33a24ad4b225880bee5c9d40527022ea020daf2f6d7643269f4f739b3271f5de

Target

HRCComplaintProcedureForm (7).doc
Size

80KB
MD5

a411bb05ee4192202c88efdbd54552db
SHA1

6b0acf8175d39a1008bf9fb0d3c45bb63a3361e9
SHA256

33a24ad4b225880bee5c9d40527022ea020daf2f6d7643269f4f739b3271f5de
SHA512

6e424b2c2a7881d4969ddfaef595822f3d987e8fc49f578118c6d4ba25461ef53613405394f4ac366606ecfda08ede4d22f436f182aaee82ba9b5f7962cce6f4

Score

1^/10

Malware Config

Signatures

Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1608 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

PowerShell_ISE.exe

pid process

1596 PowerShell_ISE.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PowerShell_ISE.exe

description pid process

Token: SeDebugPrivilege 1596 PowerShell_ISE.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1608 WINWORD.EXE
1608 WINWORD.EXE

pid	process
1608	WINWORD.EXE

pid	process
1596	PowerShell_ISE.exe

description	pid	process
Token: SeDebugPrivilege	1596	PowerShell_ISE.exe

pid	process
1608	WINWORD.EXE
1608	WINWORD.EXE

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\HRCComplaintProcedureForm (7).doc"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1608

C:\Windows\sysWOW64\WindowsPowerShell\v1.0\PowerShell_ISE.exe
"C:\Windows\sysWOW64\WindowsPowerShell\v1.0\PowerShell_ISE.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1596-0-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/1596-1-0x00000000013C0000-0x00000000013C1000-memory.dmp

Filesize
4KB

Download
memory/1596-2-0x0000000004980000-0x0000000004981000-memory.dmp

Filesize
4KB

Download
memory/1596-3-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/1596-4-0x0000000005DC0000-0x0000000005DC1000-memory.dmp

Filesize
4KB

Download
memory/1596-5-0x0000000005F60000-0x0000000005F61000-memory.dmp

Filesize
4KB

Download
memory/1596-6-0x0000000001390000-0x0000000001391000-memory.dmp

Filesize
4KB

Download
memory/1596-7-0x0000000006630000-0x0000000006631000-memory.dmp

Filesize
4KB

Download
memory/1596-8-0x000000000A480000-0x000000000A481000-memory.dmp

Filesize
4KB

Download
memory/1596-11-0x000000000A660000-0x000000000A661000-memory.dmp

Filesize
4KB

Download
memory/1596-16-0x000000000A6A0000-0x000000000A6A1000-memory.dmp

Filesize
4KB

Download
memory/1596-17-0x000000000D7C0000-0x000000000D7C1000-memory.dmp

Filesize
4KB

Download
memory/1596-24-0x000000000A950000-0x000000000A951000-memory.dmp

Filesize
4KB

Download
memory/1596-25-0x000000000A800000-0x000000000A801000-memory.dmp

Filesize
4KB

Download
memory/1596-39-0x000000000AB40000-0x000000000AB41000-memory.dmp

Filesize
4KB

Download
memory/1596-40-0x000000000ABB0000-0x000000000ABB1000-memory.dmp

Filesize
4KB

Download
memory/1596-41-0x000000000D850000-0x000000000D851000-memory.dmp

Filesize
4KB

Download
memory/1596-42-0x0000000006910000-0x0000000006911000-memory.dmp

Filesize
4KB

Download
memory/1596-43-0x000000000A600000-0x000000000A601000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads