Analysis
-
max time kernel
71s -
max time network
22s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
25-02-2021 00:05
Behavioral task
behavioral1
Sample
785c2845af631f33fda47b5a0fe5ccb338389b15e028e1ae7fa418d991e2c38f.bin.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
785c2845af631f33fda47b5a0fe5ccb338389b15e028e1ae7fa418d991e2c38f.bin.doc
Resource
win10v20201028
General
-
Target
785c2845af631f33fda47b5a0fe5ccb338389b15e028e1ae7fa418d991e2c38f.bin.doc
-
Size
20KB
-
MD5
c4fc7abac76c14df6d4a5ede971254d8
-
SHA1
ce3c31ed681b39ef2db3ab5c27f8c399f43ad443
-
SHA256
785c2845af631f33fda47b5a0fe5ccb338389b15e028e1ae7fa418d991e2c38f
-
SHA512
05ca3c1979fec3748b196959647641990dd66da700c9d7fbca3ea5f29ee27c62e5aa49e8d9838218e8d920c7092d178998f80b845c05f4d6808742b31ec94b7b
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1656 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1656 WINWORD.EXE 1656 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\785c2845af631f33fda47b5a0fe5ccb338389b15e028e1ae7fa418d991e2c38f.bin.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1656-2-0x0000000072131000-0x0000000072134000-memory.dmpFilesize
12KB
-
memory/1656-3-0x000000006FBB1000-0x000000006FBB3000-memory.dmpFilesize
8KB
-
memory/1656-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1656-5-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-7-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-9-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-10-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-11-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-12-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-14-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-16-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-18-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-20-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-22-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-24-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-26-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-28-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-30-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-32-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-34-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-36-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-38-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-40-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-42-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-44-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-46-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-48-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-49-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-50-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-51-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-52-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-53-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-55-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-57-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-59-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-61-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-63-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-65-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-67-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-69-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-71-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-73-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-75-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-77-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-79-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-81-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-83-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-85-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-87-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-89-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-91-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-93-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-95-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-97-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-99-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-101-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-103-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-105-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-107-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-109-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-111-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-113-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-115-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-117-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-119-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-121-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-123-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-125-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-127-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-129-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-131-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-133-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-135-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-137-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-139-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-141-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-143-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-145-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-147-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-149-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-151-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-153-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-155-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-157-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-159-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-161-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-163-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-165-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-167-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-169-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-171-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-173-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-175-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-177-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-179-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-181-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-183-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1656-185-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB