b840b2a914a1f64a546c1ce7ee92c49c59e7f1e43ac65d13b88d15535b4120a5

General

Target

b840b2a914a1f64a546c1ce7ee92c49c59e7f1e43ac65d13b88d15535b4120a5.doc
Size

5KB
MD5

78990db79a91149fd7ddcd888fba3f39
SHA1

6e8f7597e5c980e3851aa31f012616c43958287a
SHA256

b840b2a914a1f64a546c1ce7ee92c49c59e7f1e43ac65d13b88d15535b4120a5
SHA512

07e7e866d1d471bad8d4e7be0eb39211f62675d3a573fffb7eb26aa863b856773fb5518731d23ce218b607fb4a8e579ade75171e2ea6e600f0d26843daa7ae02

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1044 WINWORD.EXE

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

WINWORD.EXE

pid	process
1044	WINWORD.EXE
1044	WINWORD.EXE
1044	WINWORD.EXE
1044	WINWORD.EXE
1044	WINWORD.EXE
1044	WINWORD.EXE
1044	WINWORD.EXE
1044	WINWORD.EXE
1044	WINWORD.EXE
1044	WINWORD.EXE
1044	WINWORD.EXE
1044	WINWORD.EXE
1044	WINWORD.EXE
1044	WINWORD.EXE
1044	WINWORD.EXE
1044	WINWORD.EXE
1044	WINWORD.EXE
1044	WINWORD.EXE
1044	WINWORD.EXE
1044	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\b840b2a914a1f64a546c1ce7ee92c49c59e7f1e43ac65d13b88d15535b4120a5.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1044

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-54-0x0000000072601000-0x0000000072604000-memory.dmp

Filesize
12KB

Download
memory/1044-55-0x0000000070081000-0x0000000070083000-memory.dmp

Filesize
8KB

Download
memory/1044-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1044-57-0x000000007106D000-0x0000000071078000-memory.dmp

Filesize
44KB

Download
memory/1044-58-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing