75d96ee4d9e94bf92db139253c67bfe4a2889ca171e663ec3bad66fde694315f

General

Target

75d96ee4d9e94bf92db139253c67bfe4a2889ca171e663ec3bad66fde694315f.docm
Size

111KB
MD5

572cbdf91dc3ba3b843548d6513c908b
SHA1

c4a1445988c626c5b0ad7ab6fd9e753dcaa29300
SHA256

75d96ee4d9e94bf92db139253c67bfe4a2889ca171e663ec3bad66fde694315f
SHA512

1c350973dd6d6346db30814ef04f9d75d8ae77feffee2c49020033d22d40e6623c252278144fade9d031aa5ccb4bf71551a3a36626d30a1f74e2983b1516699f

Score

1^/10

Malware Config

Signatures

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

892 WINWORD.EXE
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

892 WINWORD.EXE
892 WINWORD.EXE
892 WINWORD.EXE
892 WINWORD.EXE
892 WINWORD.EXE
892 WINWORD.EXE
892 WINWORD.EXE

pid	process
892	WINWORD.EXE

pid	process
892	WINWORD.EXE
892	WINWORD.EXE
892	WINWORD.EXE
892	WINWORD.EXE
892	WINWORD.EXE
892	WINWORD.EXE
892	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\75d96ee4d9e94bf92db139253c67bfe4a2889ca171e663ec3bad66fde694315f.docm"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:892

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/892-54-0x0000000072471000-0x0000000072474000-memory.dmp

Filesize
12KB

Download
memory/892-55-0x000000006FEF1000-0x000000006FEF3000-memory.dmp

Filesize
8KB

Download
memory/892-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/892-57-0x00000000755C1000-0x00000000755C3000-memory.dmp

Filesize
8KB

Download
memory/892-58-0x0000000070EDD000-0x0000000070EE8000-memory.dmp

Filesize
44KB

Download
memory/892-59-0x000000000054F000-0x0000000000553000-memory.dmp

Filesize
16KB

Download
memory/892-60-0x000000000054F000-0x0000000000553000-memory.dmp

Filesize
16KB

Download
memory/892-61-0x000000000054F000-0x0000000000553000-memory.dmp

Filesize
16KB

Download
memory/892-62-0x000000000054F000-0x0000000000553000-memory.dmp

Filesize
16KB

Download
memory/892-63-0x000000000054F000-0x0000000000553000-memory.dmp

Filesize
16KB

Download
memory/892-64-0x000000000054F000-0x0000000000553000-memory.dmp

Filesize
16KB

Download
memory/892-65-0x000000000054F000-0x0000000000553000-memory.dmp

Filesize
16KB

Download
memory/892-67-0x000000000054F000-0x0000000000553000-memory.dmp

Filesize
16KB

Download
memory/892-66-0x000000000054F000-0x0000000000553000-memory.dmp

Filesize
16KB

Download
memory/892-68-0x000000000054F000-0x0000000000553000-memory.dmp

Filesize
16KB

Download
memory/892-69-0x000000000054F000-0x0000000000553000-memory.dmp

Filesize
16KB

Download
memory/892-75-0x000000000054F000-0x0000000000553000-memory.dmp

Filesize
16KB

Download
memory/892-81-0x000000000054F000-0x0000000000553000-memory.dmp

Filesize
16KB

Download
memory/892-82-0x000000000054F000-0x0000000000553000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing