Analysis
-
max time kernel
127s -
max time network
44s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
13-10-2021 14:48
Behavioral task
behavioral1
Sample
Azhar Resume.doc
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Azhar Resume.doc
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
Azhar Resume.doc
-
Size
129KB
-
MD5
3e5d7a46e50a468390e7c39707fae399
-
SHA1
52e57377c7010380a5315fd145bd269d9a572d78
-
SHA256
5d9410d397156cefc3ce4ce886436e187f36741fbdd25f25114c1b6da8b933ec
-
SHA512
7edb7efaafa41aed39fd715cbd7a2079262962305b56e72f70ca69baef04bdf61fce0b35271271c55f710895ae1881e3ff735a31a36a8d2d9da9cab27440f159
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1824 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1824 WINWORD.EXE 1824 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 1824 wrote to memory of 1624 1824 WINWORD.EXE splwow64.exe PID 1824 wrote to memory of 1624 1824 WINWORD.EXE splwow64.exe PID 1824 wrote to memory of 1624 1824 WINWORD.EXE splwow64.exe PID 1824 wrote to memory of 1624 1824 WINWORD.EXE splwow64.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Azhar Resume.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1624-64-0x0000000000000000-mapping.dmp
-
memory/1624-65-0x000007FEFB631000-0x000007FEFB633000-memory.dmpFilesize
8KB
-
memory/1824-60-0x0000000072131000-0x0000000072134000-memory.dmpFilesize
12KB
-
memory/1824-61-0x000000006FBB1000-0x000000006FBB3000-memory.dmpFilesize
8KB
-
memory/1824-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1824-63-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/1824-66-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB