Analysis
-
max time kernel
146s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
09-12-2022 13:32
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Exploit.CVE-2018-0798.4.23649.15924.rtf
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Exploit.CVE-2018-0798.4.23649.15924.rtf
Resource
win10v2004-20220901-en
General
-
Target
SecuriteInfo.com.Exploit.CVE-2018-0798.4.23649.15924.rtf
-
Size
3KB
-
MD5
69a6f3e5b30ab64fd90eb46dfec8d714
-
SHA1
9843c366b075bc145a5164be19052f8b441ef6e8
-
SHA256
5bf7aa1de7a064a956a29b7927a17b58c20b7cba96d74bd976ff920c41a34224
-
SHA512
547a9d9d80dcc33e0b113028b9a6fc8447d2823dbef89e01412282ce1f02317cd65bf48c2cfc2abd5d9b73ac49d07a8cd2860626675f7857ac906bf1b12c5bcd
Malware Config
Extracted
formbook
4.1
lt63
fortrantelecom.africa
ffafa.buzz
bullybrain.com
ekeisolutions.com
lamiamira.com
noahsark.xyz
beautyby-eve.com
cloudfatory.com
12443.football
hataykultur.online
donqu3.sexy
breakthroughaustralia.com
havengpe.com
cpxlocatup.info
corefourpartners.com
amonefintech.com
thithombo.africa
bassmaty.store
fdshdsr.top
lifesoapsimple.com
divaproportugal.com
footwearbags.com
ivbusinessservices.com
93215.vip
livescorenona123.online
ablulu109.xyz
chuyunfang.com
fogofwar.quest
weimingpian.net
getmowico.com
hability.xyz
brightmachineary.com
precious-sawdaa.com
nochewing.net
fruihcon.xyz
hue-fame.com
egordizain.ru
tutastrading.africa
deansroofingandconstruction.com
arabianroadstech.com
family-doctor-41501.com
233969.com
9898svip1.com
yonggunkim.net
illminded.com
gemlikguventasevdeneve.com
fiberlazertamir.com
kimia.boo
skinnectar.uk
leve-tech.co.uk
just3pages.com
wristnoe.co.uk
e-suxiu.com
evri-deiivery.com
storageredbox.net
grdpy.com
darkblissclothing.com
functionful.com
bestinvestorcorporation.info
com-prostaclear.com
91yqm.com
districthvacs.com
floridasoftware.biz
cocredcaixaaqui.com
gooqoo.xyz
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/688-75-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/688-83-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1652-86-0x0000000000100000-0x000000000012F000-memory.dmp formbook behavioral1/memory/1652-91-0x0000000000100000-0x000000000012F000-memory.dmp formbook -
Blocklisted process makes network request 3 IoCs
Processes:
EQNEDT32.EXEflow pid process 5 556 EQNEDT32.EXE 6 556 EQNEDT32.EXE 8 556 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
wordpage.exeovwid.exeovwid.exepid process 1324 wordpage.exe 852 ovwid.exe 688 ovwid.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEwordpage.exeovwid.exepid process 556 EQNEDT32.EXE 1324 wordpage.exe 1324 wordpage.exe 852 ovwid.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
ovwid.exeovwid.execolorcpl.exedescription pid process target process PID 852 set thread context of 688 852 ovwid.exe ovwid.exe PID 688 set thread context of 1304 688 ovwid.exe Explorer.EXE PID 688 set thread context of 1304 688 ovwid.exe Explorer.EXE PID 1652 set thread context of 1304 1652 colorcpl.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\wordpage.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\wordpage.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\wordpage.exe nsis_installer_1 -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1808 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
ovwid.execolorcpl.exepid process 688 ovwid.exe 688 ovwid.exe 688 ovwid.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe 1652 colorcpl.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
ovwid.exeovwid.execolorcpl.exepid process 852 ovwid.exe 688 ovwid.exe 688 ovwid.exe 688 ovwid.exe 688 ovwid.exe 1652 colorcpl.exe 1652 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
ovwid.exeExplorer.EXEcolorcpl.exedescription pid process Token: SeDebugPrivilege 688 ovwid.exe Token: SeShutdownPrivilege 1304 Explorer.EXE Token: SeShutdownPrivilege 1304 Explorer.EXE Token: SeShutdownPrivilege 1304 Explorer.EXE Token: SeDebugPrivilege 1652 colorcpl.exe Token: SeShutdownPrivilege 1304 Explorer.EXE Token: SeShutdownPrivilege 1304 Explorer.EXE -
Suspicious use of FindShellTrayWindow 14 IoCs
Processes:
Explorer.EXEpid process 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
Explorer.EXEpid process 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE 1304 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1808 WINWORD.EXE 1808 WINWORD.EXE -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
EQNEDT32.EXEwordpage.exeovwid.exeExplorer.EXEWINWORD.EXEcolorcpl.exedescription pid process target process PID 556 wrote to memory of 1324 556 EQNEDT32.EXE wordpage.exe PID 556 wrote to memory of 1324 556 EQNEDT32.EXE wordpage.exe PID 556 wrote to memory of 1324 556 EQNEDT32.EXE wordpage.exe PID 556 wrote to memory of 1324 556 EQNEDT32.EXE wordpage.exe PID 1324 wrote to memory of 852 1324 wordpage.exe ovwid.exe PID 1324 wrote to memory of 852 1324 wordpage.exe ovwid.exe PID 1324 wrote to memory of 852 1324 wordpage.exe ovwid.exe PID 1324 wrote to memory of 852 1324 wordpage.exe ovwid.exe PID 852 wrote to memory of 688 852 ovwid.exe ovwid.exe PID 852 wrote to memory of 688 852 ovwid.exe ovwid.exe PID 852 wrote to memory of 688 852 ovwid.exe ovwid.exe PID 852 wrote to memory of 688 852 ovwid.exe ovwid.exe PID 852 wrote to memory of 688 852 ovwid.exe ovwid.exe PID 1304 wrote to memory of 1652 1304 Explorer.EXE colorcpl.exe PID 1304 wrote to memory of 1652 1304 Explorer.EXE colorcpl.exe PID 1304 wrote to memory of 1652 1304 Explorer.EXE colorcpl.exe PID 1304 wrote to memory of 1652 1304 Explorer.EXE colorcpl.exe PID 1808 wrote to memory of 1976 1808 WINWORD.EXE splwow64.exe PID 1808 wrote to memory of 1976 1808 WINWORD.EXE splwow64.exe PID 1808 wrote to memory of 1976 1808 WINWORD.EXE splwow64.exe PID 1808 wrote to memory of 1976 1808 WINWORD.EXE splwow64.exe PID 1652 wrote to memory of 1768 1652 colorcpl.exe cmd.exe PID 1652 wrote to memory of 1768 1652 colorcpl.exe cmd.exe PID 1652 wrote to memory of 1768 1652 colorcpl.exe cmd.exe PID 1652 wrote to memory of 1768 1652 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Exploit.CVE-2018-0798.4.23649.15924.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1976
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ovwid.exe"3⤵PID:1768
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Roaming\wordpage.exeC:\Users\Admin\AppData\Roaming\wordpage.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\ovwid.exe"C:\Users\Admin\AppData\Local\Temp\ovwid.exe" C:\Users\Admin\AppData\Local\Temp\rrsopjtftd.p3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\ovwid.exe"C:\Users\Admin\AppData\Local\Temp\ovwid.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:688
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cqdkrcshwhw.wFilesize
185KB
MD57e02dcac3d442f6e3a36de2b65661c8a
SHA15057ac4eff50e36d8c1a767b8f35accf7db4a5ee
SHA256846b04da46b952747476b98c2cb6071faedc8d5ef0ca7f7a320b92fa299248fd
SHA512f6976c1060780888f7f1dfb31edba6f89d8096134cd693ef9fb1ebb97fb06d42fd5a437d4da6d7bddb354d17f72e661f8140310dd8837468bdf59a648a81f32c
-
C:\Users\Admin\AppData\Local\Temp\ovwid.exeFilesize
276KB
MD5a5cc35863cadeb24f827d9daa513c424
SHA10584250d8f5b06a11afbd3071547c6719adf02a4
SHA25646590fb8724e192cff8f18ccf4188f9cb2bd8661cbc1141cc15623775ad46a5c
SHA51232761ac38ab4c9b9f99bd767476b35fdecff67af8dcd678b6c449a4cebfe0c1bb040b5b8d31ba046566d2a612865709088494d90d4825ec7e8353e37ac0a7098
-
C:\Users\Admin\AppData\Local\Temp\ovwid.exeFilesize
276KB
MD5a5cc35863cadeb24f827d9daa513c424
SHA10584250d8f5b06a11afbd3071547c6719adf02a4
SHA25646590fb8724e192cff8f18ccf4188f9cb2bd8661cbc1141cc15623775ad46a5c
SHA51232761ac38ab4c9b9f99bd767476b35fdecff67af8dcd678b6c449a4cebfe0c1bb040b5b8d31ba046566d2a612865709088494d90d4825ec7e8353e37ac0a7098
-
C:\Users\Admin\AppData\Local\Temp\ovwid.exeFilesize
276KB
MD5a5cc35863cadeb24f827d9daa513c424
SHA10584250d8f5b06a11afbd3071547c6719adf02a4
SHA25646590fb8724e192cff8f18ccf4188f9cb2bd8661cbc1141cc15623775ad46a5c
SHA51232761ac38ab4c9b9f99bd767476b35fdecff67af8dcd678b6c449a4cebfe0c1bb040b5b8d31ba046566d2a612865709088494d90d4825ec7e8353e37ac0a7098
-
C:\Users\Admin\AppData\Local\Temp\rrsopjtftd.pFilesize
5KB
MD556286c4878d09104d3b70a79a461c288
SHA10454937ba6a485ef7893e0a37cb576e3b31c55e6
SHA2562f34ec04e1cefc4bb24065ebaacf3e607c86a9f65976d098356735b546b7c029
SHA51261944319fb9f54f948bf5e27dc3db5dfa50319a2e5ce4061490370e78b8e07796f02f153ca8ef6a72b43bef6fdcfb77940b7c175d068f2705619f29c8fd74ec1
-
C:\Users\Admin\AppData\Roaming\wordpage.exeFilesize
321KB
MD56bd52c8274a35c39740da9b52b4c7ef0
SHA10754724c922472de6048b5c5595f520f2b93e46e
SHA2567a0e92402659c86d9da6faf33be3817996718051ea564e34aa43a41606df7be6
SHA51224e3e05f7db606d1305fab3ab2cb8619cbec90afb81b1a2fafd528581fa04a04c9c3279f0cf6955f8a2e0114acfc70e29be1d10e426b1804c2b4bcb5123c52c7
-
C:\Users\Admin\AppData\Roaming\wordpage.exeFilesize
321KB
MD56bd52c8274a35c39740da9b52b4c7ef0
SHA10754724c922472de6048b5c5595f520f2b93e46e
SHA2567a0e92402659c86d9da6faf33be3817996718051ea564e34aa43a41606df7be6
SHA51224e3e05f7db606d1305fab3ab2cb8619cbec90afb81b1a2fafd528581fa04a04c9c3279f0cf6955f8a2e0114acfc70e29be1d10e426b1804c2b4bcb5123c52c7
-
\Users\Admin\AppData\Local\Temp\ovwid.exeFilesize
276KB
MD5a5cc35863cadeb24f827d9daa513c424
SHA10584250d8f5b06a11afbd3071547c6719adf02a4
SHA25646590fb8724e192cff8f18ccf4188f9cb2bd8661cbc1141cc15623775ad46a5c
SHA51232761ac38ab4c9b9f99bd767476b35fdecff67af8dcd678b6c449a4cebfe0c1bb040b5b8d31ba046566d2a612865709088494d90d4825ec7e8353e37ac0a7098
-
\Users\Admin\AppData\Local\Temp\ovwid.exeFilesize
276KB
MD5a5cc35863cadeb24f827d9daa513c424
SHA10584250d8f5b06a11afbd3071547c6719adf02a4
SHA25646590fb8724e192cff8f18ccf4188f9cb2bd8661cbc1141cc15623775ad46a5c
SHA51232761ac38ab4c9b9f99bd767476b35fdecff67af8dcd678b6c449a4cebfe0c1bb040b5b8d31ba046566d2a612865709088494d90d4825ec7e8353e37ac0a7098
-
\Users\Admin\AppData\Local\Temp\ovwid.exeFilesize
276KB
MD5a5cc35863cadeb24f827d9daa513c424
SHA10584250d8f5b06a11afbd3071547c6719adf02a4
SHA25646590fb8724e192cff8f18ccf4188f9cb2bd8661cbc1141cc15623775ad46a5c
SHA51232761ac38ab4c9b9f99bd767476b35fdecff67af8dcd678b6c449a4cebfe0c1bb040b5b8d31ba046566d2a612865709088494d90d4825ec7e8353e37ac0a7098
-
\Users\Admin\AppData\Roaming\wordpage.exeFilesize
321KB
MD56bd52c8274a35c39740da9b52b4c7ef0
SHA10754724c922472de6048b5c5595f520f2b93e46e
SHA2567a0e92402659c86d9da6faf33be3817996718051ea564e34aa43a41606df7be6
SHA51224e3e05f7db606d1305fab3ab2cb8619cbec90afb81b1a2fafd528581fa04a04c9c3279f0cf6955f8a2e0114acfc70e29be1d10e426b1804c2b4bcb5123c52c7
-
memory/688-73-0x000000000041F0B0-mapping.dmp
-
memory/688-79-0x0000000002200000-0x0000000002214000-memory.dmpFilesize
80KB
-
memory/688-83-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/688-75-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/688-76-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/688-77-0x0000000000570000-0x0000000000584000-memory.dmpFilesize
80KB
-
memory/852-67-0x0000000000000000-mapping.dmp
-
memory/1304-93-0x0000000007330000-0x000000000743C000-memory.dmpFilesize
1.0MB
-
memory/1304-92-0x0000000007330000-0x000000000743C000-memory.dmpFilesize
1.0MB
-
memory/1304-80-0x0000000006570000-0x0000000006632000-memory.dmpFilesize
776KB
-
memory/1304-78-0x0000000006200000-0x0000000006337000-memory.dmpFilesize
1.2MB
-
memory/1324-61-0x0000000000000000-mapping.dmp
-
memory/1652-87-0x00000000021C0000-0x00000000024C3000-memory.dmpFilesize
3.0MB
-
memory/1652-91-0x0000000000100000-0x000000000012F000-memory.dmpFilesize
188KB
-
memory/1652-82-0x0000000000000000-mapping.dmp
-
memory/1652-90-0x0000000000910000-0x00000000009A3000-memory.dmpFilesize
588KB
-
memory/1652-85-0x0000000000DA0000-0x0000000000DB8000-memory.dmpFilesize
96KB
-
memory/1652-86-0x0000000000100000-0x000000000012F000-memory.dmpFilesize
188KB
-
memory/1768-88-0x0000000000000000-mapping.dmp
-
memory/1808-55-0x0000000070551000-0x0000000070553000-memory.dmpFilesize
8KB
-
memory/1808-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1808-54-0x0000000072AD1000-0x0000000072AD4000-memory.dmpFilesize
12KB
-
memory/1808-57-0x0000000075511000-0x0000000075513000-memory.dmpFilesize
8KB
-
memory/1808-58-0x000000007153D000-0x0000000071548000-memory.dmpFilesize
44KB
-
memory/1808-94-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1808-95-0x000000007153D000-0x0000000071548000-memory.dmpFilesize
44KB
-
memory/1976-89-0x000007FEFBFB1000-0x000007FEFBFB3000-memory.dmpFilesize
8KB
-
memory/1976-81-0x0000000000000000-mapping.dmp