Analysis
-
max time kernel
119s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22-02-2023 10:54
Static task
static1
Behavioral task
behavioral1
Sample
TEKLİF İSTEME FORMU.rtf
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
TEKLİF İSTEME FORMU.rtf
Resource
win10v2004-20230220-en
General
-
Target
TEKLİF İSTEME FORMU.rtf
-
Size
37KB
-
MD5
ac61d636809fd4617b6fa6b5a099a38c
-
SHA1
9e3bb29de5667a90fe0df822ec27a0f4a6a012ed
-
SHA256
1fd6569eae2820afd99e6ba741c6f4c69f61004e617e9e0cccf54c4df93d6865
-
SHA512
1a18206c3b417993381c7b8bc8b4fe538022744c2890fb247c6c56b1726d22d8ec0f170197b4c925bd84ab507277067e95bae1b6403f5f371f8b9508f80c471a
-
SSDEEP
768:xFx0XaIsnPRIa4fwJMcfBPts3AjTySc2sj345ddMu8pcn:xf0Xvx3EMcfBPtmAwboY96n
Malware Config
Extracted
netwire
zekeriyasolek44.duckdns.org:3102
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
Valentine End
-
install_path
%Windows%\Windows DataPoint\Windows Data Start.exe
-
lock_executable
false
-
mutex
Windows
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 14 IoCs
Processes:
resource yara_rule behavioral1/memory/1968-82-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1968-83-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1968-84-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1968-86-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1968-89-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1968-91-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1968-97-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1616-102-0x0000000002420000-0x0000000002460000-memory.dmp netwire behavioral1/memory/268-113-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/268-114-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/268-133-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/268-134-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/268-135-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/268-136-0x0000000000400000-0x000000000044F000-memory.dmp netwire -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 2 1768 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
chungd48628.exechungd48628.exeWindows Data Start.exeWindows Data Start.exepid process 856 chungd48628.exe 1968 chungd48628.exe 1616 Windows Data Start.exe 268 Windows Data Start.exe -
Loads dropped DLL 2 IoCs
Processes:
EQNEDT32.EXEchungd48628.exepid process 1768 EQNEDT32.EXE 1968 chungd48628.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Windows Data Start.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Windows Data Start.exe Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\sžHà<¬ú°*uÆÉÝR¡ = "C:\\Windows\\SysWOW64\\%Windows\\Windows DataPoint\\Windows Data Start.exe" Windows Data Start.exe -
Drops file in System32 directory 2 IoCs
Processes:
chungd48628.exeWindows Data Start.exedescription ioc process File created C:\Windows\SysWOW64\%Windows\Windows DataPoint\Windows Data Start.exe chungd48628.exe File created C:\Windows\SysWOW64\%Windows\Windows DataPoint\Windows Data Start.exe Windows Data Start.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
chungd48628.exeWindows Data Start.exedescription pid process target process PID 856 set thread context of 1968 856 chungd48628.exe chungd48628.exe PID 1616 set thread context of 268 1616 Windows Data Start.exe Windows Data Start.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1352 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1352 WINWORD.EXE 1352 WINWORD.EXE -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
EQNEDT32.EXEWINWORD.EXEchungd48628.exechungd48628.exeWindows Data Start.exedescription pid process target process PID 1768 wrote to memory of 856 1768 EQNEDT32.EXE chungd48628.exe PID 1768 wrote to memory of 856 1768 EQNEDT32.EXE chungd48628.exe PID 1768 wrote to memory of 856 1768 EQNEDT32.EXE chungd48628.exe PID 1768 wrote to memory of 856 1768 EQNEDT32.EXE chungd48628.exe PID 1352 wrote to memory of 1000 1352 WINWORD.EXE splwow64.exe PID 1352 wrote to memory of 1000 1352 WINWORD.EXE splwow64.exe PID 1352 wrote to memory of 1000 1352 WINWORD.EXE splwow64.exe PID 1352 wrote to memory of 1000 1352 WINWORD.EXE splwow64.exe PID 856 wrote to memory of 1968 856 chungd48628.exe chungd48628.exe PID 856 wrote to memory of 1968 856 chungd48628.exe chungd48628.exe PID 856 wrote to memory of 1968 856 chungd48628.exe chungd48628.exe PID 856 wrote to memory of 1968 856 chungd48628.exe chungd48628.exe PID 856 wrote to memory of 1968 856 chungd48628.exe chungd48628.exe PID 856 wrote to memory of 1968 856 chungd48628.exe chungd48628.exe PID 856 wrote to memory of 1968 856 chungd48628.exe chungd48628.exe PID 856 wrote to memory of 1968 856 chungd48628.exe chungd48628.exe PID 856 wrote to memory of 1968 856 chungd48628.exe chungd48628.exe PID 856 wrote to memory of 1968 856 chungd48628.exe chungd48628.exe PID 856 wrote to memory of 1968 856 chungd48628.exe chungd48628.exe PID 1968 wrote to memory of 1616 1968 chungd48628.exe Windows Data Start.exe PID 1968 wrote to memory of 1616 1968 chungd48628.exe Windows Data Start.exe PID 1968 wrote to memory of 1616 1968 chungd48628.exe Windows Data Start.exe PID 1968 wrote to memory of 1616 1968 chungd48628.exe Windows Data Start.exe PID 1616 wrote to memory of 268 1616 Windows Data Start.exe Windows Data Start.exe PID 1616 wrote to memory of 268 1616 Windows Data Start.exe Windows Data Start.exe PID 1616 wrote to memory of 268 1616 Windows Data Start.exe Windows Data Start.exe PID 1616 wrote to memory of 268 1616 Windows Data Start.exe Windows Data Start.exe PID 1616 wrote to memory of 268 1616 Windows Data Start.exe Windows Data Start.exe PID 1616 wrote to memory of 268 1616 Windows Data Start.exe Windows Data Start.exe PID 1616 wrote to memory of 268 1616 Windows Data Start.exe Windows Data Start.exe PID 1616 wrote to memory of 268 1616 Windows Data Start.exe Windows Data Start.exe PID 1616 wrote to memory of 268 1616 Windows Data Start.exe Windows Data Start.exe PID 1616 wrote to memory of 268 1616 Windows Data Start.exe Windows Data Start.exe PID 1616 wrote to memory of 268 1616 Windows Data Start.exe Windows Data Start.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\TEKLİF İSTEME FORMU.rtf"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\chungd48628.exe"C:\Users\Admin\AppData\Roaming\chungd48628.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\chungd48628.exe"C:\Users\Admin\AppData\Roaming\chungd48628.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\%Windows\Windows DataPoint\Windows Data Start.exe"C:\Windows\System32\%Windows\Windows DataPoint\Windows Data Start.exe" -m "C:\Users\Admin\AppData\Roaming\chungd48628.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\%Windows\Windows DataPoint\Windows Data Start.exe"C:\Windows\SysWOW64\%Windows\Windows DataPoint\Windows Data Start.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotmFilesize
20KB
MD525e5ddb1345a59296db101e599302b1d
SHA1e568fb7a3a65aa864c0ec38b26592e5443da8574
SHA256f990befba812f35c800a090283ad497665d51151f7944a4edadfed15c06bebcb
SHA512a2f69dd00d35b0cf8ef88fa5cda5685fa3a5a744cdd20c5602e8cf0b5973c700eebf70b93f8c46a6f050ea1e99291a7ffc46ff8796df3a6245d384b5fa806cee
-
C:\Users\Admin\AppData\Roaming\chungd48628.exeFilesize
1.0MB
MD59e3dac5c792d10815c94ae9474c93aa8
SHA1da3ffcfa7c41e842ea80548105fac93252149550
SHA256e9b94cae938b5549cc9645b0e15337bc0ff894b9413305351937cf7831347d85
SHA51269fe825e8c41cdc852407eb2d396344341ceeabcec2edb0bebe269245ca305796975a88d81d557b5cde3fe84c235fb4c26bbad60541b19709ede1240387c956b
-
C:\Users\Admin\AppData\Roaming\chungd48628.exeFilesize
1.0MB
MD59e3dac5c792d10815c94ae9474c93aa8
SHA1da3ffcfa7c41e842ea80548105fac93252149550
SHA256e9b94cae938b5549cc9645b0e15337bc0ff894b9413305351937cf7831347d85
SHA51269fe825e8c41cdc852407eb2d396344341ceeabcec2edb0bebe269245ca305796975a88d81d557b5cde3fe84c235fb4c26bbad60541b19709ede1240387c956b
-
C:\Users\Admin\AppData\Roaming\chungd48628.exeFilesize
1.0MB
MD59e3dac5c792d10815c94ae9474c93aa8
SHA1da3ffcfa7c41e842ea80548105fac93252149550
SHA256e9b94cae938b5549cc9645b0e15337bc0ff894b9413305351937cf7831347d85
SHA51269fe825e8c41cdc852407eb2d396344341ceeabcec2edb0bebe269245ca305796975a88d81d557b5cde3fe84c235fb4c26bbad60541b19709ede1240387c956b
-
C:\Users\Admin\AppData\Roaming\chungd48628.exeFilesize
1.0MB
MD59e3dac5c792d10815c94ae9474c93aa8
SHA1da3ffcfa7c41e842ea80548105fac93252149550
SHA256e9b94cae938b5549cc9645b0e15337bc0ff894b9413305351937cf7831347d85
SHA51269fe825e8c41cdc852407eb2d396344341ceeabcec2edb0bebe269245ca305796975a88d81d557b5cde3fe84c235fb4c26bbad60541b19709ede1240387c956b
-
C:\Windows\SysWOW64\%Windows\Windows DataPoint\Windows Data Start.exeFilesize
1.0MB
MD59e3dac5c792d10815c94ae9474c93aa8
SHA1da3ffcfa7c41e842ea80548105fac93252149550
SHA256e9b94cae938b5549cc9645b0e15337bc0ff894b9413305351937cf7831347d85
SHA51269fe825e8c41cdc852407eb2d396344341ceeabcec2edb0bebe269245ca305796975a88d81d557b5cde3fe84c235fb4c26bbad60541b19709ede1240387c956b
-
C:\Windows\SysWOW64\%Windows\Windows DataPoint\Windows Data Start.exeFilesize
1.0MB
MD59e3dac5c792d10815c94ae9474c93aa8
SHA1da3ffcfa7c41e842ea80548105fac93252149550
SHA256e9b94cae938b5549cc9645b0e15337bc0ff894b9413305351937cf7831347d85
SHA51269fe825e8c41cdc852407eb2d396344341ceeabcec2edb0bebe269245ca305796975a88d81d557b5cde3fe84c235fb4c26bbad60541b19709ede1240387c956b
-
C:\Windows\SysWOW64\%Windows\Windows DataPoint\Windows Data Start.exeFilesize
1.0MB
MD59e3dac5c792d10815c94ae9474c93aa8
SHA1da3ffcfa7c41e842ea80548105fac93252149550
SHA256e9b94cae938b5549cc9645b0e15337bc0ff894b9413305351937cf7831347d85
SHA51269fe825e8c41cdc852407eb2d396344341ceeabcec2edb0bebe269245ca305796975a88d81d557b5cde3fe84c235fb4c26bbad60541b19709ede1240387c956b
-
\Users\Admin\AppData\Roaming\chungd48628.exeFilesize
1.0MB
MD59e3dac5c792d10815c94ae9474c93aa8
SHA1da3ffcfa7c41e842ea80548105fac93252149550
SHA256e9b94cae938b5549cc9645b0e15337bc0ff894b9413305351937cf7831347d85
SHA51269fe825e8c41cdc852407eb2d396344341ceeabcec2edb0bebe269245ca305796975a88d81d557b5cde3fe84c235fb4c26bbad60541b19709ede1240387c956b
-
\Windows\SysWOW64\%Windows\Windows DataPoint\Windows Data Start.exeFilesize
1.0MB
MD59e3dac5c792d10815c94ae9474c93aa8
SHA1da3ffcfa7c41e842ea80548105fac93252149550
SHA256e9b94cae938b5549cc9645b0e15337bc0ff894b9413305351937cf7831347d85
SHA51269fe825e8c41cdc852407eb2d396344341ceeabcec2edb0bebe269245ca305796975a88d81d557b5cde3fe84c235fb4c26bbad60541b19709ede1240387c956b
-
memory/268-135-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/268-134-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/268-133-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/268-136-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/268-114-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/268-113-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/268-109-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/856-77-0x0000000007F20000-0x0000000007FF2000-memory.dmpFilesize
840KB
-
memory/856-78-0x00000000043C0000-0x000000000440C000-memory.dmpFilesize
304KB
-
memory/856-67-0x0000000000DA0000-0x0000000000EB2000-memory.dmpFilesize
1.1MB
-
memory/856-72-0x0000000000D40000-0x0000000000D80000-memory.dmpFilesize
256KB
-
memory/856-73-0x0000000000750000-0x0000000000764000-memory.dmpFilesize
80KB
-
memory/856-74-0x0000000000D40000-0x0000000000D80000-memory.dmpFilesize
256KB
-
memory/856-76-0x0000000000780000-0x000000000078C000-memory.dmpFilesize
48KB
-
memory/1352-132-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1352-54-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1616-99-0x0000000000B80000-0x0000000000C92000-memory.dmpFilesize
1.1MB
-
memory/1616-102-0x0000000002420000-0x0000000002460000-memory.dmpFilesize
256KB
-
memory/1616-100-0x0000000000250000-0x0000000000264000-memory.dmpFilesize
80KB
-
memory/1616-101-0x0000000002420000-0x0000000002460000-memory.dmpFilesize
256KB
-
memory/1968-81-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1968-80-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1968-79-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1968-85-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1968-97-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1968-82-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1968-83-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1968-91-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1968-89-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1968-84-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1968-86-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB