Analysis
-
max time kernel
111s -
max time network
120s -
platform
windows7_x64 -
resource
win7 -
submitted
11-07-2020 07:17
General
-
Target
documento legale_07.20.doc
-
Size
147KB
-
MD5
2f90002a2bd51ba8e16bae0e8afa0624
-
SHA1
aac91441b513c3801a87a3953d9c6afdb80d81b0
-
SHA256
03f9be4517e46e9a1a9f7cd4dd6dac324aa4f6dd23c3b88545879b2aee47ac1c
-
SHA512
040b2ccb36bc54bf973bccea98e7a96d0d5e5efb97c5be48cadafa5e6406365d350c9826f294454e46865252efe532f3b3bd02a90b9d878cfef2d1d19aa3dcd4
Score
10/10
Malware Config
Signatures
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious use of WriteProcessMemory 5 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\documento legale_07.20.doc"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" kG.tmp2⤵
- Process spawned unexpected child process
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1788-3-0x0000000000000000-mapping.dmp