Analysis
-
max time kernel
127s -
max time network
122s -
platform
windows7_x64 -
resource
win7 -
submitted
11-07-2020 07:15
Static task
static1
Behavioral task
behavioral1
Sample
commercio,07.20.doc
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
commercio,07.20.doc
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
commercio,07.20.doc
-
Size
147KB
-
MD5
51d3dbc377be322144ebcbd5d4807f0e
-
SHA1
6faf0b17ba708e8c29bbbc1b52798456ac58d170
-
SHA256
7f2fa5e8de6a3d91a78c091f921a258aefe7c0737198c8d13c7663c453d4dbf1
-
SHA512
ca9395be04da38294baf29dc60ccbcd57ec84d164cd2c102e6c3ffd4f291f89f3586f2591a83f1165e971e1efaa313205bc1d2a179cb79b6c98203722ead7566
Score
10/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
WINWORD.EXEpid process 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE 1496 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 1844 1496 regsvr32.exe WINWORD.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 1496 wrote to memory of 1844 1496 WINWORD.EXE regsvr32.exe PID 1496 wrote to memory of 1844 1496 WINWORD.EXE regsvr32.exe PID 1496 wrote to memory of 1844 1496 WINWORD.EXE regsvr32.exe PID 1496 wrote to memory of 1844 1496 WINWORD.EXE regsvr32.exe PID 1496 wrote to memory of 1844 1496 WINWORD.EXE regsvr32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
regsvr32.exepid process 1844 regsvr32.exe -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1496 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\commercio,07.20.doc"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" w8.tmp2⤵
- Process spawned unexpected child process
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1844-3-0x0000000000000000-mapping.dmp