Analysis
-
max time kernel
144s -
max time network
21s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
29-05-2020 16:09
Static task
static1
Behavioral task
behavioral1
Sample
file.doc
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
file.doc
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
file.doc
-
Size
73KB
-
MD5
03da3c149defc051b11005c86bcbe599
-
SHA1
f95da4f19e6a289a4719415d24f1d32275761a33
-
SHA256
f7c5c10cee118eddd6c5a20c5a095032324fcb0bd368d7b7015f6646d8b5d411
-
SHA512
2d09399255220372db0e0497f0f0c0957ce5211bbe079b5999caa6a49046086461784f685811728050b992d3c7af9b7a5c9f4069c7f20828a9e38a2136d80db4
Score
10/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
WINWORD.EXERegsvr32.exeregsvr32.exedescription pid process target process PID 1232 wrote to memory of 1648 1232 WINWORD.EXE Regsvr32.exe PID 1232 wrote to memory of 1648 1232 WINWORD.EXE Regsvr32.exe PID 1232 wrote to memory of 1648 1232 WINWORD.EXE Regsvr32.exe PID 1232 wrote to memory of 1648 1232 WINWORD.EXE Regsvr32.exe PID 1232 wrote to memory of 1648 1232 WINWORD.EXE Regsvr32.exe PID 1648 wrote to memory of 1112 1648 Regsvr32.exe regsvr32.exe PID 1648 wrote to memory of 1112 1648 Regsvr32.exe regsvr32.exe PID 1648 wrote to memory of 1112 1648 Regsvr32.exe regsvr32.exe PID 1648 wrote to memory of 1112 1648 Regsvr32.exe regsvr32.exe PID 1648 wrote to memory of 1112 1648 Regsvr32.exe regsvr32.exe PID 1648 wrote to memory of 1112 1648 Regsvr32.exe regsvr32.exe PID 1648 wrote to memory of 1112 1648 Regsvr32.exe regsvr32.exe PID 1112 wrote to memory of 1820 1112 regsvr32.exe wscript.exe PID 1112 wrote to memory of 1820 1112 regsvr32.exe wscript.exe PID 1112 wrote to memory of 1820 1112 regsvr32.exe wscript.exe PID 1112 wrote to memory of 1820 1112 regsvr32.exe wscript.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1112 regsvr32.exe -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1232 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
WINWORD.EXEpid process 1232 WINWORD.EXE 1232 WINWORD.EXE 1232 WINWORD.EXE 1232 WINWORD.EXE 1232 WINWORD.EXE 1232 WINWORD.EXE 1232 WINWORD.EXE 1232 WINWORD.EXE 1232 WINWORD.EXE 1232 WINWORD.EXE 1232 WINWORD.EXE 1232 WINWORD.EXE 1232 WINWORD.EXE 1232 WINWORD.EXE 1232 WINWORD.EXE 1232 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
Regsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 1648 1232 Regsvr32.exe WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\file.doc"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\Regsvr32.exeRegsvr32 c:\programdata\71061557.dat2⤵
- Suspicious use of WriteProcessMemory
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\regsvr32.exec:\programdata\71061557.dat3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
-
C:\Windows\SysWOW64\wscript.exewscript.exe //E:jscript "C:\Users\Public\xSsGKcUqL.vA_YV4⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