7c5e3fb421331b44461fb1a324c85feca52dbe117639c39fed6d5097f151d300

Analysis

Target

require.05.20.doc
Size

72KB
MD5

9f04925d84fc7155683294c713aeeb58
SHA1

95f774a93375a049246ffce99e4c0da5e5ad18a5
SHA256

427a5c15ca89981ea6386e8a262474f80a47f07af10663478b9c7728fc054d54
SHA512

272a5de403ed83f83b0c17f13a2b0919fc8ee5c8b598edda149c6ba4bfdda14a03383dd514e4fe84f7b2c8baaeaf91075407b8c81391a4920d01636431289a0a

Score

10^/10

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

Regsvr32.exeRegsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1328	376	Regsvr32.exe	WINWORD.EXE
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1996	376	Regsvr32.exe	WINWORD.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 376 wrote to memory of 1328	376	WINWORD.EXE	Regsvr32.exe
PID 376 wrote to memory of 1328	376	WINWORD.EXE	Regsvr32.exe
PID 376 wrote to memory of 1328	376	WINWORD.EXE	Regsvr32.exe
PID 376 wrote to memory of 1328	376	WINWORD.EXE	Regsvr32.exe
PID 376 wrote to memory of 1328	376	WINWORD.EXE	Regsvr32.exe
PID 376 wrote to memory of 1996	376	WINWORD.EXE	Regsvr32.exe
PID 376 wrote to memory of 1996	376	WINWORD.EXE	Regsvr32.exe
PID 376 wrote to memory of 1996	376	WINWORD.EXE	Regsvr32.exe
PID 376 wrote to memory of 1996	376	WINWORD.EXE	Regsvr32.exe
PID 376 wrote to memory of 1996	376	WINWORD.EXE	Regsvr32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

376 WINWORD.EXE
376 WINWORD.EXE
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Regsvr32.exe

pid process

1328 Regsvr32.exe
Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

376 WINWORD.EXE

pid	process
1328	Regsvr32.exe

C:\Windows\system32\Regsvr32.exe
Regsvr32 c:\programdata\49452677.dat
2⤵
- Process spawned unexpected child process
PID:1996

memory/376-3-0x00000000021F0000-0x00000000021F2000-memory.dmp

Filesize
8KB

Download