Analysis
-
max time kernel
148s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 03:50
Static task
static1
Behavioral task
behavioral1
Sample
f2973c6947472704baf28e9db060471323d290d4a4d74f41389b6cb83f3efd7b.doc
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f2973c6947472704baf28e9db060471323d290d4a4d74f41389b6cb83f3efd7b.doc
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
f2973c6947472704baf28e9db060471323d290d4a4d74f41389b6cb83f3efd7b.doc
-
Size
9KB
-
MD5
ee4338ee50fa964115235527c63bb479
-
SHA1
e97768b0eeacc33805e98c9ef7928e02150d8355
-
SHA256
f2973c6947472704baf28e9db060471323d290d4a4d74f41389b6cb83f3efd7b
-
SHA512
b328ba0d6bcb5ba35bc5fc1e9ad56b055647d252e926acb07a0df1fc4b8a3b0fc5d39f3cd213d122a5f713e138fcf692b5393226ebc63df6a821aa0c2320e931
Score
1/10
Malware Config
Signatures
-
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1680 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 21 IoCs
Processes:
WINWORD.EXEpid process 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f2973c6947472704baf28e9db060471323d290d4a4d74f41389b6cb83f3efd7b.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1680-54-0x00000000728E1000-0x00000000728E4000-memory.dmpFilesize
12KB
-
memory/1680-55-0x0000000070361000-0x0000000070363000-memory.dmpFilesize
8KB
-
memory/1680-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1680-57-0x0000000076451000-0x0000000076453000-memory.dmpFilesize
8KB
-
memory/1680-58-0x000000007134D000-0x0000000071358000-memory.dmpFilesize
44KB