54f42da8259c446dcaa20a678a382301b319b3936c9d42fe50300d28f6c5939a

General

Target

54f42da8259c446dcaa20a678a382301b319b3936c9d42fe50300d28f6c5939a.doc
Size

74KB
MD5

3ca459375646fa36b18b24e3d4121ef0
SHA1

4a577a89c89d5e641480a8b8c2dccd04ef810b98
SHA256

54f42da8259c446dcaa20a678a382301b319b3936c9d42fe50300d28f6c5939a
SHA512

ea0037de8f34fa5c8944d8acd02249202519e180473ac2fcfd9d21fe20305f91be72da4d9b466a5ea19264a881078e539aaf8f367eba93fa2d7329979ebcbbe4

Score

1^/10

Malware Config

Signatures

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

836 WINWORD.EXE
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

836 WINWORD.EXE
836 WINWORD.EXE
836 WINWORD.EXE
836 WINWORD.EXE
836 WINWORD.EXE
836 WINWORD.EXE
836 WINWORD.EXE

pid	process
836	WINWORD.EXE

pid	process
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\54f42da8259c446dcaa20a678a382301b319b3936c9d42fe50300d28f6c5939a.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-54-0x0000000072A91000-0x0000000072A94000-memory.dmp

Filesize
12KB

Download
memory/836-55-0x0000000070511000-0x0000000070513000-memory.dmp

Filesize
8KB

Download
memory/836-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/836-57-0x00000000714FD000-0x0000000071508000-memory.dmp

Filesize
44KB

Download
memory/836-58-0x0000000075381000-0x0000000075383000-memory.dmp

Filesize
8KB

Download
memory/836-59-0x00000000005A5000-0x00000000005A9000-memory.dmp

Filesize
16KB

Download
memory/836-60-0x00000000005A5000-0x00000000005A9000-memory.dmp

Filesize
16KB

Download
memory/836-62-0x00000000005A5000-0x00000000005A9000-memory.dmp

Filesize
16KB

Download
memory/836-61-0x00000000005A5000-0x00000000005A9000-memory.dmp

Filesize
16KB

Download
memory/836-63-0x00000000005A5000-0x00000000005A9000-memory.dmp

Filesize
16KB

Download
memory/836-64-0x00000000005A5000-0x00000000005A9000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing