PING.EXE
PID 1068 wrote to memory of 2008	1068	cmd.exe	PING.EXE
PID 1068 wrote to memory of 1540	1068	cmd.exe	chcp.com
PID 1068 wrote to memory of 1540	1068	cmd.exe	chcp.com
PID 1068 wrote to memory of 1540	1068	cmd.exe	chcp.com
PID 1068 wrote to memory of 1540	1068	cmd.exe	chcp.com
PID 1068 wrote to memory of 1552	1068	cmd.exe	cscript.exe
PID 1068 wrote to memory of 1552	1068	cmd.exe	cscript.exe
PID 1068 wrote to memory of 1552	1068	cmd.exe	cscript.exe
PID 1068 wrote to memory of 1552	1068	cmd.exe	cscript.exe
PID 1552 wrote to memory of 1560	1552	cscript.exe	powershell.exe
PID 1552 wrote to memory of 1560	1552	cscript.exe	powershell.exe
PID 1552 wrote to memory of 1560	1552	cscript.exe	powershell.exe
PID 1552 wrote to memory of 1560	1552	cscript.exe	powershell.exe
PID 1928 wrote to memory of 1728	1928	WINWORD.EXE	splwow64.exe
PID 1928 wrote to memory of 1728	1928	WINWORD.EXE	splwow64.exe
PID 1928 wrote to memory of 1728	1928	WINWORD.EXE	splwow64.exe
PID 1928 wrote to memory of 1728	1928	WINWORD.EXE	splwow64.exe
PID 1560 wrote to memory of 592	1560	powershell.exe	cmd.exe
PID 1560 wrote to memory of 592	1560	powershell.exe	cmd.exe
PID 1560 wrote to memory of 592	1560	powershell.exe	cmd.exe
PID 1560 wrote to memory of 592	1560	powershell.exe	cmd.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0616f04ec50d2745f50b40b3ff6c7bf99924f8dea084569afa6fb3b971114b41.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\Users\Admin\AppData\Local\Temp\adobeacd-update.bat
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\SysWOW64\PING.EXE
ping 1.1.2.2 -n 2
3⤵
- Runs ping.exe
PID:2008

C:\Windows\SysWOW64\chcp.com
chcp 1251
3⤵
PID:1540

C:\Windows\SysWOW64\cscript.exe
cscript.exe "c:\Users\Admin\AppData\Local\Temp\adobeacd-update"".""v""bs"
3⤵
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy bypass -noprofile -file C:\Users\Admin\AppData\Local\Temp\adobeacd-update.ps1
4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c c:\Users\Admin\AppData\Local\Temp\444.exe
5⤵
PID:592

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\adobeacd-update.ps1
Filesize
1KB

MD5
a8a954ecf3820fe0edc44cb6bb56cfae

SHA1
e9913ad2ff8e8960a871eb282683fc53f88b5c73

SHA256
94143b3aa4dfe74475eeaabaa1d44a1f15dee8a224268b52f91ca5e8b91350a3

SHA512
abb76ffe17a57a2d036b2266fa36e6c663901e5835e045a0ef6a4616705be3dce4b101699ba81b8dcd37efea76a3b591013d387be99782b9b6550917653592a4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\adobeacd-update.bat
Filesize
207B

MD5
bcee45f249102dd87bc0445925e1dc65

SHA1
5652e6a5aa3178329def77f50e54529997e0cfad

SHA256
84b6d24219105e86f42329300278bbefa03ff6b40116123f3d19ff3c20f6ec9a

SHA512
c6290cc42bc452ce9d4bd284909da7f735d571dedf98e55809c1d91b0272db2a09e76865f2f476a7a2a1833126920ed7f2f9fab5d400bf2d0fb0ff381b432480

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\adobeacd-update.vbs
Filesize
355B

MD5
31b68eb4af8a0a939dbff53a9355e130

SHA1
a64374be6f7a90ac04c77e54162b93b95066c791

SHA256
a2daedce3a9b0abaf3b246b016e4f39a7ba00dec7dbad35134668c2fa336eae5

SHA512
83d7b3599dcf947fcda88fe21156b8bea5f2e04bf9a56058553261e9fe3fed8f886fd8df6e211a0921555a510b6e6de224aef99c57d55be0f5b54eb1a727f4b5

Download Submit
memory/592-131-0x0000000000000000-mapping.dmp

Download
memory/1068-96-0x0000000000000000-mapping.dmp

Download
memory/1540-120-0x0000000000000000-mapping.dmp

Download
memory/1552-121-0x0000000000000000-mapping.dmp

Download
memory/1560-129-0x0000000069DA0000-0x000000006A34B000-memory.dmp

Filesize
5.7MB

Download
memory/1560-126-0x0000000069DA0000-0x000000006A34B000-memory.dmp

Filesize
5.7MB

Download
memory/1560-124-0x0000000000000000-mapping.dmp

Download
memory/1728-130-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Filesize
8KB

Download
memory/1728-128-0x0000000000000000-mapping.dmp

Download
memory/1928-87-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-94-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-61-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-60-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-65-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-66-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-67-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-68-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-69-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-70-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-71-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-73-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-72-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-75-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-74-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-77-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-76-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-78-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-79-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-80-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-81-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-82-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-83-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-84-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-85-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-86-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-64-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-89-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-90-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-91-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-92-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-88-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-93-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-62-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-95-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-97-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-99-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-98-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-101-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-100-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-102-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-103-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-106-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-107-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-108-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-109-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-110-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-111-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-112-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-113-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-114-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-115-0x0000000070AED000-0x0000000070AF8000-memory.dmp

Filesize
44KB

Download
memory/1928-116-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-63-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-59-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-58-0x0000000070AED000-0x0000000070AF8000-memory.dmp

Filesize
44KB

Download
memory/1928-57-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download
memory/1928-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1928-55-0x000000006FB01000-0x000000006FB03000-memory.dmp

Filesize
8KB

Download
memory/1928-54-0x0000000072081000-0x0000000072084000-memory.dmp

Filesize
12KB

Download
memory/1928-117-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-118-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-119-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1928-132-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1928-133-0x0000000070AED000-0x0000000070AF8000-memory.dmp

Filesize
44KB

Download
memory/2008-105-0x0000000000000000-mapping.dmp

Download