agenttesla | d037a0f1a4ce8bd5b3ef41f8f1efbf445bba229cd61502d0f47e4078f7d64fb4

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01-12-2023 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d037a0f1a4ce8bd5b3ef41f8f1efbf445bba229cd61502d0f47e4078f7d64fb4.docx
Size

16KB
MD5

c6d1103403667550402d92301a0dbe62
SHA1

106f1b0488f98debf7599f602278185ffebd7a11
SHA256

d037a0f1a4ce8bd5b3ef41f8f1efbf445bba229cd61502d0f47e4078f7d64fb4
SHA512

9094dcb1148347c39a240d033f5b78fc92ca072b21eb53c40954323d7e00a686b5ed145dac13ef51af5334f98bfc27913213ad250c697e31fae29abdda0fd96a
SSDEEP

384:ayXPNKVWWs8PL8wi4OEwH8TIbE91r2fRSJY5vim/Y1nz3:acP+55P3DOqnYJMMv//Y1nb

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.royalwealth.space
Port:
587
Username:
[email protected]
Password:
sQxM4AdAZ5kY7As
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

10 2244 EQNEDT32.EXE
Downloads MZ/PE file
Abuses OpenXML format to download file from external location
Executes dropped EXE 2 IoCs

Processes:

wealth68399.exewealth68399.exe

pid process

812 wealth68399.exe
1980 wealth68399.exe
Loads dropped DLL 1 IoCs

Processes:

EQNEDT32.EXE

pid process

2244 EQNEDT32.EXE
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

wealth68399.exe

description pid process target process

PID 812 set thread context of 1980 812 wealth68399.exe wealth68399.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

2244 EQNEDT32.EXE

flow	pid	process
10	2244	EQNEDT32.EXE

pid	process
812	wealth68399.exe
1980	wealth68399.exe

pid	process
2244	EQNEDT32.EXE

description	pid	process	target process
PID 812 set thread context of 1980	812	wealth68399.exe	wealth68399.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
2244	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

2224 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

wealth68399.exe

pid process

1980 wealth68399.exe
1980 wealth68399.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

wealth68399.exeWINWORD.EXE

description pid process

Token: SeDebugPrivilege 1980 wealth68399.exe
Token: SeShutdownPrivilege 2224 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

2224 WINWORD.EXE
2224 WINWORD.EXE

pid	process
2224	WINWORD.EXE

pid	process
1980	wealth68399.exe
1980	wealth68399.exe

description	pid	process
Token: SeDebugPrivilege	1980	wealth68399.exe
Token: SeShutdownPrivilege	2224	WINWORD.EXE

pid	process
2224	WINWORD.EXE
2224	WINWORD.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

EQNEDT32.EXEwealth68399.exeWINWORD.EXE

description	pid	process	target process
PID 2244 wrote to memory of 812	2244	EQNEDT32.EXE	wealth68399.exe
PID 2244 wrote to memory of 812	2244	EQNEDT32.EXE	wealth68399.exe
PID 2244 wrote to memory of 812	2244	EQNEDT32.EXE	wealth68399.exe
PID 2244 wrote to memory of 812	2244	EQNEDT32.EXE	wealth68399.exe
PID 812 wrote to memory of 1980	812	wealth68399.exe	wealth68399.exe
PID 812 wrote to memory of 1980	812	wealth68399.exe	wealth68399.exe
PID 812 wrote to memory of 1980	812	wealth68399.exe	wealth68399.exe
PID 812 wrote to memory of 1980	812	wealth68399.exe	wealth68399.exe
PID 812 wrote to memory of 1980	812	wealth68399.exe	wealth68399.exe
PID 812 wrote to memory of 1980	812	wealth68399.exe	wealth68399.exe
PID 812 wrote to memory of 1980	812	wealth68399.exe	wealth68399.exe
PID 812 wrote to memory of 1980	812	wealth68399.exe	wealth68399.exe
PID 812 wrote to memory of 1980	812	wealth68399.exe	wealth68399.exe
PID 2224 wrote to memory of 2316	2224	WINWORD.EXE	splwow64.exe
PID 2224 wrote to memory of 2316	2224	WINWORD.EXE	splwow64.exe
PID 2224 wrote to memory of 2316	2224	WINWORD.EXE	splwow64.exe
PID 2224 wrote to memory of 2316	2224	WINWORD.EXE	splwow64.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d037a0f1a4ce8bd5b3ef41f8f1efbf445bba229cd61502d0f47e4078f7d64fb4.docx"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:2316

