f8d44d7880640da690ec310d1d562a37f0f63e45503d8eb8710f40dd062cf401

General

Target

SARS Documents.doc
Size

36KB
MD5

ea2c22c96421b40396d9d9a5ef2e4dc4
SHA1

77a04b21f8e8c57b7f24c6681fcac30ca09fd42b
SHA256

f8d44d7880640da690ec310d1d562a37f0f63e45503d8eb8710f40dd062cf401
SHA512

70068a330cbb1e368f941625649e0a5f0fc8f6da9def43a440ca9d19fece1f74a51ff03f7e430278f1cdf9c2c762f271f985b15cf96a40438d9a9bcc97b5814a

Score

1^/10

Malware Config

Signatures

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

452 WINWORD.EXE
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

452 WINWORD.EXE
452 WINWORD.EXE
452 WINWORD.EXE
452 WINWORD.EXE
452 WINWORD.EXE
452 WINWORD.EXE
452 WINWORD.EXE

pid	process
452	WINWORD.EXE

pid	process
452	WINWORD.EXE
452	WINWORD.EXE
452	WINWORD.EXE
452	WINWORD.EXE
452	WINWORD.EXE
452	WINWORD.EXE
452	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 452 wrote to memory of 1844	452	WINWORD.EXE	splwow64.exe
PID 452 wrote to memory of 1844	452	WINWORD.EXE	splwow64.exe
PID 452 wrote to memory of 1844	452	WINWORD.EXE	splwow64.exe
PID 452 wrote to memory of 1844	452	WINWORD.EXE	splwow64.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SARS Documents.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:452

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/452-60-0x0000000072881000-0x0000000072884000-memory.dmp

Filesize
12KB

Download
memory/452-61-0x0000000070301000-0x0000000070303000-memory.dmp

Filesize
8KB

Download
memory/452-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1844-63-0x0000000000000000-mapping.dmp

Download
memory/1844-64-0x000007FEFBEF1000-0x000007FEFBEF3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing