85b3f137a1982946d87baa0ba6e06d79ba7d79560e99469842249f7c4f7179fb

General

Target

85b3f137a1982946d87baa0ba6e06d79ba7d79560e99469842249f7c4f7179fb.doc
Size

11KB
MD5

f4fc7719242c3670869af29d3e846515
SHA1

11514d4d4863977e7817bc9bd205eb69d49c4183
SHA256

85b3f137a1982946d87baa0ba6e06d79ba7d79560e99469842249f7c4f7179fb
SHA512

611e9aec55ad86627f4924e73bbb43b3c4233cdb16b4f955a5bb47d622c1b941704841f6470c1a5d76d09f973dce533052ca25d44d26d43bd83bf41e153a903f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

836 WINWORD.EXE

Suspicious use of SetWindowsHookEx 21 IoCs

Processes:

WINWORD.EXE

pid	process
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE
836	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\85b3f137a1982946d87baa0ba6e06d79ba7d79560e99469842249f7c4f7179fb.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:836

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-54-0x0000000072491000-0x0000000072494000-memory.dmp

Filesize
12KB

Download
memory/836-55-0x000000006FF11000-0x000000006FF13000-memory.dmp

Filesize
8KB

Download
memory/836-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/836-57-0x0000000075721000-0x0000000075723000-memory.dmp

Filesize
8KB

Download
memory/836-58-0x0000000070EFD000-0x0000000070F08000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing