Analysis
-
max time kernel
106s -
max time network
56s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 09:50
Static task
static1
Behavioral task
behavioral1
Sample
4f970fe5a0df88373022185d178b21fbb5db754176042f60317e46d5d20a01c0.doc
Resource
win7
Behavioral task
behavioral2
Sample
4f970fe5a0df88373022185d178b21fbb5db754176042f60317e46d5d20a01c0.doc
Resource
win10v200430
General
-
Target
4f970fe5a0df88373022185d178b21fbb5db754176042f60317e46d5d20a01c0.doc
-
Size
147KB
-
MD5
7bc2c2949bc0fe5e91f4ab0fbf557f9c
-
SHA1
d7a8ce829138f409be74498ecd74d3eefe738215
-
SHA256
4f970fe5a0df88373022185d178b21fbb5db754176042f60317e46d5d20a01c0
-
SHA512
c7463c3709989f9ff6fb71061f0a49f5e5e357bd104f18786bad6ea7ab78cfbb1b3b1148178e2fd02f45749db50836ac36531405d1f70526efcd7429ca0a6d66
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1324 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
WINWORD.EXEpid process 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 1508 1324 regsvr32.exe WINWORD.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 1324 wrote to memory of 1508 1324 WINWORD.EXE regsvr32.exe PID 1324 wrote to memory of 1508 1324 WINWORD.EXE regsvr32.exe PID 1324 wrote to memory of 1508 1324 WINWORD.EXE regsvr32.exe PID 1324 wrote to memory of 1508 1324 WINWORD.EXE regsvr32.exe PID 1324 wrote to memory of 1508 1324 WINWORD.EXE regsvr32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
regsvr32.exepid process 1508 regsvr32.exe -
Office loads VBA resources, possible macro or embedded object present
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4f970fe5a0df88373022185d178b21fbb5db754176042f60317e46d5d20a01c0.doc"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" o.tmp2⤵
- Process spawned unexpected child process
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1508-3-0x0000000000000000-mapping.dmp