38473a7da74c7513b8b26550778e6c10337bfa0c8037a5ec1040200c324dcc5b

Resubmissions

20-07-2021 11:03

210720-nzqxzersjs 10

20-07-2021 10:57

210720-n32mpq7vnn 10

Analysis

max time kernel
297s
max time network
276s
platform
windows7_x64
resource
win7v20210408
submitted
20-07-2021 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Despacho_de_informacion.doc
Size

178KB
MD5

d51027ccc08c7a7bf42e481e85196136
SHA1

02abd7025f5e3a721676714410c66fc5b8d95f22
SHA256

38473a7da74c7513b8b26550778e6c10337bfa0c8037a5ec1040200c324dcc5b
SHA512

008279cd4e860de0279b66eac71e2b9da31418e566d2e8f6be4e59cfdb7f192614aaeb838d1a3fea151804ec0f2fac6b093127fe1c8cdfc86c9caacfa69f0fc4

Score

1^/10

Malware Config

Signatures

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1624 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

1624 WINWORD.EXE
1624 WINWORD.EXE

Suspicious use of SetWindowsHookEx 21 IoCs

Processes:

WINWORD.EXE

pid	process
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Despacho_de_informacion.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1624

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-59-0x0000000072B31000-0x0000000072B34000-memory.dmp

Filesize
12KB

Download
memory/1624-60-0x00000000705B1000-0x00000000705B3000-memory.dmp

Filesize
8KB

Download
memory/1624-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1624-62-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download