Analysis
-
max time kernel
153s -
max time network
42s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
15-09-2021 06:31
Static task
static1
Behavioral task
behavioral1
Sample
CRS.doc
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
CRS.doc
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
CRS.doc
-
Size
66KB
-
MD5
06064caf703f369ce9c331dcc4b9bf7d
-
SHA1
263142f6d387cb9b537c7f6eec529db1701dee7b
-
SHA256
e479676384d0a4c9f7426c9f430d1d9f1433c9d2ab65fdeb0f78cc576aa74e84
-
SHA512
2e116cc590bf2407f9343ee2ea4687b51f8d4f9eb452a4a486fe91fb99443dc8a0ffbcdb3e7ad752787d7fd4fa5b3c256bf746af5a562cf5b2872385b5374a87
Score
1/10
Malware Config
Signatures
-
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1832 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
WINWORD.EXEpid process 1832 WINWORD.EXE 1832 WINWORD.EXE 1832 WINWORD.EXE 1832 WINWORD.EXE 1832 WINWORD.EXE 1832 WINWORD.EXE 1832 WINWORD.EXE 1832 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\CRS.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1832-60-0x0000000072131000-0x0000000072134000-memory.dmpFilesize
12KB
-
memory/1832-61-0x000000006FBB1000-0x000000006FBB3000-memory.dmpFilesize
8KB
-
memory/1832-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1832-63-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB