7b693a752fabb069ef0e9881e6c138036ebd8b01e9bfa12dd7d0403c6286cd1d

General

Target

7b693a752fabb069ef0e9881e6c138036ebd8b01e9bfa12dd7d0403c6286cd1d.docm
Size

111KB
MD5

d458997adc5725e8b36bf70df43a73a2
SHA1

c127694379a1fd8ac94a5d274e55a81356de3b89
SHA256

7b693a752fabb069ef0e9881e6c138036ebd8b01e9bfa12dd7d0403c6286cd1d
SHA512

7cbcb7edd600ca162b72f44d9be79521212a1546fd2de401b9e675e7d5e80a57b31a7758435d6d3f5acd4694fe2987619ec9482817d968b67ce45819f12025c9

Score

1^/10

Malware Config

Signatures

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1684 WINWORD.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

WINWORD.EXE

pid process

1684 WINWORD.EXE
1684 WINWORD.EXE
1684 WINWORD.EXE
1684 WINWORD.EXE
1684 WINWORD.EXE
1684 WINWORD.EXE

pid	process
1684	WINWORD.EXE

pid	process
1684	WINWORD.EXE
1684	WINWORD.EXE
1684	WINWORD.EXE
1684	WINWORD.EXE
1684	WINWORD.EXE
1684	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7b693a752fabb069ef0e9881e6c138036ebd8b01e9bfa12dd7d0403c6286cd1d.docm"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1684

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-54-0x00000000721C1000-0x00000000721C4000-memory.dmp

Filesize
12KB

Download
memory/1684-55-0x000000006FC41000-0x000000006FC43000-memory.dmp

Filesize
8KB

Download
memory/1684-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1684-57-0x0000000074F91000-0x0000000074F93000-memory.dmp

Filesize
8KB

Download
memory/1684-58-0x0000000070C2D000-0x0000000070C38000-memory.dmp

Filesize
44KB

Download
memory/1684-59-0x0000000000323000-0x0000000000326000-memory.dmp

Filesize
12KB

Download
memory/1684-60-0x0000000000323000-0x0000000000326000-memory.dmp

Filesize
12KB

Download
memory/1684-62-0x0000000000323000-0x0000000000326000-memory.dmp

Filesize
12KB

Download
memory/1684-61-0x0000000000323000-0x0000000000326000-memory.dmp

Filesize
12KB

Download
memory/1684-63-0x0000000000323000-0x0000000000326000-memory.dmp

Filesize
12KB

Download
memory/1684-64-0x0000000000323000-0x0000000000326000-memory.dmp

Filesize
12KB

Download
memory/1684-65-0x0000000000323000-0x0000000000326000-memory.dmp

Filesize
12KB

Download
memory/1684-66-0x0000000000323000-0x0000000000326000-memory.dmp

Filesize
12KB

Download
memory/1684-67-0x0000000000323000-0x0000000000326000-memory.dmp

Filesize
12KB

Download
memory/1684-68-0x0000000000323000-0x0000000000326000-memory.dmp

Filesize
12KB

Download
memory/1684-69-0x0000000000323000-0x0000000000326000-memory.dmp

Filesize
12KB

Download
memory/1684-75-0x0000000000323000-0x0000000000326000-memory.dmp

Filesize
12KB

Download
memory/1684-82-0x0000000000323000-0x0000000000326000-memory.dmp

Filesize
12KB

Download
memory/1684-81-0x0000000000323000-0x0000000000326000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing