Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
100s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 22:57
Behavioral task
behavioral1
Sample
9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe
Resource
win10v2004-20221111-en
General
-
Target
9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe
-
Size
139KB
-
MD5
6a5b3756d94eb031d2d0f17d8aa770c2
-
SHA1
ea01889c4f7b08847290646a05fed16be7de3ec0
-
SHA256
9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223
-
SHA512
43b30a67043b3471848b9958d72b495848ac6e5a3b28ac9d5b7455b5e3ce35508d7f5b28dbdc3b06f63122aae749a39defa8b3bc9ce9fd3b7b4c87c1f219628e
-
SSDEEP
3072:6mi+/dgy5Ef8doutaZZYCajVJ4pcUiqbHBchQfi:6tSEf+oSaR6PKcTcBchQf
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1964 osk.exe 596 WINWORD.EXE 700 WINWORD.EXE -
resource yara_rule behavioral1/memory/1204-57-0x0000000011000000-0x000000001102F000-memory.dmp upx behavioral1/files/0x000a000000013a09-59.dat upx behavioral1/files/0x000a000000013a09-60.dat upx behavioral1/files/0x000a000000013a09-62.dat upx behavioral1/memory/1204-67-0x0000000011000000-0x000000001102F000-memory.dmp upx behavioral1/files/0x000a000000013a09-66.dat upx behavioral1/files/0x0009000000014219-70.dat upx behavioral1/files/0x0009000000014219-71.dat upx behavioral1/files/0x0009000000014219-73.dat upx behavioral1/memory/1964-75-0x0000000011000000-0x000000001102F000-memory.dmp upx behavioral1/files/0x0009000000014219-78.dat upx behavioral1/files/0x000600000001422b-79.dat upx behavioral1/files/0x0009000000014219-81.dat upx behavioral1/files/0x0009000000014219-82.dat upx behavioral1/memory/596-85-0x0000000011000000-0x000000001102F000-memory.dmp upx behavioral1/files/0x0009000000014219-84.dat upx behavioral1/memory/700-88-0x0000000011000000-0x000000001102F000-memory.dmp upx -
Loads dropped DLL 6 IoCs
pid Process 1204 9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe 1204 9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe 1964 osk.exe 1964 osk.exe 596 WINWORD.EXE 596 WINWORD.EXE -
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\WINWORD.EXE osk.exe File opened for modification C:\Windows\SysWOW64\Com\ctfmoon.exe WINWORD.EXE File opened for modification C:\Windows\SysWOW64\Opened.enc WINWORD.EXE File opened for modification C:\Windows\SysWOW64\Recently.enc WINWORD.EXE File opened for modification C:\Windows\SysWOW64\StopImport.enc WINWORD.EXE File opened for modification C:\Windows\SysWOW64\These.enc WINWORD.EXE File opened for modification C:\Windows\SysWOW64\Com\ctfmoon.exe osk.exe File opened for modification C:\Windows\SysWOW64\WINWORD.exe WINWORD.EXE File opened for modification C:\Windows\SysWOW64\WINWORD.EXE WINWORD.EXE File opened for modification C:\Windows\SysWOW64\Are.enc WINWORD.EXE File opened for modification C:\Windows\SysWOW64\Files.enc WINWORD.EXE -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2044 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1964 osk.exe 1964 osk.exe 596 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1204 9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe 1964 osk.exe 596 WINWORD.EXE 700 WINWORD.EXE 2044 WINWORD.EXE 2044 WINWORD.EXE 2044 WINWORD.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1204 wrote to memory of 2044 1204 9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe 27 PID 1204 wrote to memory of 2044 1204 9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe 27 PID 1204 wrote to memory of 2044 1204 9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe 27 PID 1204 wrote to memory of 2044 1204 9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe 27 PID 1204 wrote to memory of 1964 1204 9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe 28 PID 1204 wrote to memory of 1964 1204 9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe 28 PID 1204 wrote to memory of 1964 1204 9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe 28 PID 1204 wrote to memory of 1964 1204 9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe 28 PID 1964 wrote to memory of 596 1964 osk.exe 29 PID 1964 wrote to memory of 596 1964 osk.exe 29 PID 1964 wrote to memory of 596 1964 osk.exe 29 PID 1964 wrote to memory of 596 1964 osk.exe 29 PID 596 wrote to memory of 700 596 WINWORD.EXE 30 PID 596 wrote to memory of 700 596 WINWORD.EXE 30 PID 596 wrote to memory of 700 596 WINWORD.EXE 30 PID 596 wrote to memory of 700 596 WINWORD.EXE 30 PID 2044 wrote to memory of 1084 2044 WINWORD.EXE 33 PID 2044 wrote to memory of 1084 2044 WINWORD.EXE 33 PID 2044 wrote to memory of 1084 2044 WINWORD.EXE 33 PID 2044 wrote to memory of 1084 2044 WINWORD.EXE 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe"C:\Users\Admin\AppData\Local\Temp\9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\Temp\_$Cf\9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223 .doc"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1084
-
-
-
C:\Windows\Temp\_$Cf\osk.exe"C:\Windows\Temp\_$Cf\osk.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\WINWORD.EXE"C:\Windows\system32\WINWORD.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\SysWOW64\WINWORD.EXE"C:\Windows\system32\WINWORD.EXE"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:700
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5862a96836fe55f230039047fc1897b6f
SHA156a56c039d90714cefe7d2e7bb02e13c2b04764c
SHA2560044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21
SHA512d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574
-
Filesize
74KB
MD5862a96836fe55f230039047fc1897b6f
SHA156a56c039d90714cefe7d2e7bb02e13c2b04764c
SHA2560044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21
SHA512d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574
-
Filesize
74KB
MD5862a96836fe55f230039047fc1897b6f
SHA156a56c039d90714cefe7d2e7bb02e13c2b04764c
SHA2560044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21
SHA512d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574
-
Filesize
74KB
MD5862a96836fe55f230039047fc1897b6f
SHA156a56c039d90714cefe7d2e7bb02e13c2b04764c
SHA2560044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21
SHA512d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574
-
Filesize
118KB
MD54e9b69cecff4ca8e53137add4071ad5b
SHA151ba5a8ec1125ad1a726121a0977f3980e740cab
SHA2569fbf56cd714f26aeba25c9896e1d668c28465b806e0dd298dbea4429098f5931
SHA512e47c7f8333f958fef019bc56a3663e0879e1509b82c06d71243cb5d41032bdb462da6962848f9137e4cbeaa6bc84ad37377a7da053f0b1786f35576d52b38b70
-
Filesize
74KB
MD5862a96836fe55f230039047fc1897b6f
SHA156a56c039d90714cefe7d2e7bb02e13c2b04764c
SHA2560044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21
SHA512d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574
-
Filesize
74KB
MD5862a96836fe55f230039047fc1897b6f
SHA156a56c039d90714cefe7d2e7bb02e13c2b04764c
SHA2560044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21
SHA512d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574
-
Filesize
74KB
MD5862a96836fe55f230039047fc1897b6f
SHA156a56c039d90714cefe7d2e7bb02e13c2b04764c
SHA2560044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21
SHA512d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574
-
Filesize
74KB
MD5862a96836fe55f230039047fc1897b6f
SHA156a56c039d90714cefe7d2e7bb02e13c2b04764c
SHA2560044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21
SHA512d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574
-
Filesize
74KB
MD5862a96836fe55f230039047fc1897b6f
SHA156a56c039d90714cefe7d2e7bb02e13c2b04764c
SHA2560044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21
SHA512d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574
-
Filesize
74KB
MD5862a96836fe55f230039047fc1897b6f
SHA156a56c039d90714cefe7d2e7bb02e13c2b04764c
SHA2560044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21
SHA512d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574
-
Filesize
74KB
MD5862a96836fe55f230039047fc1897b6f
SHA156a56c039d90714cefe7d2e7bb02e13c2b04764c
SHA2560044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21
SHA512d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574
-
Filesize
74KB
MD5862a96836fe55f230039047fc1897b6f
SHA156a56c039d90714cefe7d2e7bb02e13c2b04764c
SHA2560044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21
SHA512d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574