febbc5ed972af6a662baf6305b758c5230e185d0c92c0731fb67bd29dc76f750

Resubmissions

29-05-2020 16:38

Target

require.05.20.doc
Size

72KB
MD5

9f04925d84fc7155683294c713aeeb58
SHA1

95f774a93375a049246ffce99e4c0da5e5ad18a5
SHA256

427a5c15ca89981ea6386e8a262474f80a47f07af10663478b9c7728fc054d54
SHA512

272a5de403ed83f83b0c17f13a2b0919fc8ee5c8b598edda149c6ba4bfdda14a03383dd514e4fe84f7b2c8baaeaf91075407b8c81391a4920d01636431289a0a

Score

10^/10

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1412 WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

Regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1800	1412	Regsvr32.exe	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 1412 wrote to memory of 1800	1412	WINWORD.EXE	Regsvr32.exe
PID 1412 wrote to memory of 1800	1412	WINWORD.EXE	Regsvr32.exe
PID 1412 wrote to memory of 1800	1412	WINWORD.EXE	Regsvr32.exe
PID 1412 wrote to memory of 1800	1412	WINWORD.EXE	Regsvr32.exe
PID 1412 wrote to memory of 1800	1412	WINWORD.EXE	Regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Regsvr32.exe

pid process

1800 Regsvr32.exe
Office loads VBA resources, possible macro or embedded object present

pid	process
1800	Regsvr32.exe