ca822b28a868bb52c0e59bf09093cf38dedb0a09c82718d3979980f13c02d1b9

Analysis

Target

docs-07.20.doc
Size

147KB
MD5

7dd79ba56b7ec464e9b515d900f3f569
SHA1

6c2bf5092ce30405ee4b7a349d9fe533045c6b4a
SHA256

ca822b28a868bb52c0e59bf09093cf38dedb0a09c82718d3979980f13c02d1b9
SHA512

b0974074f16bd77a59d4d36faa671998eb245d43e4ac966a4eeea53840b03385cdba5ec5780829fcd85d4360743c4429e1d55d2aeae3cbb52786ea8ff9afe494

Score

10^/10

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1068 WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1100	1068	regsvr32.exe	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 1068 wrote to memory of 1100	1068	WINWORD.EXE	regsvr32.exe
PID 1068 wrote to memory of 1100	1068	WINWORD.EXE	regsvr32.exe
PID 1068 wrote to memory of 1100	1068	WINWORD.EXE	regsvr32.exe
PID 1068 wrote to memory of 1100	1068	WINWORD.EXE	regsvr32.exe
PID 1068 wrote to memory of 1100	1068	WINWORD.EXE	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

regsvr32.exe

pid process

1100 regsvr32.exe
Office loads VBA resources, possible macro or embedded object present

pid	process
1100	regsvr32.exe