Analysis
-
max time kernel
139s -
max time network
145s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 10:17
Static task
static1
Behavioral task
behavioral1
Sample
2321d68dd852f459bb95ab10c6517516d574578d3f184ea83d85a7b83123ab09.doc
Resource
win7
Behavioral task
behavioral2
Sample
2321d68dd852f459bb95ab10c6517516d574578d3f184ea83d85a7b83123ab09.doc
Resource
win10v200430
General
-
Target
2321d68dd852f459bb95ab10c6517516d574578d3f184ea83d85a7b83123ab09.doc
-
Size
147KB
-
MD5
4e16d9ee583f8fb7acbd8111608038b0
-
SHA1
dd0c3748e86b579450d462e3fff370b140bc9af8
-
SHA256
2321d68dd852f459bb95ab10c6517516d574578d3f184ea83d85a7b83123ab09
-
SHA512
d46d59a6f4150cba502e606f4c65c1e6333e496dc81d5f761a804fb60d3895ac5c0d2d0b43962d3f287dea0b565ec1a1ff097520b969f103c3a531eab657762d
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1044 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
WINWORD.EXEpid process 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 532 1044 regsvr32.exe WINWORD.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 1044 wrote to memory of 532 1044 WINWORD.EXE regsvr32.exe PID 1044 wrote to memory of 532 1044 WINWORD.EXE regsvr32.exe PID 1044 wrote to memory of 532 1044 WINWORD.EXE regsvr32.exe PID 1044 wrote to memory of 532 1044 WINWORD.EXE regsvr32.exe PID 1044 wrote to memory of 532 1044 WINWORD.EXE regsvr32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
regsvr32.exepid process 532 regsvr32.exe -
Office loads VBA resources, possible macro or embedded object present
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2321d68dd852f459bb95ab10c6517516d574578d3f184ea83d85a7b83123ab09.doc"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" U.tmp2⤵
- Process spawned unexpected child process
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/532-3-0x0000000000000000-mapping.dmp