Analysis
-
max time kernel
186s -
max time network
234s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
16-01-2023 15:18
Static task
static1
Behavioral task
behavioral1
Sample
P.I 99220345.docx
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
P.I 99220345.docx
Resource
win10v2004-20220812-en
General
-
Target
P.I 99220345.docx
-
Size
10KB
-
MD5
28d506098937d7ddaf58805011f8d45d
-
SHA1
24229cc8d80884084c1addb04c65681c9233dad0
-
SHA256
4b67a9ddf9fc9d3df0b158bdae523144c329080a0e949a71584b7339b204e5c5
-
SHA512
cf5e2af854adec3a6657e2fac63aefaa8484a30fbe78e074760bc54a00aec4046724fad6b8c03ab87e2675e6476130138582b64c722e5737d97946653c46e5ef
-
SSDEEP
192:ScIMmtP8ar5G/bfIdTOpULnamWBX8ex6y3PWFl:SPXt4ATOqLnosM+D
Malware Config
Extracted
lokibot
https://sempersim.su/ha1/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 8 976 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
vbc.exedpgvxmdtum.exedpgvxmdtum.exepid process 868 vbc.exe 2028 dpgvxmdtum.exe 1752 dpgvxmdtum.exe -
Abuses OpenXML format to download file from external location 2 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\14.0\Common WINWORD.EXE Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\Common\Offline\Files\http://392097655/_--00_o______---00o0_00-o_o0-__________o0o-__________/jpooofggjdfjghjfdggsahfhfghf.doc WINWORD.EXE -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEvbc.exedpgvxmdtum.exepid process 976 EQNEDT32.EXE 868 vbc.exe 868 vbc.exe 2028 dpgvxmdtum.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
dpgvxmdtum.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dpgvxmdtum.exe Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook dpgvxmdtum.exe Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook dpgvxmdtum.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
dpgvxmdtum.exedescription pid process target process PID 2028 set thread context of 1752 2028 dpgvxmdtum.exe dpgvxmdtum.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1496 WINWORD.EXE -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
dpgvxmdtum.exepid process 2028 dpgvxmdtum.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
dpgvxmdtum.exeWINWORD.EXEdescription pid process Token: SeDebugPrivilege 1752 dpgvxmdtum.exe Token: SeShutdownPrivilege 1496 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1496 WINWORD.EXE 1496 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
EQNEDT32.EXEvbc.exedpgvxmdtum.exeWINWORD.EXEdescription pid process target process PID 976 wrote to memory of 868 976 EQNEDT32.EXE vbc.exe PID 976 wrote to memory of 868 976 EQNEDT32.EXE vbc.exe PID 976 wrote to memory of 868 976 EQNEDT32.EXE vbc.exe PID 976 wrote to memory of 868 976 EQNEDT32.EXE vbc.exe PID 868 wrote to memory of 2028 868 vbc.exe dpgvxmdtum.exe PID 868 wrote to memory of 2028 868 vbc.exe dpgvxmdtum.exe PID 868 wrote to memory of 2028 868 vbc.exe dpgvxmdtum.exe PID 868 wrote to memory of 2028 868 vbc.exe dpgvxmdtum.exe PID 2028 wrote to memory of 1752 2028 dpgvxmdtum.exe dpgvxmdtum.exe PID 2028 wrote to memory of 1752 2028 dpgvxmdtum.exe dpgvxmdtum.exe PID 2028 wrote to memory of 1752 2028 dpgvxmdtum.exe dpgvxmdtum.exe PID 2028 wrote to memory of 1752 2028 dpgvxmdtum.exe dpgvxmdtum.exe PID 2028 wrote to memory of 1752 2028 dpgvxmdtum.exe dpgvxmdtum.exe PID 1496 wrote to memory of 1380 1496 WINWORD.EXE splwow64.exe PID 1496 wrote to memory of 1380 1496 WINWORD.EXE splwow64.exe PID 1496 wrote to memory of 1380 1496 WINWORD.EXE splwow64.exe PID 1496 wrote to memory of 1380 1496 WINWORD.EXE splwow64.exe -
outlook_office_path 1 IoCs
Processes:
dpgvxmdtum.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook dpgvxmdtum.exe -
outlook_win_path 1 IoCs
Processes:
dpgvxmdtum.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dpgvxmdtum.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\P.I 99220345.docx"1⤵
- Abuses OpenXML format to download file from external location
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1380
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exe"C:\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exe" C:\Users\Admin\AppData\Local\Temp\feiewqxkkjf.osb3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exe"C:\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exe"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1752
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exeFilesize
53KB
MD57161a61f688e63fb69df4767de016a43
SHA1f23558f27c54f967b0519ccf8e6085cf12cf43e2
SHA2565d99cd5ff1a6c8d9183cc7132e171bd5b35d0a0abd96947226e8c187277323cd
SHA51290768522122136e8788465bae7973c13d022c1ff104271dccee66ddd478ea4460cce4b3febc63d6efad38780b7f4c7a3b3048a434c6354d42b1e6eba28f7e68c
-
C:\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exeFilesize
53KB
MD57161a61f688e63fb69df4767de016a43
SHA1f23558f27c54f967b0519ccf8e6085cf12cf43e2
SHA2565d99cd5ff1a6c8d9183cc7132e171bd5b35d0a0abd96947226e8c187277323cd
SHA51290768522122136e8788465bae7973c13d022c1ff104271dccee66ddd478ea4460cce4b3febc63d6efad38780b7f4c7a3b3048a434c6354d42b1e6eba28f7e68c
-
C:\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exeFilesize
53KB
MD57161a61f688e63fb69df4767de016a43
SHA1f23558f27c54f967b0519ccf8e6085cf12cf43e2
SHA2565d99cd5ff1a6c8d9183cc7132e171bd5b35d0a0abd96947226e8c187277323cd
SHA51290768522122136e8788465bae7973c13d022c1ff104271dccee66ddd478ea4460cce4b3febc63d6efad38780b7f4c7a3b3048a434c6354d42b1e6eba28f7e68c
-
C:\Users\Admin\AppData\Local\Temp\dvhldofr.llaFilesize
124KB
MD53d4a6f79291d3875db38ee4294a5ff94
SHA13bade4e8c0b0000b6f61b7f569f03f85775a13ce
SHA2565aadeb18553e1c5518cb4722652bc46d2a1ce48b9fa1bc98f0d367dec6aaa842
SHA5125789b8a8da6ae3c130dd2768c3307e05272eb4f8913f48cb4548ac65a1171a3e8cdc25d54fefa5eec62bf0adaa30a716718aa9849bbe8fa18c6922dfe6d1255b
-
C:\Users\Admin\AppData\Local\Temp\feiewqxkkjf.osbFilesize
5KB
MD5530c3bfc50912d630e557662e70a7b7d
SHA1e5c58863693d12cb6f5c6cf8918ca65c7db92e24
SHA2569dc0d8295b0154b6a2382fbb3d8558662b4674501784cdbf3b1bebde54756ffa
SHA51280ff35d9122e8d667a96efbfe10faefe5518935094475a0510c417f016e464af2e42edb077aaf0d57c6fd9b40d30df28df0d1f29aec2c5e8ec6aed3dd5b30b1e
-
C:\Users\Public\vbc.exeFilesize
344KB
MD5419d97afbdef4d3bbdfed37cf2522cc1
SHA1da5890bca82bbdaaa771426f64bb888c7ab2479d
SHA256c60e5978dd457e4e51c9df1d33c844aaab32a873aec48372adb988ca9647cd9b
SHA512e70a5466d76308ebd20aba1149e07250561fc36bf823847d80c3629fd84b8a8c2c321a62bc23d5972e15b11db397d314923940945d956c5ceaf95f55c07db66b
-
C:\Users\Public\vbc.exeFilesize
344KB
MD5419d97afbdef4d3bbdfed37cf2522cc1
SHA1da5890bca82bbdaaa771426f64bb888c7ab2479d
SHA256c60e5978dd457e4e51c9df1d33c844aaab32a873aec48372adb988ca9647cd9b
SHA512e70a5466d76308ebd20aba1149e07250561fc36bf823847d80c3629fd84b8a8c2c321a62bc23d5972e15b11db397d314923940945d956c5ceaf95f55c07db66b
-
\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exeFilesize
53KB
MD57161a61f688e63fb69df4767de016a43
SHA1f23558f27c54f967b0519ccf8e6085cf12cf43e2
SHA2565d99cd5ff1a6c8d9183cc7132e171bd5b35d0a0abd96947226e8c187277323cd
SHA51290768522122136e8788465bae7973c13d022c1ff104271dccee66ddd478ea4460cce4b3febc63d6efad38780b7f4c7a3b3048a434c6354d42b1e6eba28f7e68c
-
\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exeFilesize
53KB
MD57161a61f688e63fb69df4767de016a43
SHA1f23558f27c54f967b0519ccf8e6085cf12cf43e2
SHA2565d99cd5ff1a6c8d9183cc7132e171bd5b35d0a0abd96947226e8c187277323cd
SHA51290768522122136e8788465bae7973c13d022c1ff104271dccee66ddd478ea4460cce4b3febc63d6efad38780b7f4c7a3b3048a434c6354d42b1e6eba28f7e68c
-
\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exeFilesize
53KB
MD57161a61f688e63fb69df4767de016a43
SHA1f23558f27c54f967b0519ccf8e6085cf12cf43e2
SHA2565d99cd5ff1a6c8d9183cc7132e171bd5b35d0a0abd96947226e8c187277323cd
SHA51290768522122136e8788465bae7973c13d022c1ff104271dccee66ddd478ea4460cce4b3febc63d6efad38780b7f4c7a3b3048a434c6354d42b1e6eba28f7e68c
-
\Users\Public\vbc.exeFilesize
344KB
MD5419d97afbdef4d3bbdfed37cf2522cc1
SHA1da5890bca82bbdaaa771426f64bb888c7ab2479d
SHA256c60e5978dd457e4e51c9df1d33c844aaab32a873aec48372adb988ca9647cd9b
SHA512e70a5466d76308ebd20aba1149e07250561fc36bf823847d80c3629fd84b8a8c2c321a62bc23d5972e15b11db397d314923940945d956c5ceaf95f55c07db66b
-
memory/868-62-0x0000000000000000-mapping.dmp
-
memory/1380-80-0x000007FEFBCD1000-0x000007FEFBCD3000-memory.dmpFilesize
8KB
-
memory/1380-79-0x0000000000000000-mapping.dmp
-
memory/1496-54-0x00000000727C1000-0x00000000727C4000-memory.dmpFilesize
12KB
-
memory/1496-55-0x0000000070241000-0x0000000070243000-memory.dmpFilesize
8KB
-
memory/1496-83-0x000000007122D000-0x0000000071238000-memory.dmpFilesize
44KB
-
memory/1496-57-0x00000000761F1000-0x00000000761F3000-memory.dmpFilesize
8KB
-
memory/1496-59-0x000000007122D000-0x0000000071238000-memory.dmpFilesize
44KB
-
memory/1496-58-0x000000007122D000-0x0000000071238000-memory.dmpFilesize
44KB
-
memory/1496-82-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1496-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1752-81-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1752-75-0x00000000004139DE-mapping.dmp
-
memory/1752-78-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2028-68-0x0000000000000000-mapping.dmp