Malware Analysis Report

2024-12-07 22:46

Sample ID 240514-cc1w5aee9x
Target Order2354.xls
SHA256 114ea93681433aaf40289d58407cb4b570748645aca682ddae3052b6f428b3f7
Tags
remcos execution rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

114ea93681433aaf40289d58407cb4b570748645aca682ddae3052b6f428b3f7

Threat Level: Known bad

The file Order2354.xls was found to be: Known bad.

Malicious Activity Summary

remcos execution rat

Remcos

Blocklisted process makes network request

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Abuses OpenXML format to download file from external location

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Enumerates physical storage devices

Program crash

Office loads VBA resources, possible macro or embedded object present

Enumerates system info in registry

Uses Volume Shadow Copy service COM API

Creates scheduled task(s)

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious behavior: AddClipboardFormatListener

Launches Equation Editor

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Uses Volume Shadow Copy WMI provider

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-14 01:56

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-14 01:56

Reported

2024-05-14 01:59

Platform

win7-20240221-en

Max time kernel

144s

Max time network

151s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Order2354.xls

Signatures

Remcos

rat remcos

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Abuses OpenXML format to download file from external location

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\vnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\vnc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2488 set thread context of 1216 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\vnc.exe

Office loads VBA resources, possible macro or embedded object present

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Launches Equation Editor

exploit
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 988 wrote to memory of 2488 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\vnc.exe
PID 988 wrote to memory of 2488 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\vnc.exe
PID 988 wrote to memory of 2488 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\vnc.exe
PID 988 wrote to memory of 2488 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\vnc.exe
PID 2560 wrote to memory of 2052 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2560 wrote to memory of 2052 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2560 wrote to memory of 2052 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2560 wrote to memory of 2052 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2488 wrote to memory of 412 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2488 wrote to memory of 412 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2488 wrote to memory of 412 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2488 wrote to memory of 412 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2488 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2488 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2488 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2488 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2488 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\schtasks.exe
PID 2488 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\schtasks.exe
PID 2488 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\schtasks.exe
PID 2488 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\schtasks.exe
PID 2488 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 2488 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 2488 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 2488 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 2488 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 2488 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 2488 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 2488 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 2488 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 2488 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 2488 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 2488 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 2488 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 1216 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WerFault.exe
PID 1216 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WerFault.exe
PID 1216 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WerFault.exe
PID 1216 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Order2354.xls

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" -Embedding

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

C:\Users\Admin\AppData\Roaming\vnc.exe

"C:\Users\Admin\AppData\Roaming\vnc.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vnc.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jGiHPUkzfFmtq.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jGiHPUkzfFmtq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9EFD.tmp"

C:\Users\Admin\AppData\Roaming\vnc.exe

"C:\Users\Admin\AppData\Roaming\vnc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 200

Network

Country Destination Domain Proto
US 8.8.8.8:53 dokdo.in udp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:443 dokdo.in tcp
US 172.93.222.102:80 172.93.222.102 tcp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:443 dokdo.in tcp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:443 dokdo.in tcp
US 172.93.222.102:80 172.93.222.102 tcp
US 172.93.222.102:80 172.93.222.102 tcp

Files

memory/2004-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2004-1-0x00000000723FD000-0x0000000072408000-memory.dmp

memory/2560-20-0x000000002FA71000-0x000000002FA72000-memory.dmp

memory/2560-22-0x00000000723FD000-0x0000000072408000-memory.dmp

memory/2560-24-0x00000000023E0000-0x00000000023E2000-memory.dmp

memory/2004-25-0x00000000024A0000-0x00000000024A2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MULTGHKV.txt

MD5 e7a094b9a5d25c3ebb746e3da142148e
SHA1 881097247ec6c6704d5040a6949993cf7a14b14d
SHA256 c47f7a91a979ae9e7579f601c1bc42504d742af5be38d0881df1c9ca1b4d1e02
SHA512 6fecc7d7d1a80ec6f52a40bb406b184c1c7b13c606ac55ce58bfae52dff5ff8746eedf13c6c4bc7ec5e6c150c16f01d01e5fa5f68aa2ee534b9bfcc821900e4d

C:\Users\Admin\AppData\Local\Temp\{91E2AC18-CBB6-42CD-B9E1-D9742542C767}

MD5 71a0b8e5441eae4eab67fbae8da01627
SHA1 ea9e1ef8a5cac257e428f3d1506dafac04a86da7
SHA256 c1f1db77a7f3b01bd2a9331398b589b1aeafc7411850e21d8f9711adbfa1dae6
SHA512 8b9e6194fc0bfafa95685b7eb8f5eab7147c7359f8c4cc47d2fe1fad8761ab835cff6b46e0c9dce3797d9524224d4479f6f9ed489ad6aac5191137316a213c16

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{5F65277B-6858-4EFE-96F8-D4A4EAB12C9A}.FSD

MD5 2c029bb0d3ef268d92b158845e0bc5bd
SHA1 a8a32616548f051e36be47d41525c4029cfd74c8
SHA256 3d9d53dec1423b7d726b1440cd60796227868f3202023193368424b669d73722
SHA512 f7afe965cf96055561b98558a2f00211a5886177baf47a8034f1999f8b2fe6ecc954fbd4983dfc4f5b1aa8637267af6dc94627d816e027798ad88f5ce506f683

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

MD5 8839e71935289361f9c19714e6ae7613
SHA1 5ce1f420e40ebee10f9c416d79db6b9bf07fc704
SHA256 f084848825e4a926a5d1801ec380b25327f427de9865e99b7b3f3f4ac1215c48
SHA512 d7cffd6f28cec1ad593ea25032156d6a6aa8b1d8d49665fd7bfd9319c9cc64258a8ffa8c652b874bbca720bd03e70772cf421f437ea9871e3c693dcac5238899

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{0F78C702-CB7C-42BD-8812-A8D97721FBF9}.FSD

MD5 99e2152982fec8e94b29f10c4e4ffbd8
SHA1 138b15dc3200c99a4223df95c478c4b39cd95bb8
SHA256 18964feb7e8f652bbedeb6b07a7dc6d0112141e714ab67600d28186f1524511f
SHA512 a371db6a6d75f53f482c4e3f76c077a82a25618640c72a72d0a80f1f736bcde6c2585a044e9f97258c71da04ed8d1cc21221e3c5f94820bf6791e297e9e693ea

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORQXHVT\beautifulroseflowerwanttogetinhandbecauseitsgreatthingshandbeautiuflthingshappenedtogetback___beautiuflflowers[1].doc

MD5 7a7b11bbe3d337c74805c519c22601c0
SHA1 4b680f33a5d1f26934429bb7dff11b8b3f6ea0f8
SHA256 3f6bd3440b27d64b41ff2902d7b35c1105b7dc026e834755a1b44f63b5da965e
SHA512 c637d681ff8f7e00c74291bf38835ada5d4c074d62f9d5a12ceed7b4ec540f21e05dc89469664af08d7a68040e5d0646e1f13669ddec965812ce9eeb78975302

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 5fd2cde1dd0ff55b448c1a19f03475c3
SHA1 704188b528b2933db2b974947021315897fc1bbc
SHA256 2f07dec57fbc688cfb77b5c959261496911da9bcced2c12e4c5ed494720e6dae
SHA512 bde96a0e987791f1d441b46a0f9fb97dc41b62c9e71c5f13c4bd7a0bbb2821072720147ed61733b2027b151acfc8ea03d3fe296bfe40f135773dc7bbd4a9ef80

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 e911d5250fd2c67530801b2c146e56ad
SHA1 c5452baaee6e85d4129c0f35f5d4182fa3b225f8
SHA256 c27edf2fc78bb8ea82d5bca8f2aa9a6ba9a7a62f8e75c9f1af92dec7bfcb229d
SHA512 0eb3e6a4bffe7eca9f3c62e89c71f92b2e4527cd240cfd0743a5abf492e44f7c22128c402c02b34177f34ae83f06fa24cf22fbabab58ecc4fc4935e342f56b1d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 08382a2e54147a15b94d7ba0db7f32ab
SHA1 8842ea874cdd26e775c96815fe96267b5d0259b6
SHA256 a88264cd8124286639250e56617e992f81da7ef1d58577f69edd3b21f11d1bff
SHA512 e65630ddb073d38ef87157a9a2a2206250c45a25c0629059beac83aadb8c85a055779bd950cc3e099b4591463d21e33a0805900bcf97703398e16ec97a826813

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 53cc5ac90a595cefb61b14011e01eeed
SHA1 d50ce46c4d4aafdf1e450875502c7469cbca0edb
SHA256 36d536c42fce94a89e0e74d0870ee511c189b1b5963e98cf9de37d19c0a94e05
SHA512 d4afcd1d126b8ef145790c2ae23d4c61381d04b2de213dc140f6e6bcf30cad6100df91577a17177d6eb3024e44ded03132c95c96fdb06f8fe502ab7840bd03db

C:\Users\Admin\AppData\Local\Temp\Cab5EA5.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Roaming\vnc.exe

MD5 1299c227f71353022f7ed366f9efb219
SHA1 b8437949812bd190d66b656cdf99625243e0740f
SHA256 b2ae69e681c120901c4f5f839125d81b53eabd3f22c0a50547604c15d43a33f3
SHA512 0e5276521830eab912247cead3adb5465cd2ad9fdb784999f189c8c854c541f6a671a3bfdce7880fd6c7b4e232c22cb57cfb288a3c71957ee858f1c354c5e26d

memory/2488-126-0x0000000000890000-0x000000000098A000-memory.dmp

memory/2488-128-0x0000000000680000-0x00000000006A0000-memory.dmp

memory/2004-129-0x00000000723FD000-0x0000000072408000-memory.dmp

memory/2488-130-0x0000000000840000-0x0000000000850000-memory.dmp

memory/2488-131-0x0000000000850000-0x0000000000866000-memory.dmp

memory/2488-132-0x00000000051F0000-0x00000000052B0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IC6WS40XJI6KD2SRJ0MA.temp

MD5 51b23f06935960a2ea654fff60a14638
SHA1 9a28e3b6ba62808d5ef80ccfb05634821eab0f81
SHA256 92c2ca18872970710e0c8027aa7bef94100b2d17b4e8f6b3f7fadfef9ce741d2
SHA512 3dcb757ed91d290990c7fda6ad44f60e513ba61701169209e561a993de01a95ca67c810256ded67fe274d1020a9f4a2e84eb8a7763eec8956bb92de78a53d2d4

C:\Users\Admin\AppData\Local\Temp\tmp9EFD.tmp

MD5 e5319a32aae07ca11a0077f066d8b62f
SHA1 feba6e6aef0cc374a91cf357f86eaca5ca6cec95
SHA256 43677b14c2d988affbec9e24d0e5e621eccf94acd45a0a35dbfcb2294b81f2bb
SHA512 a2ad26cbb68c182855049aa15d091cfdef72bb5c581e881c3e779ff0fe70b230ab07c09ea614814e8009b282babd950d7d5c51c51440ee097e40c6ef7eb8a549

memory/1216-146-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1216-162-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1216-164-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1216-161-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1216-159-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1216-157-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1216-155-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1216-153-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1216-151-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1216-149-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1216-147-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2560-172-0x00000000723FD000-0x0000000072408000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-14 01:56

Reported

2024-05-14 01:59

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

147s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Order2354.xls"

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAuditPrivilege N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4628 wrote to memory of 1844 N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE C:\Windows\splwow64.exe
PID 4628 wrote to memory of 1844 N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE C:\Windows\splwow64.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Order2354.xls"

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 dokdo.in udp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:443 dokdo.in tcp
US 8.8.8.8:53 2.96.114.188.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 67.179.250.142.in-addr.arpa udp
US 172.93.222.102:80 172.93.222.102 tcp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 102.222.93.172.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:443 dokdo.in tcp
US 8.8.8.8:53 210.143.182.52.in-addr.arpa udp
US 172.93.222.102:80 172.93.222.102 tcp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:443 dokdo.in tcp
US 172.93.222.102:80 172.93.222.102 tcp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
NL 23.62.61.162:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 162.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 17.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp

Files

memory/3604-0-0x00007FF81FEF0000-0x00007FF81FF00000-memory.dmp

memory/3604-1-0x00007FF85FF0D000-0x00007FF85FF0E000-memory.dmp

memory/3604-3-0x00007FF81FEF0000-0x00007FF81FF00000-memory.dmp

memory/3604-5-0x00007FF81FEF0000-0x00007FF81FF00000-memory.dmp

memory/3604-4-0x00007FF81FEF0000-0x00007FF81FF00000-memory.dmp

memory/3604-2-0x00007FF81FEF0000-0x00007FF81FF00000-memory.dmp

memory/3604-8-0x00007FF85FE70000-0x00007FF860065000-memory.dmp

memory/3604-7-0x00007FF85FE70000-0x00007FF860065000-memory.dmp

memory/3604-6-0x00007FF85FE70000-0x00007FF860065000-memory.dmp

memory/3604-9-0x00007FF81D780000-0x00007FF81D790000-memory.dmp

memory/3604-11-0x00007FF85FE70000-0x00007FF860065000-memory.dmp

memory/3604-12-0x00007FF85FE70000-0x00007FF860065000-memory.dmp

memory/3604-13-0x00007FF85FE70000-0x00007FF860065000-memory.dmp

memory/3604-14-0x00007FF81D780000-0x00007FF81D790000-memory.dmp

memory/3604-10-0x00007FF85FE70000-0x00007FF860065000-memory.dmp

memory/3604-15-0x00007FF85FE70000-0x00007FF860065000-memory.dmp

memory/4628-35-0x00007FF85FE70000-0x00007FF860065000-memory.dmp

memory/4628-38-0x00007FF85FE70000-0x00007FF860065000-memory.dmp

memory/4628-39-0x00007FF85FE70000-0x00007FF860065000-memory.dmp

memory/4628-40-0x00007FF85FE70000-0x00007FF860065000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\769DF7CC-3388-498D-A3AF-8E25C8C10D12

MD5 b49e1f4f8628641836279ecd867aceef
SHA1 b85a1b021cd85b0edc3aab8bcee39032a98e1eac
SHA256 1b19954b69d7c2daf774ffd3f170334b21776b236ca8b126ee954e49d464556e
SHA512 bbd7a7f7db162bc1dc5729dbc6decd60cc96c5c05735ed069b76312cf1469d0c4e5dfe93f985a6975df345045ad965d9b410250f957bc24121f7799efcda52d4

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

MD5 beef05ef38cc265b7f27632b633dafd4
SHA1 6bf28eb47f258ea4cce25ac4b953ab4de96e218e
SHA256 4996713af3de43400f656335cd33cf7ae64034014afe83e06a1f6c5f64fd370a
SHA512 a13b374eae48f5d1919138362dd8207812a3c030dc8f38af05b79b644c1ae1a6264148f7f66613d2d3ad40ade6f4483bad3d1eae68140941e760f9a7af46991f

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

MD5 32d001c5c63cdbe6ed36058ee70389ce
SHA1 6b17639bb9ea617f8b74ddfc00293ee1a502b9cf
SHA256 dd4881e00258eb3750f0d83c64ca6e16cd9bbf1ef57eca76c607c7eaa5ccfee4
SHA512 4f03ce0ca7144556cc4227fa80d6fcefa89c7c7b81ff2c416c2fb0f065e10787292dff2abb170e4026c39a52c19c56db5f4a3d49c4a7845e4eb19fc814daa661

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CMPDKH9Q\beautifulroseflowerwanttogetinhandbecauseitsgreatthingshandbeautiuflthingshappenedtogetback___beautiuflflowers[1].doc

MD5 7a7b11bbe3d337c74805c519c22601c0
SHA1 4b680f33a5d1f26934429bb7dff11b8b3f6ea0f8
SHA256 3f6bd3440b27d64b41ff2902d7b35c1105b7dc026e834755a1b44f63b5da965e
SHA512 c637d681ff8f7e00c74291bf38835ada5d4c074d62f9d5a12ceed7b4ec540f21e05dc89469664af08d7a68040e5d0646e1f13669ddec965812ce9eeb78975302

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 5db91e83608ae891debab17c5f65f6f2
SHA1 d016ab90b358325483f8afe4173071094b858f4c
SHA256 f88360415fd97c4df31fcf259e9264b138fc825d7a4e68e25e1cf3b3b018f8c2
SHA512 6801e217d58c24674bbaddb15f3d1da28f21c19191e16aae2c3a33ef634c8a65c9370d55f1542c8567aafd975fc4f6775a1d39eba49ec104d5d79601ff0330db

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 e911d5250fd2c67530801b2c146e56ad
SHA1 c5452baaee6e85d4129c0f35f5d4182fa3b225f8
SHA256 c27edf2fc78bb8ea82d5bca8f2aa9a6ba9a7a62f8e75c9f1af92dec7bfcb229d
SHA512 0eb3e6a4bffe7eca9f3c62e89c71f92b2e4527cd240cfd0743a5abf492e44f7c22128c402c02b34177f34ae83f06fa24cf22fbabab58ecc4fc4935e342f56b1d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 1e616f9b15bc1e7faa4776c5ab312357
SHA1 5eb6eb3526fb8cd448ef447b5db0edd084c75bc6
SHA256 32ed642a6f980684a278577160eda743f88c8fe41df53a14f1f89cc5c29f11f6
SHA512 8afe0eac6feb7e7a406b09f67742ec80be12625d6ff8398c29ba51d5c6bd0d0d094c6d3a25cdbd8b694932cfeaae4f6d8acf3afdb5a4f279ad58a4465d867d24

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 df047878aabade0d90b949939a2ae3f9
SHA1 058c5b3b0cc05116f03054d416b4f475ab784c8b
SHA256 084cd0a2f8062debb49b4acdba0a03d446aac260851cc60a8fee3b05d123a713
SHA512 b94cf7e0ab9e601a254fb43bbb655b599e08e85f0aebcb6e254dc9fc9c63277d5180a015b699b05d4c64b408f59d90e8a69b2cd0111c6ac06215452891e4aa7f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

MD5 8a8e0321e01b962638ef3628ae2e7de7
SHA1 c039b26811f149f4d9922a8f0b2e10c3b506f0f9
SHA256 e6e226aa365274c07a4413a06bb3362d46af81cc7cac9928242d622e890ec41e
SHA512 ee6f841c88ddb16bae5087906eab0f0b6081af9604748d378316964b19eb6a32562580298fe4735fd83d7ca7e88a350f580221826eb42574285dbe610c28d1a1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

MD5 c5ad48a2f1d3b597290523bd060fdcc5
SHA1 a5ef0ab7239f194d25c1c88a93d0738becb7096e
SHA256 a25f1462b8c45b9c4756f5f5e87e89121b311c740e82ca5769ddb64f44742333
SHA512 0c9edf5fe71b30afb82094b2c332027cd1e2071dfe75bd5f0a55e81b3e3757dbf4b58a27716bd36663f7cf0d26db72501801f5f5bc20f77415d5de3dd9234bb9

C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

MD5 8d5ef0a0d4744822f0c16e577131998e
SHA1 77bda1b79176c915fac0850c28980e0b9b3ba3ae
SHA256 e28b2c6d4f490fdfe48abef2d8d05e3082de54f2cca2e9ae339ea699d5809769
SHA512 5b7c2bb89cc6e7f9ad77a783d17de309dcbd133f16525244dc4028eb8c7a4fd7b3a62bd0ac4aaf903d4d718911d917397f4a051662fa960d491ab03baab3102a

memory/3604-78-0x00007FF85FE70000-0x00007FF860065000-memory.dmp

memory/3604-80-0x00007FF85FE70000-0x00007FF860065000-memory.dmp

memory/3604-79-0x00007FF85FF0D000-0x00007FF85FF0E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 656d977ba9aef81bbf1962fe69fe47ae
SHA1 043e69b1f9551c99aa747f7c5f2e079481deb4ed
SHA256 b4687e9d510262695512bc7542b90ea46d99ce01151cf3120479ffbc41978e19
SHA512 644c415205a10164e4880cdbea660dcd01b361c27f98951885b82bdb49cb08e8c7e6c2f227d87a0956e74012be52bd7a71eb8dd4091d434cd86b973f4956c20a

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 d59b584f7e536cc32daac35e8c113def
SHA1 1b72cfcbbdf0fe896550fd1be65039966f666c7f
SHA256 692a43802cdc411fe042de3bc67ec5e96582d6628f356183f29a48db8413f306
SHA512 4046d1aa4ed531d0733b26cab0f9064b45f3b886a8d5be6eed23bd4b2a21a1ab839ce37794df302ed0a4537792c2f79faf38eeeede7094bfd1c418a0d8ff3def

C:\Users\Admin\AppData\Local\Temp\TCDAD02.tmp\sist02.xsl

MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

memory/4628-572-0x00007FF85FE70000-0x00007FF860065000-memory.dmp