Analysis
-
max time kernel
110s -
max time network
117s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 15:07
Static task
static1
Behavioral task
behavioral1
Sample
d8fc308f94016f51cafa022193fbfe26778451b981c413f8f73206730599b466.doc
Resource
win7
Behavioral task
behavioral2
Sample
d8fc308f94016f51cafa022193fbfe26778451b981c413f8f73206730599b466.doc
Resource
win10v200430
General
-
Target
d8fc308f94016f51cafa022193fbfe26778451b981c413f8f73206730599b466.doc
-
Size
147KB
-
MD5
70812f69666fb0a7a305038253920457
-
SHA1
f4c3e9dec1d2cd4e5d4de9ca39265c784894e836
-
SHA256
d8fc308f94016f51cafa022193fbfe26778451b981c413f8f73206730599b466
-
SHA512
8b64c034762008d800fe874968bf3bd3ee9e928e8c850834cdfb342f53d81a8d3acd80a29c3d009fa4fc308a89512ed3dc61ac3ef127f5897f59c2c83a8e41b4
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
regsvr32.exepid process 1060 regsvr32.exe -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 616 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
WINWORD.EXEpid process 616 WINWORD.EXE 616 WINWORD.EXE 616 WINWORD.EXE 616 WINWORD.EXE 616 WINWORD.EXE 616 WINWORD.EXE 616 WINWORD.EXE 616 WINWORD.EXE 616 WINWORD.EXE 616 WINWORD.EXE 616 WINWORD.EXE 616 WINWORD.EXE 616 WINWORD.EXE 616 WINWORD.EXE 616 WINWORD.EXE 616 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 1060 616 regsvr32.exe WINWORD.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 616 wrote to memory of 1060 616 WINWORD.EXE regsvr32.exe PID 616 wrote to memory of 1060 616 WINWORD.EXE regsvr32.exe PID 616 wrote to memory of 1060 616 WINWORD.EXE regsvr32.exe PID 616 wrote to memory of 1060 616 WINWORD.EXE regsvr32.exe PID 616 wrote to memory of 1060 616 WINWORD.EXE regsvr32.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d8fc308f94016f51cafa022193fbfe26778451b981c413f8f73206730599b466.doc"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" Nv.tmp2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1060-3-0x0000000000000000-mapping.dmp