15b306d80a29d3298c257222d1284779122457122bb95ecfb3e9f67dd3de92cf

General

Target

4ad1eb927d9df8338fa4e38441bba80a.exe
Size

2.0MB
MD5

4ad1eb927d9df8338fa4e38441bba80a
SHA1

82872bc4556d3e61f0f6cd03c9ab2bea017012ea
SHA256

15b306d80a29d3298c257222d1284779122457122bb95ecfb3e9f67dd3de92cf
SHA512

afb92e7c5e0136b86f0b5e85348e5ddc8c2298cc55ac006f6e4be7940fd23466081fea341bf6c2507dc7bfb24b36b8f878ccbaa99da40598f1700b62af505d1f
SSDEEP

49152:OFUcx88PWPOpX0SF98ExENhmNrG0V4laAsyGc:O+K88uPCH38mEXmNa0V4lAyGc

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1976	4309.tmp

Loads dropped DLL 1 IoCs

pid	Process
1984	4ad1eb927d9df8338fa4e38441bba80a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1556	WINWORD.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1976	4309.tmp

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1556	WINWORD.EXE
1556	WINWORD.EXE
1556	WINWORD.EXE
1556	WINWORD.EXE
1556	WINWORD.EXE
1556	WINWORD.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1976	1984	4ad1eb927d9df8338fa4e38441bba80a.exe	28
PID 1984 wrote to memory of 1976	1984	4ad1eb927d9df8338fa4e38441bba80a.exe	28
PID 1984 wrote to memory of 1976	1984	4ad1eb927d9df8338fa4e38441bba80a.exe	28
PID 1984 wrote to memory of 1976	1984	4ad1eb927d9df8338fa4e38441bba80a.exe	28
PID 1976 wrote to memory of 1556	1976	4309.tmp	29
PID 1976 wrote to memory of 1556	1976	4309.tmp	29
PID 1976 wrote to memory of 1556	1976	4309.tmp	29
PID 1976 wrote to memory of 1556	1976	4309.tmp	29

C:\Users\Admin\AppData\Local\Temp\4ad1eb927d9df8338fa4e38441bba80a.exe
"C:\Users\Admin\AppData\Local\Temp\4ad1eb927d9df8338fa4e38441bba80a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\4309.tmp
  "C:\Users\Admin\AppData\Local\Temp\4309.tmp" --splashC:\Users\Admin\AppData\Local\Temp\4ad1eb927d9df8338fa4e38441bba80a.exe 5564D10381DB347BB109C54EE04F62D255D4E2CD6B174831983EF27CE63366CDF1779CDD2DF9FAD662F7CD652D0F8DC40EA11235B2DE8614702C52970DA36EFA
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4ad1eb927d9df8338fa4e38441bba80a.docx"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4309.tmp

Filesize
1.7MB

MD5
51893d7b0c00b0e8f1ca7360bc6c3e44

SHA1
babeec196eee7168bde3b89daea677a38546421a

SHA256
60e92bba5b37d3010b6411dd15b14d1151299af6b6fa1b33893b17acbdce95db

SHA512
85ad648803676e5a326acf2280ae0cc3e0f8e894702b80b18174521841627b4267fe38a52a8e6ca970f8b6ec31ae3ce214527e2a014ffe1adae00d9d2ca210e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\4ad1eb927d9df8338fa4e38441bba80a.docx

Filesize
19KB

MD5
4046ff080673cffac6529512b8d3bdbb

SHA1
d3cbc39065b7a55e995fa25397da2140bdac80c1

SHA256
f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680

SHA512
453f70730b7560e3d3e23ddfa0fe74e014753f8b34b45254c1c0cf5fec0546a2b8b109a4f9d096e91711b6d02cb383a7136c2cb7bd6600d0598acf7c90c25418

Download Submit
\Users\Admin\AppData\Local\Temp\4309.tmp

Filesize
2.0MB

MD5
1ab2bb59c05863a123c6c2074231ad8e

SHA1
f6a5bf3387692b386843b706ec6f4573525eeeb9

SHA256
b7c24f981171a9d30723d5890eb1822e38e6769c21a97a28f5e2cc841a5a41ae

SHA512
d8b3d37002da63862b28f07348e4be319396caced68fab25e74f3d9016793363c8add2fdb13e93e95120f419132b17009119dcdb17a0008fa1ee18f53585e7aa

Download Submit
memory/1556-9-0x000000002F201000-0x000000002F202000-memory.dmp

Filesize
4KB

Download
memory/1556-10-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1556-11-0x0000000070B9D000-0x0000000070BA8000-memory.dmp

Filesize
44KB

Download
memory/1556-15-0x0000000070B9D000-0x0000000070BA8000-memory.dmp

Filesize
44KB

Download
memory/1976-6-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/1984-0-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing