48ec2fcc897b3143efd660c5395cc876d6f91fa94a961e9505ed6af8fbd29544

General

Target

48ec2fcc897b3143efd660c5395cc876d6f91fa94a961e9505ed6af8fbd29544.doc
Size

707KB
MD5

c24b7c1cee20c631e0128a267bea9cdd
SHA1

9b161592ac93e904d8998887c07cb19d50153865
SHA256

48ec2fcc897b3143efd660c5395cc876d6f91fa94a961e9505ed6af8fbd29544
SHA512

2cd77d09e31acf0b433176f4cea13b46944f00fa67c0d622a0af4811f22a565f4910f7f9fe35e3418d36b220c916b462a4f7dd91b64231a46d257d6a6740423b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1808	WINWORD.EXE

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE
1808	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\48ec2fcc897b3143efd660c5395cc876d6f91fa94a961e9505ed6af8fbd29544.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-54-0x0000000072161000-0x0000000072164000-memory.dmp

Filesize
12KB

Download
memory/1808-55-0x000000006FBE1000-0x000000006FBE3000-memory.dmp

Filesize
8KB

Download
memory/1808-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1808-57-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/1808-58-0x0000000070BCD000-0x0000000070BD8000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing