87b1b71337ae7bc237d677fd6559ea6432facb27252fcefcac24bb6132ae8ac8

Analysis

max time kernel
69s
max time network
49s
platform
windows7_x64
resource
win7v20201028
submitted
25-02-2021 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87b1b71337ae7bc237d677fd6559ea6432facb27252fcefcac24bb6132ae8ac8.doc
Size

36KB
MD5

625cf5743fc703833c78842312950c00
SHA1

981fbf82e2c96f5c106b8727a5fc1b15bf7918ad
SHA256

87b1b71337ae7bc237d677fd6559ea6432facb27252fcefcac24bb6132ae8ac8
SHA512

13275bfb8b60c7d509c15686221ec8ed51816b991ab27d686f7f88e1c9cab367d7811f9f11e4c644557a9c399c8ce255ae33a6c33e447fe16851de622f6a1ca2

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

800 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

800 WINWORD.EXE
800 WINWORD.EXE

pid	process
800	WINWORD.EXE

pid	process
800	WINWORD.EXE
800	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\87b1b71337ae7bc237d677fd6559ea6432facb27252fcefcac24bb6132ae8ac8.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:800

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-2-0x0000000072E21000-0x0000000072E24000-memory.dmp

Filesize
12KB

Download
memory/800-3-0x00000000708A1000-0x00000000708A3000-memory.dmp

Filesize
8KB

Download
memory/800-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/800-5-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-7-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-9-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-10-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-11-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-12-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-14-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-16-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-18-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-20-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-22-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-24-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-26-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-28-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-30-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-32-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-34-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-36-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-38-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-40-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-42-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-44-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-46-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-48-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-49-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-50-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-51-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-52-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-53-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-55-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-57-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-59-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-61-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-63-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-65-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-67-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-69-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-71-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-73-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-75-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-77-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-79-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-81-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-83-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-85-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-87-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-89-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-91-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-93-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-95-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-97-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-99-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-101-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-103-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-105-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-107-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-109-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-111-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-113-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-115-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-117-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-119-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-121-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-123-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-125-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-127-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-129-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-131-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-133-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-135-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-137-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-139-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-141-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-143-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-145-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-147-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-149-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-151-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-153-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-155-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-157-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-159-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-161-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-163-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-165-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-167-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-169-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-171-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-173-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-175-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-177-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-179-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-181-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-183-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/800-185-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download