0d844e0b429813d9d18cca304b0719a1a6ec4de65702fc96580018344a9eae29

Analysis

max time kernel
249s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22-11-2022 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a0e6af473484c183dafbb3c29fc91bf.doc
Size

2.4MB
MD5

9a0e6af473484c183dafbb3c29fc91bf
SHA1

5f573156ba09334570e2256956502dddda0df03f
SHA256

0d844e0b429813d9d18cca304b0719a1a6ec4de65702fc96580018344a9eae29
SHA512

9e2ec5151fbf5f94dfc418edfb4f38df7b997abcb44866570bfa371997e48342c024f69a464123e6191369313d7c4fd8b5a4f85083d7c453b913f5d689b7bcd6
SSDEEP

24576:SntBDIDBw5oBpNYWYcGQL6cYjxp/+2Lt4KYHkyY4t1sGXgZM:kBDuBw5kkcrLCvaD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

664 WINWORD.EXE

Suspicious use of SetWindowsHookEx 21 IoCs

Processes:

WINWORD.EXE

pid	process
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE
664	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\9a0e6af473484c183dafbb3c29fc91bf.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:664

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/664-54-0x0000000072A81000-0x0000000072A84000-memory.dmp

Filesize
12KB

Download
memory/664-55-0x0000000070501000-0x0000000070503000-memory.dmp

Filesize
8KB

Download
memory/664-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/664-57-0x00000000763D1000-0x00000000763D3000-memory.dmp

Filesize
8KB

Download
memory/664-58-0x00000000714ED000-0x00000000714F8000-memory.dmp

Filesize
44KB

Download