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:2244

C:\Users\Admin\AppData\Roaming\wealth68399.exe
"C:\Users\Admin\AppData\Roaming\wealth68399.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:812

C:\Users\Admin\AppData\Roaming\wealth68399.exe
"C:\Users\Admin\AppData\Roaming\wealth68399.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Exploitation for Client Execution

T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{9C3E9EDF-7E06-4D56-9F51-1F22FEB7CCC6}.FSD

Filesize
128KB

MD5
f70f0890502a27cbe7b7856d40b76a99

SHA1
84c969420e4909e7fd8d337465f0fbafd94d0ecd

SHA256
64f5b31c3fa09cf0e4f9f9987b4e17a1db1b9f8d4c8e8ef9346cdab3eee5462f

SHA512
7ea5270bf9466ce410c3a7a8d6ccb5d786672a80e203b6969cd6dd3b460aa39359fa5fb6bbcb6a605a77993cae0a4c4865419e32b9caba2d97634ba83fc521b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{9C3E9EDF-7E06-4D56-9F51-1F22FEB7CCC6}.FSD

Filesize
128KB

MD5
5e31fce83e308edb8c47ccaa85cc0843

SHA1
29302dfd1640e13b36ca49393432c3af641d0a8c

SHA256
eca00e2b8a4afe7ca0ac0ac20817b4e13687000bf91ec55414dcae34ee071711

SHA512
c9b65543ceeb69d1fb381ca2e4fb60a0f0391788d8fc543581bd551dbaf3e158829e93a03bb53361e8653b731d801a0a5a690c4f83bf77277643092c4068edbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

Filesize
128KB

MD5
56e5f2c495d4cc7c76115d48799a9876

SHA1
5142c36a71819e19a8f7a523ba859aa0a46d8424

SHA256
7b1aafe1054986a4f8c4482f19f3a5db47de83896bea275803ff616fddf9b575

SHA512
c30fdeb2f60f31cdb7accd15cb8a62195393083f8aabbfd634771c7275bc63dc147a50dcfe8ff80f7540e7e4ab49652fb8c0686ba727fecee5ab3802dc3e1339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{62294F4E-E570-4812-BF59-64F20C0DDA3B}.FSD

Filesize
128KB

MD5
d0f65d00dcf6bf445af6a5c15cebf133

SHA1
e706991355fcc39affb8bad3745c6ee0d0cf0684

SHA256
c834f306fcb851919b47dad35a8ae9f3e6d8791ccd8a67af81c4d0e788e21d11

SHA512
4aca6e79d9a2e5bfc2e60edcfc36f7a74aaff97682aa078635e44ce58ce0edb079a017ab09afd4699eb37efa7a2884a0c1de5d722c7e4ab35d62559e0d409efb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HYJJYCDH\wealthzx[1].doc

Filesize
141KB

MD5
5bb5392ff71e2d8ae392f6149170a525

SHA1
433d9215f077d6b25da8b2495144e7cea1e094d7

SHA256
d621391686684860304b22b66c5acea407a93a6dc10b0373b26b0ddc46170b2c

SHA512
a01541f80e368480a74df787ebb24999e961f940b7e8294b7484967128f78ddc43180b5cf86051ff4e1535871109b9743c00eafbe39f3c06e000a5e16ff6e24b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{E24AFEF2-E273-47D0-97DB-97EF0CDF00C3}

Filesize
128KB

MD5
aa6048d2b068059f9de09b2f99870bdb

SHA1
97ce795793233c225f27fc5580d1c4890c269b61

SHA256
38f94e59945f4648797df4deb945b25a1646b735af0695087dd71af6a14ba2f4

SHA512
4cfde962d08eb52110ab0522f3a0601eb63503443d34e28aeb2b00b722dbfd48ba25fb889780d12623012876f0f9a834fee88f51fccc774d19c44a83b208c8c7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
20KB

MD5
cb14b3020bc58869be8af8c619fdb1ae

SHA1
b2da194cccda2f55ee935eab45ae98d54ceadab3

SHA256
87f6aca6ce4677e31d8a546f0f8742e8953be11b31992f35d6c0418385883a42

SHA512
5668db61dc9b5c2fa77a30db6fca3cab063a3d54bd0f4085612208ed6c1ee7b6cf3b576fee989eed51539f2578cc0bcb6b0f74821d4d9545b9125230f146a6fc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\wealth68399.exe

Filesize
716KB

MD5
da1d7932229b720f188bb1586de920db

SHA1
82028dd1c32fafee8ea4351a108b2d1f29cedd33

SHA256
5ed580a1aa1981a142791f7f00f62dcb95643e30188ca4852391c34ce658060d

SHA512
6cfd7bcc452055620d7ca1c759cd2b2a5b28f2cf50f5663157bed403eeba62b994408b5846adcb82b58d2a843692b3dea83de7a8e20c31fab03a4099b48c999c

Download Submit
C:\Users\Admin\AppData\Roaming\wealth68399.exe

Filesize
716KB

MD5
da1d7932229b720f188bb1586de920db

SHA1
82028dd1c32fafee8ea4351a108b2d1f29cedd33

SHA256
5ed580a1aa1981a142791f7f00f62dcb95643e30188ca4852391c34ce658060d

SHA512
6cfd7bcc452055620d7ca1c759cd2b2a5b28f2cf50f5663157bed403eeba62b994408b5846adcb82b58d2a843692b3dea83de7a8e20c31fab03a4099b48c999c

Download Submit
C:\Users\Admin\AppData\Roaming\wealth68399.exe

Filesize
716KB

MD5
da1d7932229b720f188bb1586de920db

SHA1
82028dd1c32fafee8ea4351a108b2d1f29cedd33

SHA256
5ed580a1aa1981a142791f7f00f62dcb95643e30188ca4852391c34ce658060d

SHA512
6cfd7bcc452055620d7ca1c759cd2b2a5b28f2cf50f5663157bed403eeba62b994408b5846adcb82b58d2a843692b3dea83de7a8e20c31fab03a4099b48c999c

Download Submit
C:\Users\Admin\AppData\Roaming\wealth68399.exe

Filesize
716KB

MD5
da1d7932229b720f188bb1586de920db

SHA1
82028dd1c32fafee8ea4351a108b2d1f29cedd33

SHA256
5ed580a1aa1981a142791f7f00f62dcb95643e30188ca4852391c34ce658060d

SHA512
6cfd7bcc452055620d7ca1c759cd2b2a5b28f2cf50f5663157bed403eeba62b994408b5846adcb82b58d2a843692b3dea83de7a8e20c31fab03a4099b48c999c

Download Submit
\Users\Admin\AppData\Roaming\wealth68399.exe

Filesize
716KB

MD5
da1d7932229b720f188bb1586de920db

SHA1
82028dd1c32fafee8ea4351a108b2d1f29cedd33

SHA256
5ed580a1aa1981a142791f7f00f62dcb95643e30188ca4852391c34ce658060d

SHA512
6cfd7bcc452055620d7ca1c759cd2b2a5b28f2cf50f5663157bed403eeba62b994408b5846adcb82b58d2a843692b3dea83de7a8e20c31fab03a4099b48c999c

Download Submit
memory/812-116-0x0000000005D20000-0x0000000005D9A000-memory.dmp

Filesize
488KB

Download
memory/812-95-0x0000000000AD0000-0x0000000000B8A000-memory.dmp

Filesize
744KB

Download
memory/812-96-0x000000006B150000-0x000000006B83E000-memory.dmp

Filesize
6.9MB

Download
memory/812-98-0x0000000004B50000-0x0000000004B90000-memory.dmp

Filesize
256KB

Download
memory/812-103-0x0000000000210000-0x0000000000226000-memory.dmp

Filesize
88KB

Download
memory/812-129-0x000000006B150000-0x000000006B83E000-memory.dmp

Filesize
6.9MB

Download
memory/812-114-0x00000000002F0000-0x00000000002F8000-memory.dmp

Filesize
32KB

Download
memory/812-115-0x0000000000300000-0x000000000030A000-memory.dmp

Filesize
40KB

Download
memory/1980-123-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1980-126-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1980-120-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1980-121-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1980-119-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1980-118-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1980-133-0x000000006B150000-0x000000006B83E000-memory.dmp

Filesize
6.9MB

Download
memory/1980-128-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1980-131-0x0000000004B90000-0x0000000004BD0000-memory.dmp

Filesize
256KB

Download
memory/1980-117-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1980-130-0x000000006B150000-0x000000006B83E000-memory.dmp

Filesize
6.9MB

Download
memory/2224-2-0x000000007171D000-0x0000000071728000-memory.dmp

Filesize
44KB

Download
memory/2224-113-0x000000007171D000-0x0000000071728000-memory.dmp

Filesize
44KB

Download
memory/2224-0-0x000000002F391000-0x000000002F392000-memory.dmp

Filesize
4KB

Download
memory/2224-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2224-157-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2224-158-0x000000007171D000-0x0000000071728000-memory.dmp

Filesize
44KB

Download