Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
09-12-2022 10:29
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-SANOS-TENDER DOCUMENT_specifications001.rtf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
RFQ-SANOS-TENDER DOCUMENT_specifications001.rtf
Resource
win10v2004-20220812-en
General
-
Target
RFQ-SANOS-TENDER DOCUMENT_specifications001.rtf
-
Size
9KB
-
MD5
8f7574acf0737fc12d5019b19df45ff5
-
SHA1
12be20df9be6591cd53003cc4c9e7388a672e41c
-
SHA256
d8a5da9f780854652a37a5a4fdd812a99af1b26236adf4deac2ca38415224a8d
-
SHA512
fe935974b8de54c093a7c355db5558f10ce3d7b156bd8b835ded53dee1afe650566ac88be6ea0c9d933f1d8db287787f08e71db93b3ee56d7afb24ea38511859
-
SSDEEP
192:Xnu6W2UOd8LhywLTPG6Pw24rCKdDrAKVw3AsQ6aR3ijPWFqMw5OCjMaM:3f/UOd8Fyw3+kwr+KdrAUwwsQRR3ijp8
Malware Config
Extracted
formbook
4.1
wh23
ow9vyvfee.com
alvis.one
mutantgobz.claims
plynofon.com
southofkingst.store
nuvidamedspa.com
coffeeforyou56.com
opaletechevents.com
momobar.life
abcmousu.com
learnicd-11.com
tipokin.xyz
kahvezevki.com
suratdimond.com
oldartists.best
infoepic.info
mattresslabo.com
skarlmotors.com
cl9319x.xyz
med49app.net
vivarellistaging2.com
gwnv.link
ogurecsbatvoi-7.online
littlelionplaycafe.com
floridaindianrivergeoves.com
eyelashacademysurrey.com
elprobetre.store
sexfan.biz
westbay.casino
carmana.store
optitude.finance
neo-hub.us
meadowwoodanimalclinic.com
ok-experts.com
magnoliabymr.com
fenomini.com
miaowu.work
skipermind.com
winstim.com
14123ninemile.com
plegablescr.com
bloommagiccbdburaliste.com
focusing-garef.com
krumobilept.com
norbercik.online
qteko.com
growupmarketingservices.com
alem-holdings.com
entreinnovator3.com
mainlydivision.space
module.live
gtrewegehwewe5.asia
jd8wme.cyou
pingacx757.com
big-teamwork.com
lesyeuxdanslespoches.com
yutighjkdfgjkd.shop
yourstoolsample.com
musntgrumble.com
jurgenremmerie.com
ebade.xyz
johnollieconstruction.com
bioprofumeria.shop
sarithebrand.com
taiguszab.online
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/464-75-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/464-81-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1440-83-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Blocklisted process makes network request 3 IoCs
Processes:
EQNEDT32.EXEflow pid process 4 1552 EQNEDT32.EXE 5 1552 EQNEDT32.EXE 7 1552 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
wget.exemyxwn.exemyxwn.exepid process 776 wget.exe 752 myxwn.exe 464 myxwn.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEwget.exemyxwn.exepid process 1552 EQNEDT32.EXE 776 wget.exe 776 wget.exe 752 myxwn.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
myxwn.exemyxwn.exeNETSTAT.EXEdescription pid process target process PID 752 set thread context of 464 752 myxwn.exe myxwn.exe PID 464 set thread context of 1224 464 myxwn.exe Explorer.EXE PID 1440 set thread context of 1224 1440 NETSTAT.EXE Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\wget.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\wget.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\wget.exe nsis_installer_1 -
Office loads VBA resources, possible macro or embedded object present
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1440 NETSTAT.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1404 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
myxwn.exeNETSTAT.EXEpid process 464 myxwn.exe 464 myxwn.exe 1440 NETSTAT.EXE 1440 NETSTAT.EXE 1440 NETSTAT.EXE 1440 NETSTAT.EXE 1440 NETSTAT.EXE 1440 NETSTAT.EXE 1440 NETSTAT.EXE 1440 NETSTAT.EXE 1440 NETSTAT.EXE 1440 NETSTAT.EXE 1440 NETSTAT.EXE 1440 NETSTAT.EXE 1440 NETSTAT.EXE 1440 NETSTAT.EXE 1440 NETSTAT.EXE 1440 NETSTAT.EXE 1440 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
myxwn.exemyxwn.exeNETSTAT.EXEpid process 752 myxwn.exe 464 myxwn.exe 464 myxwn.exe 464 myxwn.exe 1440 NETSTAT.EXE 1440 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
myxwn.exeNETSTAT.EXEExplorer.EXEdescription pid process Token: SeDebugPrivilege 464 myxwn.exe Token: SeDebugPrivilege 1440 NETSTAT.EXE Token: SeShutdownPrivilege 1224 Explorer.EXE Token: SeShutdownPrivilege 1224 Explorer.EXE Token: SeShutdownPrivilege 1224 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE 1224 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE 1224 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1404 WINWORD.EXE 1404 WINWORD.EXE -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
EQNEDT32.EXEwget.exemyxwn.exeExplorer.EXENETSTAT.EXEWINWORD.EXEdescription pid process target process PID 1552 wrote to memory of 776 1552 EQNEDT32.EXE wget.exe PID 1552 wrote to memory of 776 1552 EQNEDT32.EXE wget.exe PID 1552 wrote to memory of 776 1552 EQNEDT32.EXE wget.exe PID 1552 wrote to memory of 776 1552 EQNEDT32.EXE wget.exe PID 776 wrote to memory of 752 776 wget.exe myxwn.exe PID 776 wrote to memory of 752 776 wget.exe myxwn.exe PID 776 wrote to memory of 752 776 wget.exe myxwn.exe PID 776 wrote to memory of 752 776 wget.exe myxwn.exe PID 752 wrote to memory of 464 752 myxwn.exe myxwn.exe PID 752 wrote to memory of 464 752 myxwn.exe myxwn.exe PID 752 wrote to memory of 464 752 myxwn.exe myxwn.exe PID 752 wrote to memory of 464 752 myxwn.exe myxwn.exe PID 752 wrote to memory of 464 752 myxwn.exe myxwn.exe PID 1224 wrote to memory of 1440 1224 Explorer.EXE NETSTAT.EXE PID 1224 wrote to memory of 1440 1224 Explorer.EXE NETSTAT.EXE PID 1224 wrote to memory of 1440 1224 Explorer.EXE NETSTAT.EXE PID 1224 wrote to memory of 1440 1224 Explorer.EXE NETSTAT.EXE PID 1440 wrote to memory of 1536 1440 NETSTAT.EXE cmd.exe PID 1440 wrote to memory of 1536 1440 NETSTAT.EXE cmd.exe PID 1440 wrote to memory of 1536 1440 NETSTAT.EXE cmd.exe PID 1440 wrote to memory of 1536 1440 NETSTAT.EXE cmd.exe PID 1404 wrote to memory of 788 1404 WINWORD.EXE splwow64.exe PID 1404 wrote to memory of 788 1404 WINWORD.EXE splwow64.exe PID 1404 wrote to memory of 788 1404 WINWORD.EXE splwow64.exe PID 1404 wrote to memory of 788 1404 WINWORD.EXE splwow64.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\RFQ-SANOS-TENDER DOCUMENT_specifications001.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:788
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\myxwn.exe"3⤵PID:1536
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Roaming\wget.exe"C:\Users\Admin\AppData\Roaming\wget.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\myxwn.exe"C:\Users\Admin\AppData\Local\Temp\myxwn.exe" C:\Users\Admin\AppData\Local\Temp\getlceffch.gqb3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\myxwn.exe"C:\Users\Admin\AppData\Local\Temp\myxwn.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:464
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\eilfol.tscFilesize
185KB
MD5663d2953e8beddc4a08aca27a1145112
SHA13293e912d9661b2736ca8d403250590eb2d5164d
SHA2562aa0a26b9a38b19c34c10e53834ec199fc87cbfea15e8babee582a3df331b9cb
SHA51230581e1321f0165abcfcc908e15877f080dad2bf7bbedb24fa8e8baee3176097d7f43c5e59076f095c3929438b4e5740e1871ab3716c338e765c4d3d011a630a
-
C:\Users\Admin\AppData\Local\Temp\getlceffch.gqbFilesize
6KB
MD5e6d82eb1bea9bca087062e488dfd575e
SHA15ec22cec8805d965d6dac1719976bef32867b595
SHA256ad495d0d0e35a6ab15c042e900e0dfc20197ef36153e15559e0fdaef4c541230
SHA5126ef986b00509140137d51f114ecdf7b92c1008c3fae513579634ed202f1fc4e34ba904db48cbf092cf8d12c0a5e84cc5b2a0d61e95c03f4006eca3f190f80fd2
-
C:\Users\Admin\AppData\Local\Temp\myxwn.exeFilesize
276KB
MD52afdd35f6df6b6cbf8f3500822625d70
SHA12efd81cdd798b38908b63a7a8ae88806e5234a1d
SHA256393af45214ac518895d3178055bee95f70264bdc65ca7b97f4c564daf95943c8
SHA512b49476cddd05b3b003bb326e0f02a78eea6021f5087c4c6cd55d306ccfb061fc8510ffa44b59a96e3cd0a7c91c037989a691561b0234f3672be08194a5825359
-
C:\Users\Admin\AppData\Local\Temp\myxwn.exeFilesize
276KB
MD52afdd35f6df6b6cbf8f3500822625d70
SHA12efd81cdd798b38908b63a7a8ae88806e5234a1d
SHA256393af45214ac518895d3178055bee95f70264bdc65ca7b97f4c564daf95943c8
SHA512b49476cddd05b3b003bb326e0f02a78eea6021f5087c4c6cd55d306ccfb061fc8510ffa44b59a96e3cd0a7c91c037989a691561b0234f3672be08194a5825359
-
C:\Users\Admin\AppData\Local\Temp\myxwn.exeFilesize
276KB
MD52afdd35f6df6b6cbf8f3500822625d70
SHA12efd81cdd798b38908b63a7a8ae88806e5234a1d
SHA256393af45214ac518895d3178055bee95f70264bdc65ca7b97f4c564daf95943c8
SHA512b49476cddd05b3b003bb326e0f02a78eea6021f5087c4c6cd55d306ccfb061fc8510ffa44b59a96e3cd0a7c91c037989a691561b0234f3672be08194a5825359
-
C:\Users\Admin\AppData\Roaming\wget.exeFilesize
530KB
MD5e17b0be6e0c42a0c39c5da63523af8d8
SHA1c374934cf78e71069fc628de57b3ea15fff4c36c
SHA2567eb67be31871fe9316bbb2ba993b6dfd13cb9e7e04a2e1091b934746399e5293
SHA5121ba4983c40c19726d49b8dc73bbf9da2de7f3c53733f4264c4d731d75ae1f3e08718ecd9cba3a99d24295af5115a9449aed498259ac5c3fecf0a331c87cc4089
-
C:\Users\Admin\AppData\Roaming\wget.exeFilesize
530KB
MD5e17b0be6e0c42a0c39c5da63523af8d8
SHA1c374934cf78e71069fc628de57b3ea15fff4c36c
SHA2567eb67be31871fe9316bbb2ba993b6dfd13cb9e7e04a2e1091b934746399e5293
SHA5121ba4983c40c19726d49b8dc73bbf9da2de7f3c53733f4264c4d731d75ae1f3e08718ecd9cba3a99d24295af5115a9449aed498259ac5c3fecf0a331c87cc4089
-
\Users\Admin\AppData\Local\Temp\myxwn.exeFilesize
276KB
MD52afdd35f6df6b6cbf8f3500822625d70
SHA12efd81cdd798b38908b63a7a8ae88806e5234a1d
SHA256393af45214ac518895d3178055bee95f70264bdc65ca7b97f4c564daf95943c8
SHA512b49476cddd05b3b003bb326e0f02a78eea6021f5087c4c6cd55d306ccfb061fc8510ffa44b59a96e3cd0a7c91c037989a691561b0234f3672be08194a5825359
-
\Users\Admin\AppData\Local\Temp\myxwn.exeFilesize
276KB
MD52afdd35f6df6b6cbf8f3500822625d70
SHA12efd81cdd798b38908b63a7a8ae88806e5234a1d
SHA256393af45214ac518895d3178055bee95f70264bdc65ca7b97f4c564daf95943c8
SHA512b49476cddd05b3b003bb326e0f02a78eea6021f5087c4c6cd55d306ccfb061fc8510ffa44b59a96e3cd0a7c91c037989a691561b0234f3672be08194a5825359
-
\Users\Admin\AppData\Local\Temp\myxwn.exeFilesize
276KB
MD52afdd35f6df6b6cbf8f3500822625d70
SHA12efd81cdd798b38908b63a7a8ae88806e5234a1d
SHA256393af45214ac518895d3178055bee95f70264bdc65ca7b97f4c564daf95943c8
SHA512b49476cddd05b3b003bb326e0f02a78eea6021f5087c4c6cd55d306ccfb061fc8510ffa44b59a96e3cd0a7c91c037989a691561b0234f3672be08194a5825359
-
\Users\Admin\AppData\Roaming\wget.exeFilesize
530KB
MD5e17b0be6e0c42a0c39c5da63523af8d8
SHA1c374934cf78e71069fc628de57b3ea15fff4c36c
SHA2567eb67be31871fe9316bbb2ba993b6dfd13cb9e7e04a2e1091b934746399e5293
SHA5121ba4983c40c19726d49b8dc73bbf9da2de7f3c53733f4264c4d731d75ae1f3e08718ecd9cba3a99d24295af5115a9449aed498259ac5c3fecf0a331c87cc4089
-
memory/464-77-0x0000000000360000-0x0000000000374000-memory.dmpFilesize
80KB
-
memory/464-81-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/464-76-0x00000000008C0000-0x0000000000BC3000-memory.dmpFilesize
3.0MB
-
memory/464-75-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/464-73-0x000000000041F110-mapping.dmp
-
memory/752-67-0x0000000000000000-mapping.dmp
-
memory/776-61-0x0000000000000000-mapping.dmp
-
memory/788-86-0x0000000000000000-mapping.dmp
-
memory/788-87-0x000007FEFB8A1000-0x000007FEFB8A3000-memory.dmpFilesize
8KB
-
memory/1224-89-0x00000000081F0000-0x000000000833C000-memory.dmpFilesize
1.3MB
-
memory/1224-90-0x00000000081F0000-0x000000000833C000-memory.dmpFilesize
1.3MB
-
memory/1224-78-0x0000000007550000-0x00000000076FE000-memory.dmpFilesize
1.7MB
-
memory/1404-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1404-58-0x0000000070EAD000-0x0000000070EB8000-memory.dmpFilesize
44KB
-
memory/1404-79-0x0000000070EAD000-0x0000000070EB8000-memory.dmpFilesize
44KB
-
memory/1404-92-0x0000000070EAD000-0x0000000070EB8000-memory.dmpFilesize
44KB
-
memory/1404-91-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1404-54-0x0000000072441000-0x0000000072444000-memory.dmpFilesize
12KB
-
memory/1404-57-0x0000000074F01000-0x0000000074F03000-memory.dmpFilesize
8KB
-
memory/1404-55-0x000000006FEC1000-0x000000006FEC3000-memory.dmpFilesize
8KB
-
memory/1440-88-0x0000000001ED0000-0x0000000001F63000-memory.dmpFilesize
588KB
-
memory/1440-80-0x0000000000000000-mapping.dmp
-
memory/1440-84-0x00000000020F0000-0x00000000023F3000-memory.dmpFilesize
3.0MB
-
memory/1440-83-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1440-82-0x00000000007A0000-0x00000000007A9000-memory.dmpFilesize
36KB
-
memory/1536-85-0x0000000000000000-mapping.dmp