1e42993e5a4ecaa294e3ea3957bd9c4fe1002657344c9cabafced17023f2651c

General

Target

1e42993e5a4ecaa294e3ea3957bd9c4fe1002657344c9cabafced17023f2651c.doc
Size

610KB
MD5

16441f311dfbc7e89404702d78d56a25
SHA1

fd955111d38b642652bd7a66a15b79f53c8d3996
SHA256

1e42993e5a4ecaa294e3ea3957bd9c4fe1002657344c9cabafced17023f2651c
SHA512

d972f2929960830dc486bf47cc8a4ad204b0124e6b7376c1f5e6dcd74d95358015d1e69527abe25050f38708f2c0b8ce133d6d6c495b3516b4a55ded023e3c5d

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 9 IoCs

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1032	WINWORD.EXE

Suspicious use of SetWindowsHookEx 20 IoCs

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1032-54-0x0000000072971000-0x0000000072974000-memory.dmp

Filesize
12KB

Download
memory/1032-55-0x00000000703F1000-0x00000000703F3000-memory.dmp

Filesize
8KB

Download
memory/1032-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1032-57-0x00000000758D1000-0x00000000758D3000-memory.dmp

Filesize
8KB

Download
memory/1032-58-0x00000000713DD000-0x00000000713E8000-memory.dmp

Filesize
44KB

Download