2058dd10037d008cd1d66974e7c8b3f128ccb5961d909548d05d51414c8cdabc

General

Target

244a7e163d42fcddb89553eeea91efa9.exe
Size

17KB
MD5

244a7e163d42fcddb89553eeea91efa9
SHA1

d647e5d5c088a660638c410e5f021664ce5978f7
SHA256

2058dd10037d008cd1d66974e7c8b3f128ccb5961d909548d05d51414c8cdabc
SHA512

e4c85ecf33c24aeacf0b7953a2dc0bfff3e6e033865f0b23fdafd0174e82fb5e077366e17326597305864c28ef5e006ad732b91912aca6efc603396edc081daf
SSDEEP

384:jvQrgSuNMPOY+blFXWyAzcmlba3n59qC3Zth3BPr3B0S:jvN3NMPOYsFG5pm35h3l1

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe rundll32.exe tftp.nfo beforegllav"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe rundll32.exe tftp.nfo beforegllav"	244a7e163d42fcddb89553eeea91efa9.exe

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	2664	2684	svchost.exe	28

Deletes itself 1 IoCs

pid	Process
2664	svchost.exe

Loads dropped DLL 3 IoCs

pid	Process
1368	244a7e163d42fcddb89553eeea91efa9.exe
2684	WINWORD.EXE
2664	svchost.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\tftp.nfo	WINWORD.EXE
File opened for modification	C:\Windows\SysWOW64\tftp.nfo	WINWORD.EXE
File opened for modification	C:\Windows\SysWOW64\tftp.nfo	244a7e163d42fcddb89553eeea91efa9.exe

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\idid	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\idid\url0 = 1e9b6dd889e6c44565e8442cfae2f41744dd36cad1e79b5f619b5bb2dc4f7859da3cee9b0c95bad7a873b391f0081c0e	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2684	WINWORD.EXE

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2684	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2684	WINWORD.EXE
2684	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2664	2684	WINWORD.EXE	29
PID 2684 wrote to memory of 2664	2684	WINWORD.EXE	29
PID 2684 wrote to memory of 2664	2684	WINWORD.EXE	29
PID 2684 wrote to memory of 2664	2684	WINWORD.EXE	29

C:\Users\Admin\AppData\Local\Temp\244a7e163d42fcddb89553eeea91efa9.exe
"C:\Users\Admin\AppData\Local\Temp\244a7e163d42fcddb89553eeea91efa9.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in System32 directory
PID:1368

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Process spawned unexpected child process
  - Deletes itself
  - Loads dropped DLL
  - Modifies registry class
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\tftp.nfo

Filesize
23KB

MD5
22dc58f3eda8e2238e382f64f939ba18

SHA1
4d1bfd2f6dd19c8b343862742ad58df74032a842

SHA256
420e21954b192a41b58fc9230f0768662271b4b88710c02080bbc4e72e37261a

SHA512
6259bbed518b9d4feb2334910e72a8708046eed4e4c4787e2522784451180b5c226f1e7e15b1763d6d7639bc46ff6cdb886373dd9c56293162f398af83b40cfe

Download Submit
\Users\Admin\AppData\Local\Temp\4692.tmp

Filesize
25KB

MD5
ef00c17ee9f648b3a8fd94da0ca922a0

SHA1
c8e5a808e740597542c9fe6c7385aadff65852b1

SHA256
68c98fdbd459b39b0e3d3413823773f6e87f8d5afb0cc5e2dc5e6282cdeddebb

SHA512
a34f37f6e7b6c32387847f6bbd22c4bcecb41a83e7335a553f12711307e086fbf2f0e2af44554bfc94f81ab18408ad24e59c30baea7f06d507bf61e736e746fa

Download Submit
memory/2664-13-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2664-18-0x0000000060380000-0x000000006038E000-memory.dmp

Filesize
56KB

Download
memory/2664-19-0x0000000060380000-0x000000006038E000-memory.dmp

Filesize
56KB

Download
memory/2684-3-0x000000002FF71000-0x000000002FF72000-memory.dmp

Filesize
4KB

Download
memory/2684-5-0x00000000715BD000-0x00000000715C8000-memory.dmp

Filesize
44KB

Download
memory/2684-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2684-10-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2684-14-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2684-15-0x00000000715BD000-0x00000000715C8000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads