351fd4530eb1d2fe2201ea91ccb14717be41c15e7b6595d26e5d82243d7865f6

General

Target

e22530ed8aee7a4eb0dff5e35a43861e.exe
Size

2.0MB
MD5

e22530ed8aee7a4eb0dff5e35a43861e
SHA1

deb235b7cf00e704896dec358cff7c95b8c7ede6
SHA256

351fd4530eb1d2fe2201ea91ccb14717be41c15e7b6595d26e5d82243d7865f6
SHA512

c9df30bff9c5a999d50066436dbe7e2a5fa2a5f684ba76d5b7cc2e96cecbeb5dae617044cda681fab72b04e94f537257d31180d06c792bbb8f0af25abfd980d6
SSDEEP

49152:OFUcx88PWPOpX0SF8D1KbC1+VoR7cNVVM4PdIdNx5M8yGc:O+K88uPCHyBWV6cNpdIfrM8yGc

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2964	1758.tmp

Loads dropped DLL 1 IoCs

pid	Process
2268	e22530ed8aee7a4eb0dff5e35a43861e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2756	WINWORD.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2964	1758.tmp

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2756	WINWORD.EXE
2756	WINWORD.EXE
2756	WINWORD.EXE
2756	WINWORD.EXE
2756	WINWORD.EXE
2756	WINWORD.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2964	2268	e22530ed8aee7a4eb0dff5e35a43861e.exe	28
PID 2268 wrote to memory of 2964	2268	e22530ed8aee7a4eb0dff5e35a43861e.exe	28
PID 2268 wrote to memory of 2964	2268	e22530ed8aee7a4eb0dff5e35a43861e.exe	28
PID 2268 wrote to memory of 2964	2268	e22530ed8aee7a4eb0dff5e35a43861e.exe	28
PID 2964 wrote to memory of 2756	2964	1758.tmp	29
PID 2964 wrote to memory of 2756	2964	1758.tmp	29
PID 2964 wrote to memory of 2756	2964	1758.tmp	29
PID 2964 wrote to memory of 2756	2964	1758.tmp	29

C:\Users\Admin\AppData\Local\Temp\e22530ed8aee7a4eb0dff5e35a43861e.exe
"C:\Users\Admin\AppData\Local\Temp\e22530ed8aee7a4eb0dff5e35a43861e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\1758.tmp
  "C:\Users\Admin\AppData\Local\Temp\1758.tmp" --splashC:\Users\Admin\AppData\Local\Temp\e22530ed8aee7a4eb0dff5e35a43861e.exe 6F9EDA514D74940BBBBFC232F9B4B28586759BED553A7D2D2EA3CF8803C1135863073E2356F9107538B2054BA07A611926884DAC450E5C1874583B2806EE2A07
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e22530ed8aee7a4eb0dff5e35a43861e.docx"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e22530ed8aee7a4eb0dff5e35a43861e.docx

Filesize
19KB

MD5
4046ff080673cffac6529512b8d3bdbb

SHA1
d3cbc39065b7a55e995fa25397da2140bdac80c1

SHA256
f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680

SHA512
453f70730b7560e3d3e23ddfa0fe74e014753f8b34b45254c1c0cf5fec0546a2b8b109a4f9d096e91711b6d02cb383a7136c2cb7bd6600d0598acf7c90c25418

Download Submit
\Users\Admin\AppData\Local\Temp\1758.tmp

Filesize
2.0MB

MD5
f2debbc00dbf3e4e40f53b8e750e2627

SHA1
dc516a57fef55e34b2be083dab79174debb71392

SHA256
6b4ea3c0c51aa46bbd6f01433f919684aebfe8a17d95346c7b17135630baa8b9

SHA512
3e337919393a4b7000e5a896fed5273ce9db0983be732843c863492c234efa9ccdb3b025aa73a13747bba179e958340df14829b757e7da3059ea1ec7c55777de

Download Submit
memory/2268-0-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/2756-9-0x000000002F131000-0x000000002F132000-memory.dmp

Filesize
4KB

Download
memory/2756-10-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2756-11-0x0000000070F3D000-0x0000000070F48000-memory.dmp

Filesize
44KB

Download
memory/2964-6-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing