Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
10-02-2024 22:20
Static task
static1
Behavioral task
behavioral1
Sample
calc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
calc.exe
Resource
win10v2004-20231215-en
General
-
Target
calc.exe
-
Size
112KB
-
MD5
829e4805b0e12b383ee09abdc9e2dc3c
-
SHA1
5a272b7441328e09704b6d7eabdbd51b8858fde4
-
SHA256
37121ecb7c1e112b735bd21b0dfe3e526352ecb98c434c5f40e6a2a582380cdd
-
SHA512
356fe701e6788c9e4988ee5338c09170311c2013d6b72d7756b7ada5cda44114945f964668feb440d262fb1c0f9ca180549aafd532d169ceeadf435b9899c8f6
-
SSDEEP
1536:JEl14rQcWAkN7GAlqbkfAGQGV8aMbrNyrf1w+noPvLV6eBsCXKc:JYmZWXyaiedMbrN6pnoXL1BsC
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Processes:
WINWORD.EXEPOWERPNT.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\MenuExt POWERPNT.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" POWERPNT.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote POWERPNT.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" POWERPNT.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" POWERPNT.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 1516 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 3 IoCs
Processes:
POWERPNT.EXEWINWORD.EXEWINWORD.EXEpid process 1912 POWERPNT.EXE 2248 WINWORD.EXE 704 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2776 chrome.exe 2776 chrome.exe -
Suspicious use of AdjustPrivilegeToken 52 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe Token: SeShutdownPrivilege 2776 chrome.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
Processes:
calc.exechrome.exepid process 1680 calc.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe 2776 chrome.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
POWERPNT.EXEWINWORD.EXEWINWORD.EXEAcroRd32.exepid process 1912 POWERPNT.EXE 2248 WINWORD.EXE 2248 WINWORD.EXE 704 WINWORD.EXE 704 WINWORD.EXE 1452 AcroRd32.exe 1452 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2776 wrote to memory of 2788 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2788 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2788 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2528 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2564 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2564 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2564 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe PID 2776 wrote to memory of 2972 2776 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\calc.exe"C:\Users\Admin\AppData\Local\Temp\calc.exe"1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7b79758,0x7fef7b79768,0x7fef7b797782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1196,i,4074730752961108598,13290508144531775327,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1196,i,4074730752961108598,13290508144531775327,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1196,i,4074730752961108598,13290508144531775327,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2284 --field-trial-handle=1196,i,4074730752961108598,13290508144531775327,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2276 --field-trial-handle=1196,i,4074730752961108598,13290508144531775327,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1352 --field-trial-handle=1196,i,4074730752961108598,13290508144531775327,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1472 --field-trial-handle=1196,i,4074730752961108598,13290508144531775327,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3920 --field-trial-handle=1196,i,4074730752961108598,13290508144531775327,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" /s "C:\Users\Admin\Documents\PingReceive.ppsx"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Documents\Are.docx"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Documents\Are.docx"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Documents\SwitchTrace.pdf"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\InitializeUnlock.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
4KB
MD592ee999143f714cf95c07259be586dcd
SHA1aa56be24d26ad00c4becf668a4d12217733629ef
SHA256c6a8705ad051169f782fe5bc4847c49a0c33ba2a75530c5f2eaf32ce5b934345
SHA512138b94bb4e53d50942de4f5da7d90e653c3dbc8509225f1eb0e87603253c929958be26eb9746cc548341f0d3be55f862734eedd518cebad53632bc44d214d0f7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000007.dbtmpFilesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
239KB
MD561fddd2dd3a41b21d911ce19ceb5314a
SHA1a69595860f8d79992251a5d712f6677710379bbf
SHA256a04429407e5b29480a2e084a022ca1ad42bcd9deb0641c584b1e0ac8f92b78ed
SHA512fc6b102de990d167f226eab27705dda2423f7adf2b8d95b2da56129fab4d0d7eee5a62f41078e5eb9b2dd3ff1addb2d1222ae17772491608c752ceb108b797c1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bc0f3261-1f04-4ae5-8b13-6c9a0e756beb.tmpFilesize
238KB
MD5147e551c6e6ebee7b517204c11719ec3
SHA13a952ad2e030f088b35db3b7c57d910a16e4a8d4
SHA256d127ccfe7b40e61f151fc30f63c4bd1f9dbd37662f8397cd23b05aabf6ea27a2
SHA512ddb7223743bbf8a245ca44b931843c31b7eb7784da7f35dd5fe1e5ae26d0c1e2da746afed2ac971957698f7a8489b29dc79654e488570a6c3dfb2974072b67d8
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD537b34d7faa805318ae80eed8c0c45ac3
SHA1c11d903e3edf8da4831fed26473e386fdd701477
SHA2562e8430c456d84189e7dfca56e8c7f94897ce3ef68914d1e2d31d644420bdbfab
SHA51298aede308fec02c591446b14c89e002d71eba7b588d315fa9efa3a7f73695494982ee69628e0ce8d6e58a21cbd90ef260f64185b281232c7a1fc0912d7e56e99
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\Are.docx.LNKFilesize
983B
MD53eadeadf9a4e6c24e8f0db7bffa57c0a
SHA13fb403d2c4328ba8fb235a8d8847d40d709f5e0c
SHA2567036d794953a211937ce6dbe713e5fcc7a79d30f48c0c5ffef90d57e06111edf
SHA51269d1cee4bd7786dcfbf77b73d64c9d7c1bf73ce6b46ad85e750ec80171ca886222eac333bcd92abefe53e4e23dbee07c5c79dfabbbbb93a69cfcb659d75ae973
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.datFilesize
68B
MD56671d72b707430c5031c4f63e5f3ab38
SHA1fff201123395afa13badb0a7ad1ecb1097897440
SHA2561078c5b8420c6b9b5495aaae489d567849937600652da83267f83638f51f7864
SHA512184266204a4f8caf074272484285feb27518a2d2f7f343982851514f0af5cc8ae35e59fc97d8c062d4c9f2129723bf6f9c4716cfe96c3dc31445c220a2158353
-
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotmFilesize
20KB
MD548cd2c4434d5453fb59f38e9c8f7de0b
SHA1bdc6a4bd5e0a0c37865af165a5efb9920077d40b
SHA256d7b9ce48386e8a4dfc52f4e8a9c3f9a985a22715cd8bc9f82edc850696ffab7a
SHA512f716635a2d98a4f1347924c84ad06f63452f742c3c310c13e00ef348863f427da65c3634077a306b9ae9b46b0620af73fad9f10baf61f682becfe65ae23d073b
-
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DICFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
\??\pipe\crashpad_2776_KBZDOGMOTXTJXPPFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/704-202-0x000000002F701000-0x000000002F702000-memory.dmpFilesize
4KB
-
memory/704-220-0x0000000073FFD000-0x0000000074008000-memory.dmpFilesize
44KB
-
memory/704-204-0x0000000073FFD000-0x0000000074008000-memory.dmpFilesize
44KB
-
memory/704-203-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1912-156-0x000000002D301000-0x000000002D302000-memory.dmpFilesize
4KB
-
memory/1912-162-0x0000000072C5D000-0x0000000072C68000-memory.dmpFilesize
44KB
-
memory/1912-161-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1912-157-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1912-158-0x0000000072C5D000-0x0000000072C68000-memory.dmpFilesize
44KB
-
memory/2248-201-0x00000000719DD000-0x00000000719E8000-memory.dmpFilesize
44KB
-
memory/2248-165-0x00000000719DD000-0x00000000719E8000-memory.dmpFilesize
44KB
-
memory/2248-164-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2248-163-0x000000002FA81000-0x000000002FA82000-memory.dmpFilesize
4KB