670011a08ddcde9d1892593a968f87e9e8800248f6bb9b8967b05ec4c34b64d0

General

Target

670011a08ddcde9d1892593a968f87e9e8800248f6bb9b8967b05ec4c34b64d0.docm
Size

21KB
MD5

720f6555332b5fee6755debc506c6dd5
SHA1

4a2d406e5aff77159ee39067383302420231b045
SHA256

670011a08ddcde9d1892593a968f87e9e8800248f6bb9b8967b05ec4c34b64d0
SHA512

295238351c882e129ceaac7d8d248a40d24b2d085cc78817d3334f03b3bfc24fc2123bddfd393500ece4600ede743eb3b31f5d789a5153e577668658e8abfacc
SSDEEP

384:/imtZAqRZiSte7ZwedKS6w19Q/CEmkfsJyJ7sSMk+dRYHWfVMzPYkEx:/LZAqRZ7t2Zweww19Q6nSMk+Y2fVGP0

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://belombre.com/js/bin.exe

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	788	556	cmd.exe	WINWORD.EXE

Blocklisted process makes network request 3 IoCs

Processes:

powershell.exe

flow pid process

5 1404 powershell.exe
6 1404 powershell.exe
7 1404 powershell.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

flow	pid	process
5	1404	powershell.exe
6	1404	powershell.exe
7	1404	powershell.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1092 PING.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

556 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1404 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1404 powershell.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

556 WINWORD.EXE
556 WINWORD.EXE

pid	process
1092	PING.EXE

pid	process
556	WINWORD.EXE

pid	process
1404	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1404	powershell.exe

pid	process
556	WINWORD.EXE
556	WINWORD.EXE

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

WINWORD.EXEcmd.execscript.exe

description	pid	process	target process
PID 556 wrote to memory of 788	556	WINWORD.EXE	cmd.exe
PID 556 wrote to memory of 788	556	WINWORD.EXE	cmd.exe
PID 556 wrote to memory of 788	556	WINWORD.EXE	cmd.exe
PID 556 wrote to memory of 788	556	WINWORD.EXE	cmd.exe
PID 556 wrote to memory of 788	556	WINWORD.EXE	cmd.exe
PID 556 wrote to memory of 788	556	WINWORD.EXE	cmd.exe
PID 556 wrote to memory of 788	556	WINWORD.EXE	cmd.exe
PID 788 wrote to memory of 1092	788	cmd.exe	PING.EXE
PID 788 wrote to memory of 1092	788	cmd.exe	PING.EXE
PID 788 wrote to memory of 1092	788	cmd.exe	PING.EXE
PID 788 wrote to memory of 1092	788	cmd.exe	PING.EXE
PID 556 wrote to memory of 816	556	WINWORD.EXE	splwow64.exe
PID 556 wrote to memory of 816	556	WINWORD.EXE	splwow64.exe
PID 556 wrote to memory of 816	556	WINWORD.EXE	splwow64.exe
PID 556 wrote to memory of 816	556	WINWORD.EXE	splwow64.exe
PID 788 wrote to memory of 1620	788	cmd.exe	cscript.exe
PID 788 wrote to memory of 1620	788	cmd.exe	cscript.exe
PID 788 wrote to memory of 1620	788	cmd.exe	cscript.exe
PID 788 wrote to memory of 1620	788	cmd.exe	cscript.exe
PID 1620 wrote to memory of 1404	1620	cscript.exe	powershell.exe
PID 1620 wrote to memory of 1404	1620	cscript.exe	powershell.exe
PID 1620 wrote to memory of 1404	1620	cscript.exe	powershell.exe
PID 1620 wrote to memory of 1404	1620	cscript.exe	powershell.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\670011a08ddcde9d1892593a968f87e9e8800248f6bb9b8967b05ec4c34b64d0.docm"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:556

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\Users\Admin\AppData\Local\Temp\adobeacd-update.bat
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\SysWOW64\PING.EXE
ping 1.1.2.2 -n 2
3⤵
- Runs ping.exe
PID:1092

C:\Windows\SysWOW64\cscript.exe
cscript.exe "c:\Users\Admin\AppData\Local\Temp\adobeacd-update.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy bypass -noprofile -file C:\Users\Admin\AppData\Local\Temp\adobeacd-update.ps1
4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1404

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\adobeacd-update.ps1
Filesize
1KB

MD5
dbe0df0ea16c82857c8b21a18e3d5dc4

SHA1
34da2a37991a9c0d636861dd598e49ed7400e50e

SHA256
35cb45bf4b886175868c0c41bbc7822c1615a18678d0cfce3a9b43d91087d3b9

SHA512
ebe5a173456885255da3eb432543fe912ba26287c636e0f7585f6d17cb08f32b33cac24b5c637f84cdf1ce0199c2621ffbeb2236ce7a6f873b8e2bd6055cb837

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\adobeacd-update.bat
Filesize
105B

MD5
887e69d78ec4cdd87bd91bde8d1202ea

SHA1
24e2d56daf1660916e12085c9a05f0e203e1d797

SHA256
37043a8c9988e89e9726fa3a8dd9a0fbee8d4d96c6fa87788b1ca247fd33a90f

SHA512
d6931aec563e2a34b92ae5084f57ccfa5ed62de2b6d1dcb428c04611460e5fc763a4d0271184134469c650ae99d276c0376fd666d57f3fc17a32e2f8a878a631

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\adobeacd-update.vbs
Filesize
669B

MD5
ffc36f926b285039fac6a9d1935a902c

SHA1
187f3f56d94f35bddd58a53b3420c8444d50bd30

SHA256
3e2165633ad34ce60ecfe72de564506f25ecdcba79a52b4ed42213c7f722ff64

SHA512
97560c3192ff6d81a515abd5103ccde9f1df3ebe49ed18b20e2431b5e20fc0ebe210f1fcc845377996cdcd043cc6f4e0d21d75181a7b022f46f82469336569fa

Download Submit
memory/556-82-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-59-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-84-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-60-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-85-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-61-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-62-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-63-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-64-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-65-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-67-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-66-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-68-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-69-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-71-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-70-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-73-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-72-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-74-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-75-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-77-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-76-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-79-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-78-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-86-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-81-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-83-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/556-58-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download
memory/556-57-0x000000007160D000-0x0000000071618000-memory.dmp

Filesize
44KB

Download
memory/556-80-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-88-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-93-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-94-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-92-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-91-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-90-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-89-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-98-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-97-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-100-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-99-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-102-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-103-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-101-0x000000000045D000-0x0000000000461000-memory.dmp

Filesize
16KB

Download
memory/556-104-0x000000007160D000-0x0000000071618000-memory.dmp

Filesize
44KB

Download
memory/556-116-0x000000007160D000-0x0000000071618000-memory.dmp

Filesize
44KB

Download
memory/556-54-0x0000000072BA1000-0x0000000072BA4000-memory.dmp

Filesize
12KB

Download
memory/556-55-0x0000000070621000-0x0000000070623000-memory.dmp

Filesize
8KB

Download
memory/788-87-0x0000000000000000-mapping.dmp

Download
memory/816-106-0x000007FEFC251000-0x000007FEFC253000-memory.dmp

Filesize
8KB

Download
memory/816-105-0x0000000000000000-mapping.dmp

Download
memory/1092-96-0x0000000000000000-mapping.dmp

Download
memory/1404-110-0x0000000000000000-mapping.dmp

Download
memory/1404-112-0x000000006B0B0000-0x000000006B65B000-memory.dmp

Filesize
5.7MB

Download
memory/1404-113-0x000000006B0B0000-0x000000006B65B000-memory.dmp

Filesize
5.7MB

Download
memory/1404-115-0x00000000050D0000-0x00000000051C1000-memory.dmp

Filesize
964KB

Download
memory/1620-107-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads