20191121 EF52627.doc
----------------------------------------------------------------------
https://www.virustotal.com/gui/file/3ab3dc400f569d157a83eb0356db06d6b93e20de01915a9305fe33b9dbec95f9/detection

3ab3dc400f569d157a83eb0356db06d6b93e20de01915a9305fe33b9dbec95f9
file 20191121 EF52627.doc
216.08 KB
Size
2019-11-21 04:52:15 UTC
3 days ago
doc
Detection
Details
Community
Basic properties
MD5 efe7836fca6a77974da723c8b4511e48
SHA-1 ec87c9d8c10eb08734ff4222bcec13cd61b368e3
SHA-256 3ab3dc400f569d157a83eb0356db06d6b93e20de01915a9305fe33b9dbec95f9
SSDEEP 3072:EeBSfHH+UaqFh5zACnB7sgIKZvfI3U4uYxWEubHP:EeBSfHHNaqHnxI4fbvDrL
File type MS Word Document
File size 216.08 KB (221271 bytes)
----------------------------------------------------------------------

Detection rate 1/57
Arcabit - HEUR.VBA.Struct.1

----------------------------------------------------------------------
  Drops Office document
WINWORD.EXE
Reported IOC
WINWORD.EXE
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm	File opened for modification
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm	File created
C:\Users\Admin\AppData\Local\Temp\file 20191121 EF52627.doc	File opened for modification
  Drops file in system dir
BITS
Reported IOC
BITS
C:\Windows\Debug\ESE.TXT	File opened for modification
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	File opened for modification
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	File created
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp	File opened for modification
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp	File created
  Suspicious use of WriteProcessMemory
SppExtComObj.exe
Reported IOC
SppExtComObj.exe
PID 3976 wrote to memory of 3948
  Checks system information in the registry (likely anti-VM)
WINWORD.EXE
DoSvc
Matched TTPs
Query Registry
System Information Discovery
Reported IOC
WINWORD.EXE
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	Key value queried
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Key value queried
Reported IOC
DoSvc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	Key value queried
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Key value queried
  Enumerates system info in registry
WINWORD.EXE
Matched TTPs
Query Registry
System Information Discovery
Reported IOC
WINWORD.EXE
\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Key opened
\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Key value queried
\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Key opened
\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Key value queried
\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Key value queried
  Checks processor information in registry (likely anti-VM)
WINWORD.EXE
Matched TTPs
Query Registry
System Information Discovery
Reported IOC
WINWORD.EXE
\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Key opened
\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Key value queried
  Suspicious behavior: AddClipboardFormatListener
WINWORD.EXE
  Suspicious use of SetWindowsHookEx
WINWORD.EXE
  Windows security modification

wscsvc
Matched TTPs
Disabling Security Tools
Modify Registry
Reported IOC
wscsvc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0"	Set value (int)
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1"	Set value (int)
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\file 20191121 EF52627.doc" /o ""
PID: 4928
SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
PID: 3976
SLUI.exe
"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
PID: 3948
svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
PID: 4616
svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
PID: 4696
svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
PID: 4240
svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
PID: 4064
svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup