78632bbb0a21acb272a6238c54434b3df1e89bf95104a2ea6f0a7c880acf0d13

General

Target

file.one
Size

172KB
MD5

e4780cca4c2ab22c55c01d36b620c955
SHA1

68606cfce4bc962afbe22606c7ba6c4c87430983
SHA256

78632bbb0a21acb272a6238c54434b3df1e89bf95104a2ea6f0a7c880acf0d13
SHA512

a9f052c62b7d253e318f9da11e4f7605d1aeff0cd520ebe27ebff1134906b01facea23e13ea3e5b95f17112bcd2d6f32c7ec2bbbf962832b73e5b5f8f4cdce54
SSDEEP

3072:iaA0YRw9/WITtTWR7IbNzvL1aCbYCuWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCCG:Ia9xytedL13Ew4iERB/

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1204	ONENOTE.EXE

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk	ONENOTE.EXE

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE	ONENOTE.EXE
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE	ONENOTE.EXE
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE	ONENOTE.EXE
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE	ONENOTE.EXE
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE	ONENOTE.EXE

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	ONENOTE.EXE

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar	ONENOTE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	ONENOTE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	ONENOTE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	ONENOTE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	ONENOTE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt	ONENOTE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	ONENOTE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	ONENOTE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	ONENOTE.EXE

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2E1511D-502D-4BD0-8B3A-8A89A05CDCAE}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	ONENOTE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2E1511D-502D-4BD0-8B3A-8A89A05CDCAE}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	ONENOTE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F2A7EE29-8BF6-4A6D-83F1-098E366C709C}\1.0\ = "Microsoft OneNote 12.0 Object Library"	ONENOTE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F2A7EE29-8BF6-4A6D-83F1-098E366C709C}\1.0\0\win32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\ONENOTE.EXE\\2"	ONENOTE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EA692EE-BB50-4E3C-AEF0-356D91732725}\1.0\ = "Microsoft OneNote 14.0 Object Library"	ONENOTE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EA692EE-BB50-4E3C-AEF0-356D91732725}\1.0\0\win32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\ONENOTE.EXE\\3"	ONENOTE.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1204	ONENOTE.EXE
1204	ONENOTE.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1204	ONENOTE.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1012	ONENOTEM.EXE
Token: SeIncBasePriorityPrivilege	1012	ONENOTEM.EXE
Token: 33	1204	ONENOTE.EXE
Token: SeIncBasePriorityPrivilege	1204	ONENOTE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1012	ONENOTEM.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1012	ONENOTEM.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1204	ONENOTE.EXE
1204	ONENOTE.EXE
1204	ONENOTE.EXE
1204	ONENOTE.EXE
1204	ONENOTE.EXE
1204	ONENOTE.EXE
1204	ONENOTE.EXE
1204	ONENOTE.EXE
1204	ONENOTE.EXE
1204	ONENOTE.EXE
1204	ONENOTE.EXE
1204	ONENOTE.EXE
1204	ONENOTE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1012	1204	ONENOTE.EXE	31
PID 1204 wrote to memory of 1012	1204	ONENOTE.EXE	31
PID 1204 wrote to memory of 1012	1204	ONENOTE.EXE	31
PID 1204 wrote to memory of 1012	1204	ONENOTE.EXE	31
PID 1204 wrote to memory of 1132	1204	ONENOTE.EXE	33
PID 1204 wrote to memory of 1132	1204	ONENOTE.EXE	33
PID 1204 wrote to memory of 1132	1204	ONENOTE.EXE	33
PID 1204 wrote to memory of 1132	1204	ONENOTE.EXE	33
PID 1204 wrote to memory of 1688	1204	ONENOTE.EXE	34
PID 1204 wrote to memory of 1688	1204	ONENOTE.EXE	34
PID 1204 wrote to memory of 1688	1204	ONENOTE.EXE	34
PID 1204 wrote to memory of 1688	1204	ONENOTE.EXE	34

C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE" "C:\Users\Admin\AppData\Local\Temp\file.one"
1⤵
- Deletes itself
- Drops startup file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
  /tsr
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1012
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\OneNote\14.0\NT\0\Open.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:1132
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\OneNote\14.0\NT\1\Open.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:1688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OneNote\14.0\NT\0\Open.hta

Filesize
2KB

MD5
6728239fc3b4aba373181331259fa004

SHA1
12aacf24f4ba2f405b1e4c93d33aab205ba3d8fa

SHA256
fbda1d961cf1b73f9db4158806ea6a2e7b61ed000e60084b56909d849aeddf82

SHA512
2c69e4c6d812c8c8e77247acfe09621dcc46cf7a925553defa1bc9da35d343d8c8e5c6c028711d4be3c07b43b2a3b98188ca27d6051aae7b6d35a4d2c942e602

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneNote\14.0\NT\1\Open.hta

Filesize
2KB

MD5
6728239fc3b4aba373181331259fa004

SHA1
12aacf24f4ba2f405b1e4c93d33aab205ba3d8fa

SHA256
fbda1d961cf1b73f9db4158806ea6a2e7b61ed000e60084b56909d849aeddf82

SHA512
2c69e4c6d812c8c8e77247acfe09621dcc46cf7a925553defa1bc9da35d343d8c8e5c6c028711d4be3c07b43b2a3b98188ca27d6051aae7b6d35a4d2c942e602

Download Submit
memory/1204-54-0x00000000721E1000-0x00000000721E3000-memory.dmp

Filesize
8KB

Download
memory/1204-55-0x00000000731CD000-0x00000000731D8000-memory.dmp

Filesize
44KB

Download
memory/1204-56-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download
memory/1204-59-0x00000000731CD000-0x00000000731D8000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing