29aaab0e34cb31fa12e95e3d8fbe042a0243d31368a6ff785c47cebd3405bbab

Analysis

max time kernel
151s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22-11-2022 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ebde1fe19129523a394b0037446418c.doc
Size

590KB
MD5

2ebde1fe19129523a394b0037446418c
SHA1

eecdf698356f4661979a95992dea9f4502434404
SHA256

29aaab0e34cb31fa12e95e3d8fbe042a0243d31368a6ff785c47cebd3405bbab
SHA512

da6a629a127baefc0c49272cc7e73517d53db38b9dd0a6a7b484af6706286a9aa34e5577f2cc365bb677d5a7ddd0e0f995cf2f88b4d98a307b573cd43953b1b6
SSDEEP

12288:IkkxnWXnTxL6DJPYYcO7HR2zeDhpfvxw41iMu2F9+iEN85Q:C5WIF1cO7HR2zeDhpfvxw41iEN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1624 WINWORD.EXE

Suspicious use of SetWindowsHookEx 21 IoCs

Processes:

WINWORD.EXE

pid	process
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2ebde1fe19129523a394b0037446418c.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1624

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-54-0x0000000072F11000-0x0000000072F14000-memory.dmp

Filesize
12KB

Download
memory/1624-55-0x0000000070991000-0x0000000070993000-memory.dmp

Filesize
8KB

Download
memory/1624-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1624-57-0x00000000767D1000-0x00000000767D3000-memory.dmp

Filesize
8KB

Download
memory/1624-58-0x000000007197D000-0x0000000071988000-memory.dmp

Filesize
44KB

Download