Malware Analysis Report

2024-12-07 22:23

Sample ID 240409-q5b1csbh9x
Target weareverybeautifulgirlsxygirlwantokissmeharderthanbeforetogetmeback___sheisverybeeautifulgirlforme (1).doc
SHA256 16550f58e8ab8fbcf7dee33901008c44dd9fba3144e1edf94a0033afce770ea1
Tags
remcos remotehost rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

16550f58e8ab8fbcf7dee33901008c44dd9fba3144e1edf94a0033afce770ea1

Threat Level: Known bad

The file weareverybeautifulgirlsxygirlwantokissmeharderthanbeforetogetmeback___sheisverybeeautifulgirlforme (1).doc was found to be: Known bad.

Malicious Activity Summary

remcos remotehost rat

Remcos

Blocklisted process makes network request

Downloads MZ/PE file

Drops startup file

Loads dropped DLL

Executes dropped EXE

AutoIT Executable

Suspicious use of SetThreadContext

Drops file in Windows directory

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Launches Equation Editor

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Checks processor information in registry

Suspicious behavior: AddClipboardFormatListener

Modifies Internet Explorer settings

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-09 13:50

Signatures

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-04-09 13:50

Reported

2024-04-09 13:55

Platform

win11-20240221-en

Max time kernel

235s

Max time network

278s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\weareverybeautifulgirlsxygirlwantokissmeharderthanbeforetogetmeback___sheisverybeeautifulgirlforme (1).rtf" /o ""

Signatures

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\weareverybeautifulgirlsxygirlwantokissmeharderthanbeforetogetmeback___sheisverybeeautifulgirlforme (1).rtf" /o ""

Network

Country Destination Domain Proto
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp

Files

memory/3944-0-0x00007FF864170000-0x00007FF864180000-memory.dmp

memory/3944-1-0x00007FF864170000-0x00007FF864180000-memory.dmp

memory/3944-2-0x00007FF864170000-0x00007FF864180000-memory.dmp

memory/3944-3-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-5-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-6-0x00007FF864170000-0x00007FF864180000-memory.dmp

memory/3944-7-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-4-0x00007FF864170000-0x00007FF864180000-memory.dmp

memory/3944-8-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-9-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-10-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-11-0x00007FF861640000-0x00007FF861650000-memory.dmp

memory/3944-12-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-13-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-14-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-15-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-16-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-18-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-17-0x00007FF861640000-0x00007FF861650000-memory.dmp

memory/3944-20-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-21-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-22-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-24-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-23-0x00007FF8A2E30000-0x00007FF8A2EED000-memory.dmp

memory/3944-19-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-33-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-34-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

memory/3944-35-0x00007FF8A40E0000-0x00007FF8A42E9000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-09 13:50

Reported

2024-04-09 13:55

Platform

win7-20240221-en

Max time kernel

299s

Max time network

287s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\weareverybeautifulgirlsxygirlwantokissmeharderthanbeforetogetmeback___sheisverybeeautifulgirlforme (1).rtf"

Signatures

Remcos

rat remcos

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE N/A

Downloads MZ/PE file

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\excel.vbs C:\Users\Admin\AppData\Local\directory\excel.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\wininit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\directory\excel.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2732 set thread context of 2744 N/A C:\Users\Admin\AppData\Local\directory\excel.exe C:\Windows\SysWOW64\svchost.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Office loads VBA resources, possible macro or embedded object present

Launches Equation Editor

exploit
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\directory\excel.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2548 wrote to memory of 2512 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2548 wrote to memory of 2512 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2548 wrote to memory of 2512 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2548 wrote to memory of 2512 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2512 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Local\directory\excel.exe
PID 2512 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Local\directory\excel.exe
PID 2512 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Local\directory\excel.exe
PID 2512 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Local\directory\excel.exe
PID 2512 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Local\directory\excel.exe
PID 2512 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Local\directory\excel.exe
PID 2512 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Local\directory\excel.exe
PID 2732 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\directory\excel.exe C:\Windows\SysWOW64\svchost.exe
PID 2732 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\directory\excel.exe C:\Windows\SysWOW64\svchost.exe
PID 2732 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\directory\excel.exe C:\Windows\SysWOW64\svchost.exe
PID 2732 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\directory\excel.exe C:\Windows\SysWOW64\svchost.exe
PID 2732 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\directory\excel.exe C:\Windows\SysWOW64\svchost.exe
PID 2208 wrote to memory of 1948 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2208 wrote to memory of 1948 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2208 wrote to memory of 1948 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2208 wrote to memory of 1948 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe

Processes

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\weareverybeautifulgirlsxygirlwantokissmeharderthanbeforetogetmeback___sheisverybeeautifulgirlforme (1).rtf"

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

C:\Users\Admin\AppData\Roaming\wininit.exe

"C:\Users\Admin\AppData\Roaming\wininit.exe"

C:\Users\Admin\AppData\Local\directory\excel.exe

"C:\Users\Admin\AppData\Roaming\wininit.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Users\Admin\AppData\Roaming\wininit.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

Country Destination Domain Proto
US 192.3.95.135:80 192.3.95.135 tcp
US 8.8.8.8:53 shgoini.com udp
US 107.175.229.143:30902 shgoini.com tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp

Files

memory/2208-0-0x000000002F231000-0x000000002F232000-memory.dmp

memory/2208-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2208-2-0x000000007132D000-0x0000000071338000-memory.dmp

C:\Users\Admin\AppData\Roaming\wininit.exe

MD5 6b7314e8a04ad8436c3aff06f3918ea6
SHA1 61c5aca05c76396e70054b732d9afb7d4a5e293d
SHA256 c392c14304399e9ad13ede370375ecffa47f30245cb91a413a3fd1150721a929
SHA512 00b5c837c36cb44d5b1a7c724746daf85b4a1d4b89d55a2d81e8999ed34035baa84a8f9fc976704ec92afe52a316c09eb7b7d012d66d8d5eea284d31d5974baf

memory/2512-25-0x0000000000120000-0x0000000000124000-memory.dmp

\Users\Admin\AppData\Local\directory\excel.exe

MD5 ac23a656a0c70a57b4914472abe352b0
SHA1 a4ada12353b24688034b08ab4720ce156046d84a
SHA256 11b81c511f8007bcbc97b368d89b0a738427d1b3173736a67307a7e5c731d4f1
SHA512 57e2b20ef13756da5aa44047783120a917508409a7bdc05c207061412913fd4714bb550abc34c6dbe8a3b0081764a39d9051416f152361c0da558edcfb894c9a

C:\Users\Admin\AppData\Local\Temp\saccule

MD5 7b4ee3164750a624febb01f867bdb208
SHA1 2c68f3bc9f02ef7229da72935b33053885ad19e0
SHA256 fc648d1008816e63cb562eec07b7ae56ab4c5be06da13282a213f9c9e6f3c2a5
SHA512 aa088d535f08520ba2299da40c2e5c6ee1375eb67ac9f2438f431bda1312d024e38793c1b074f08b0accf8bf89db630b46de5b9883036b84ab50b473bbc1dc41

C:\Users\Admin\AppData\Local\Temp\Thebit

MD5 a04675531940882479c988422f627c21
SHA1 48bb45a49c1600e8f16ffe612170787f841cd969
SHA256 011bee0b69f6d996fd2ddced3a417739375f6a3909ff46d23bcca2f0d14680d5
SHA512 f8f2e1c49d7a7153a8522488a259ff37927c6c133b2030fdf70728aa034b02f2fd704d2bba7ad6660eb0f6b3696108a26df1c479723330f49ea0e462c13ba24c

memory/2744-50-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-52-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-53-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-54-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-55-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-57-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-56-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-58-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-60-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2208-62-0x000000007132D000-0x0000000071338000-memory.dmp

memory/2744-63-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-64-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-65-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-66-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-67-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-69-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-68-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-72-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-73-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-74-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-76-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-77-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-78-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-79-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2744-80-0x0000000000400000-0x0000000000482000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-09 13:50

Reported

2024-04-09 13:55

Platform

win10-20240404-en

Max time kernel

233s

Max time network

258s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\weareverybeautifulgirlsxygirlwantokissmeharderthanbeforetogetmeback___sheisverybeeautifulgirlforme (1).rtf" /o ""

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\weareverybeautifulgirlsxygirlwantokissmeharderthanbeforetogetmeback___sheisverybeeautifulgirlforme (1).rtf" /o ""

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.0.8.0.8.0.8.0.ip6.arpa udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 131.72.42.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
NL 23.62.61.162:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
GB 23.73.138.202:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 162.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 202.138.73.23.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 24.173.189.20.in-addr.arpa udp

Files

memory/4916-0-0x00007FFE9FB20000-0x00007FFE9FB30000-memory.dmp

memory/4916-1-0x00007FFE9FB20000-0x00007FFE9FB30000-memory.dmp

memory/4916-2-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-3-0x00007FFE9FB20000-0x00007FFE9FB30000-memory.dmp

memory/4916-5-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-4-0x00007FFE9FB20000-0x00007FFE9FB30000-memory.dmp

memory/4916-8-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-9-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-10-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-11-0x00007FFE9BFB0000-0x00007FFE9BFC0000-memory.dmp

memory/4916-12-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-13-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-14-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-15-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-16-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-17-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-18-0x00007FFE9BFB0000-0x00007FFE9BFC0000-memory.dmp

memory/4916-19-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-21-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-23-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-24-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-28-0x00007FFEDF9E0000-0x00007FFEDFA8E000-memory.dmp

memory/4916-27-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-29-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-30-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-31-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-32-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-33-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-34-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-35-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-207-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-208-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

memory/4916-209-0x00007FFEDFA90000-0x00007FFEDFC6B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TCD798.tmp\gb.xsl

MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

Analysis: behavioral3

Detonation Overview

Submitted

2024-04-09 13:50

Reported

2024-04-09 13:55

Platform

win10v2004-20240319-en

Max time kernel

300s

Max time network

308s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\weareverybeautifulgirlsxygirlwantokissmeharderthanbeforetogetmeback___sheisverybeeautifulgirlforme (1).rtf" /o ""

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\weareverybeautifulgirlsxygirlwantokissmeharderthanbeforetogetmeback___sheisverybeeautifulgirlforme (1).rtf" /o ""

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1008 --field-trial-handle=2228,i,8155065313278028490,17854605419281052753,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 47.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 132.250.30.184.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
NL 142.250.179.202:443 tcp
US 8.8.8.8:53 25.73.42.20.in-addr.arpa udp
IE 94.245.104.56:443 tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
GB 51.140.242.104:443 tcp
GB 51.140.244.186:443 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
NL 23.62.61.184:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 184.61.62.23.in-addr.arpa udp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
GB 23.73.137.235:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 235.137.73.23.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 95.16.208.104.in-addr.arpa udp

Files

memory/3560-0-0x00007FFC20FB0000-0x00007FFC20FC0000-memory.dmp

memory/3560-2-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

memory/3560-1-0x00007FFC20FB0000-0x00007FFC20FC0000-memory.dmp

memory/3560-3-0x00007FFC20FB0000-0x00007FFC20FC0000-memory.dmp

memory/3560-4-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

memory/3560-5-0x00007FFC20FB0000-0x00007FFC20FC0000-memory.dmp

memory/3560-6-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

memory/3560-8-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

memory/3560-7-0x00007FFC20FB0000-0x00007FFC20FC0000-memory.dmp

memory/3560-9-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

memory/3560-10-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

memory/3560-11-0x00007FFC1EEA0000-0x00007FFC1EEB0000-memory.dmp

memory/3560-12-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

memory/3560-13-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

memory/3560-14-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

memory/3560-15-0x00007FFC1EEA0000-0x00007FFC1EEB0000-memory.dmp

memory/3560-29-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

memory/3560-30-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

memory/3560-31-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

memory/3560-32-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TCDF0FE.tmp\gb.xsl

MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810