c0081717f24947f637d3f013901c2c5e1d19b3c5ef68e665c87e13ee78a6f0e1

General

Target

Nicht bestätigt 744227.docm
Size

130KB
MD5

a8287e1827650245a49f9e140a77a5f2
SHA1

740973c0252731a08e9b6a799285b682076817ed
SHA256

c0081717f24947f637d3f013901c2c5e1d19b3c5ef68e665c87e13ee78a6f0e1
SHA512

b7c4382c61b58ce7e470cdb5f4c9a8c71cf043eed623ef256b3cad9a3e40366ef23b962f40066c36f46f26e7e8b34002e601e6c8b6e8fd1338b8ed06cb5bf3d3
SSDEEP

3072:6daVVo3oyWj2FWKamB7UQFAVm3DylSsdOhROb7S:4gSo5j2sKaY7lFAVMDylS3YS

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ctrlpanel.exe

pid process

536 ctrlpanel.exe
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

ctrlpanel.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ctrlpanel = "c:\\Users\\Public" ctrlpanel.exe

pid	process
536	ctrlpanel.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ctrlpanel = "c:\\Users\\Public"	ctrlpanel.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEWINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEWINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

WINWORD.EXEWINWORD.EXE

pid process

1260 WINWORD.EXE
1260 WINWORD.EXE
3976 WINWORD.EXE

Suspicious use of SetWindowsHookEx 22 IoCs

Processes:

WINWORD.EXEWINWORD.EXE

pid	process
1260	WINWORD.EXE
1260	WINWORD.EXE
1260	WINWORD.EXE
1260	WINWORD.EXE
1260	WINWORD.EXE
3976	WINWORD.EXE
3976	WINWORD.EXE
3976	WINWORD.EXE
3976	WINWORD.EXE
3976	WINWORD.EXE
3976	WINWORD.EXE
3976	WINWORD.EXE
1260	WINWORD.EXE
1260	WINWORD.EXE
3976	WINWORD.EXE
3976	WINWORD.EXE
1260	WINWORD.EXE
1260	WINWORD.EXE
1260	WINWORD.EXE
1260	WINWORD.EXE
1260	WINWORD.EXE
1260	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 1260 wrote to memory of 536	1260	WINWORD.EXE	ctrlpanel.exe
PID 1260 wrote to memory of 536	1260	WINWORD.EXE	ctrlpanel.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Nicht bestätigt 744227.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260

\??\c:\Users\Public\ctrlpanel.exe
c:\Users\Public\ctrlpanel.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:536

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3976

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db-wal
Filesize
8KB

MD5
a0d3d5461dfe4a653128a5a5c8bf34fb

SHA1
a5f9ee6012439e3e124b35d8d82d7fd0f4e5f53b

SHA256
5764ece83279c667ffbb40001f99ad72d9054b5e7b2a07f2d040f05f5bcf8936

SHA512
ca7a895949f3644bed1bb56173a9b72bced5b3f3a3d97e214c5bde9d5ead2c4995c6e3ad9ab5ce9865be645bf7c4a070477403c00dabba0c7beb926b56ec19f6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize
3KB

MD5
90bf08717afad11eae4d101295dbfc01

SHA1
5ed449d1ac8a45decac7e6939eaa46dc15434a07

SHA256
17236f5f1df1f42a930ae1a4ed8d6058ced7941e04c605e1aacb751115dd121a

SHA512
ea3a9faeeec942b299e5ee618e6f92601f64981756b6e665ec63d6e3af1af70a331cdfddf74099ebf270ebb8e5a74780906b44ab7767f9c033850dc745962ca7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize
3KB

MD5
17d3018e6d503bf73f8b17b1f471b4bc

SHA1
86dbcd3748a1793cc77b336c5c7cccc09aa5571e

SHA256
39a4e085ad1370d7fd27ef161c6c2e7a9685d2755edfffbd50207dd13ce76caf

SHA512
d305b9db82ddcdc7403ab3f2e9536a2aa5175f6eca0609fbf1140d92d10b6ae1beede58f9618be91e68b27871d8c1d5b1fc6dacc78f7bdc57ca3788299f09ff8

Download Submit
C:\Users\Public\ctrlpanel.exe
Filesize
34KB

MD5
40d2ccd570bd898cc31af1cbfe5fb08e

SHA1
41d81d3275f8fe7be023b9731519cdf359743818

SHA256
10e720fbcf797a2f40fbaa214b3402df14b7637404e5e91d7651bd13d28a69d8

SHA512
0753eec8f21c4681559b82327c93098d2d74732df05d2304a8428dc7af0ff13d49079eacd0dc29d9b32ba5e5095cac6b9fa62a82f77e3ca3bb5986b64fe9195d

Download Submit
\??\c:\Users\Public\ctrlpanel.exe
Filesize
34KB

MD5
40d2ccd570bd898cc31af1cbfe5fb08e

SHA1
41d81d3275f8fe7be023b9731519cdf359743818

SHA256
10e720fbcf797a2f40fbaa214b3402df14b7637404e5e91d7651bd13d28a69d8

SHA512
0753eec8f21c4681559b82327c93098d2d74732df05d2304a8428dc7af0ff13d49079eacd0dc29d9b32ba5e5095cac6b9fa62a82f77e3ca3bb5986b64fe9195d

Download Submit
memory/536-335-0x0000000001340000-0x0000000001348000-memory.dmp

Filesize
32KB

Download
memory/536-333-0x000000001C8D0000-0x000000001CD9E000-memory.dmp

Filesize
4.8MB

Download
memory/536-348-0x000000001D130000-0x000000001D142000-memory.dmp

Filesize
72KB

Download
memory/536-329-0x0000000000B90000-0x0000000000BA0000-memory.dmp

Filesize
64KB

Download
memory/536-330-0x000000001BB70000-0x000000001BC58000-memory.dmp

Filesize
928KB

Download
memory/536-331-0x0000000001380000-0x0000000001390000-memory.dmp

Filesize
64KB

Download
memory/536-332-0x000000001C350000-0x000000001C3F6000-memory.dmp

Filesize
664KB

Download
memory/536-336-0x000000001D310000-0x000000001D382000-memory.dmp

Filesize
456KB

Download
memory/536-334-0x000000001CFC0000-0x000000001D05C000-memory.dmp

Filesize
624KB

Download
memory/1260-133-0x00007FFD50310000-0x00007FFD50320000-memory.dmp

Filesize
64KB

Download
memory/1260-139-0x00007FFD4DE80000-0x00007FFD4DE90000-memory.dmp

Filesize
64KB

Download
memory/1260-138-0x00007FFD4DE80000-0x00007FFD4DE90000-memory.dmp

Filesize
64KB

Download
memory/1260-137-0x00007FFD50310000-0x00007FFD50320000-memory.dmp

Filesize
64KB

Download
memory/1260-136-0x00007FFD50310000-0x00007FFD50320000-memory.dmp

Filesize
64KB

Download
memory/1260-135-0x00007FFD50310000-0x00007FFD50320000-memory.dmp

Filesize
64KB

Download
memory/1260-134-0x00007FFD50310000-0x00007FFD50320000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads