Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 09:16
Static task
static1
Behavioral task
behavioral1
Sample
RFQXPO74635.doc.rtf
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
RFQXPO74635.doc.rtf
Resource
win10v2004-20230220-en
General
-
Target
RFQXPO74635.doc.rtf
-
Size
28KB
-
MD5
9d09b6e9bf068e83c78afe33f9857c7b
-
SHA1
ad5661ad76c507cc12a402149734ea0648bfcca2
-
SHA256
90c7a131f11a2e5450a63faac63226a405fe42398f13db2e1b352a3eeba4ad2b
-
SHA512
108e7e0651a75e12acd7de6af07b7d3be459417369c0f22d97aa4e2506303e5eff0dddb19de94b41ccc6c62d05a5cbb89b33b948ea7a99283972062e9d4ff3e3
-
SSDEEP
768:awAbZSMn/Ujehmm30m6OgP8EjzVOOio5F:awAlDiwlxnDEjzriA
Malware Config
Extracted
formbook
4.1
gtt8
thesuccessbot.com
rittercivil.com
jt1.fun
d365extension.com
quqoxeq.top
visittworiverswi.com
bfprotienda.com
greenhabitsph.com
ladmere.com
clockboutiques.com
minwart.xyz
xinyuejiancai.online
eggsl.com
fetchingcandles.com
skywatiniya.com
hinkley.news
realityonlineenterprises.com
teamcroissant.com
esfera-pv.ch
herdadedosmontesbastos.com
buddhistprayers.app
talytic-one.com
capital-top.com
pawmultiverse.com
gdrop.biz
africanswers.online
amgconstruct1on.com
review.builders
findinstinct.online
leseditionsdupangolin.site
vector-sale.com
hutesmarke.shop
spacevisualmedia.com
jeweledcrown.shop
divinedivas.store
redirr.online
callifam.com
nickelinfo.com
ginghamstudio.com
launchthepodcast.com
arlisia.com
kerryshields.com
xn--o39aj5xqvflut.com
ramsgatecarwash.com
semrushfreetrails.com
rmpaclub.ru
wtpoexpo.one
amlar.xyz
downlis.top
phrasecheck.com
uk885.top
gdtrn.com
99522v.com
liftdetox2023.online
evo-omega.cloud
iccu3v.link
amd-soft1.site
containermurah.xyz
vineagency.uk
leeprintanddesign.com
bnjyjy.com
bookra-ck.com
ilyinsurance.com
texasmicroneedling.com
osmosstore.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2032-83-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2032-85-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2032-90-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/548-93-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Blocklisted process makes network request 2 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 1176 EQNEDT32.EXE 5 1176 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
atlashkei586.exeatlashkei586.exeatlashkei586.exepid process 700 atlashkei586.exe 1796 atlashkei586.exe 2032 atlashkei586.exe -
Loads dropped DLL 1 IoCs
Processes:
EQNEDT32.EXEpid process 1176 EQNEDT32.EXE -
Suspicious use of SetThreadContext 2 IoCs
Processes:
atlashkei586.exeNETSTAT.EXEdescription pid process target process PID 700 set thread context of 2032 700 atlashkei586.exe atlashkei586.exe PID 548 set thread context of 1332 548 NETSTAT.EXE Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 548 NETSTAT.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 908 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
atlashkei586.exeNETSTAT.EXEpid process 700 atlashkei586.exe 700 atlashkei586.exe 548 NETSTAT.EXE 548 NETSTAT.EXE 548 NETSTAT.EXE 548 NETSTAT.EXE 548 NETSTAT.EXE 548 NETSTAT.EXE 548 NETSTAT.EXE 548 NETSTAT.EXE 548 NETSTAT.EXE 548 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
NETSTAT.EXEpid process 548 NETSTAT.EXE 548 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
atlashkei586.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 700 atlashkei586.exe Token: SeDebugPrivilege 548 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 908 WINWORD.EXE 908 WINWORD.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
EQNEDT32.EXEWINWORD.EXEatlashkei586.exeNETSTAT.EXEdescription pid process target process PID 1176 wrote to memory of 700 1176 EQNEDT32.EXE atlashkei586.exe PID 1176 wrote to memory of 700 1176 EQNEDT32.EXE atlashkei586.exe PID 1176 wrote to memory of 700 1176 EQNEDT32.EXE atlashkei586.exe PID 1176 wrote to memory of 700 1176 EQNEDT32.EXE atlashkei586.exe PID 908 wrote to memory of 1748 908 WINWORD.EXE splwow64.exe PID 908 wrote to memory of 1748 908 WINWORD.EXE splwow64.exe PID 908 wrote to memory of 1748 908 WINWORD.EXE splwow64.exe PID 908 wrote to memory of 1748 908 WINWORD.EXE splwow64.exe PID 700 wrote to memory of 1796 700 atlashkei586.exe atlashkei586.exe PID 700 wrote to memory of 1796 700 atlashkei586.exe atlashkei586.exe PID 700 wrote to memory of 1796 700 atlashkei586.exe atlashkei586.exe PID 700 wrote to memory of 1796 700 atlashkei586.exe atlashkei586.exe PID 700 wrote to memory of 2032 700 atlashkei586.exe atlashkei586.exe PID 700 wrote to memory of 2032 700 atlashkei586.exe atlashkei586.exe PID 700 wrote to memory of 2032 700 atlashkei586.exe atlashkei586.exe PID 700 wrote to memory of 2032 700 atlashkei586.exe atlashkei586.exe PID 700 wrote to memory of 2032 700 atlashkei586.exe atlashkei586.exe PID 700 wrote to memory of 2032 700 atlashkei586.exe atlashkei586.exe PID 700 wrote to memory of 2032 700 atlashkei586.exe atlashkei586.exe PID 548 wrote to memory of 1176 548 NETSTAT.EXE cmd.exe PID 548 wrote to memory of 1176 548 NETSTAT.EXE cmd.exe PID 548 wrote to memory of 1176 548 NETSTAT.EXE cmd.exe PID 548 wrote to memory of 1176 548 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\RFQXPO74635.doc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\atlashkei586.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\atlashkei586.exe"C:\Users\Admin\AppData\Roaming\atlashkei586.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\atlashkei586.exe"C:\Users\Admin\AppData\Roaming\atlashkei586.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\atlashkei586.exe"C:\Users\Admin\AppData\Roaming\atlashkei586.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotmFilesize
20KB
MD553e3b4810fed91708798c3845a6c2a5d
SHA12952383cd3e7dc00f88a447b7876907cf1fc7667
SHA25658b9403e045c8639002b2cb54d622d0f449bb34b63da3f411b3108df019fd6bd
SHA5127ac91f197c39eff23cc8652b0513783b15e5b2ec9262de457df037adab224cf4490aaed830e53de9443a2f07878087f2d955cf1e10f7992f30f79ef813d84cb3
-
C:\Users\Admin\AppData\Roaming\atlashkei586.exeFilesize
641KB
MD5d61d2dd6df28f48ee8bd91a354f0ea75
SHA1f1b8861cc5fb41b4cba92fd56d33662a7bac5c29
SHA2566f6635f95155f37d66c295977e973d28b681fb57fc50caf361e5e13f1037008a
SHA512c2c55298203befe54ffec3215387b17d6b19e7c2a4cd9f09bf89647a40c5ea50e1411285adb4790d869354abfe9d5c15d2c2dc259d87b7ec270f29f731de7a15
-
C:\Users\Admin\AppData\Roaming\atlashkei586.exeFilesize
641KB
MD5d61d2dd6df28f48ee8bd91a354f0ea75
SHA1f1b8861cc5fb41b4cba92fd56d33662a7bac5c29
SHA2566f6635f95155f37d66c295977e973d28b681fb57fc50caf361e5e13f1037008a
SHA512c2c55298203befe54ffec3215387b17d6b19e7c2a4cd9f09bf89647a40c5ea50e1411285adb4790d869354abfe9d5c15d2c2dc259d87b7ec270f29f731de7a15
-
C:\Users\Admin\AppData\Roaming\atlashkei586.exeFilesize
641KB
MD5d61d2dd6df28f48ee8bd91a354f0ea75
SHA1f1b8861cc5fb41b4cba92fd56d33662a7bac5c29
SHA2566f6635f95155f37d66c295977e973d28b681fb57fc50caf361e5e13f1037008a
SHA512c2c55298203befe54ffec3215387b17d6b19e7c2a4cd9f09bf89647a40c5ea50e1411285adb4790d869354abfe9d5c15d2c2dc259d87b7ec270f29f731de7a15
-
C:\Users\Admin\AppData\Roaming\atlashkei586.exeFilesize
641KB
MD5d61d2dd6df28f48ee8bd91a354f0ea75
SHA1f1b8861cc5fb41b4cba92fd56d33662a7bac5c29
SHA2566f6635f95155f37d66c295977e973d28b681fb57fc50caf361e5e13f1037008a
SHA512c2c55298203befe54ffec3215387b17d6b19e7c2a4cd9f09bf89647a40c5ea50e1411285adb4790d869354abfe9d5c15d2c2dc259d87b7ec270f29f731de7a15
-
C:\Users\Admin\AppData\Roaming\atlashkei586.exeFilesize
641KB
MD5d61d2dd6df28f48ee8bd91a354f0ea75
SHA1f1b8861cc5fb41b4cba92fd56d33662a7bac5c29
SHA2566f6635f95155f37d66c295977e973d28b681fb57fc50caf361e5e13f1037008a
SHA512c2c55298203befe54ffec3215387b17d6b19e7c2a4cd9f09bf89647a40c5ea50e1411285adb4790d869354abfe9d5c15d2c2dc259d87b7ec270f29f731de7a15
-
\Users\Admin\AppData\Roaming\atlashkei586.exeFilesize
641KB
MD5d61d2dd6df28f48ee8bd91a354f0ea75
SHA1f1b8861cc5fb41b4cba92fd56d33662a7bac5c29
SHA2566f6635f95155f37d66c295977e973d28b681fb57fc50caf361e5e13f1037008a
SHA512c2c55298203befe54ffec3215387b17d6b19e7c2a4cd9f09bf89647a40c5ea50e1411285adb4790d869354abfe9d5c15d2c2dc259d87b7ec270f29f731de7a15
-
memory/548-113-0x0000000001FF0000-0x0000000002084000-memory.dmpFilesize
592KB
-
memory/548-93-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/548-92-0x0000000002170000-0x0000000002473000-memory.dmpFilesize
3.0MB
-
memory/548-91-0x0000000000450000-0x0000000000459000-memory.dmpFilesize
36KB
-
memory/700-73-0x00000000003A0000-0x00000000003B6000-memory.dmpFilesize
88KB
-
memory/700-76-0x0000000000930000-0x000000000093C000-memory.dmpFilesize
48KB
-
memory/700-67-0x0000000000970000-0x0000000000A16000-memory.dmpFilesize
664KB
-
memory/700-72-0x0000000004BD0000-0x0000000004C10000-memory.dmpFilesize
256KB
-
memory/700-75-0x0000000004BD0000-0x0000000004C10000-memory.dmpFilesize
256KB
-
memory/700-77-0x0000000005CB0000-0x0000000005D20000-memory.dmpFilesize
448KB
-
memory/700-78-0x0000000004B90000-0x0000000004BC8000-memory.dmpFilesize
224KB
-
memory/908-54-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/908-112-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1332-114-0x0000000008400000-0x0000000008544000-memory.dmpFilesize
1.3MB
-
memory/1332-115-0x0000000008400000-0x0000000008544000-memory.dmpFilesize
1.3MB
-
memory/1332-117-0x0000000008400000-0x0000000008544000-memory.dmpFilesize
1.3MB
-
memory/2032-85-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2032-90-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2032-83-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2032-80-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2032-81-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2032-82-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB