3f9c536dce15055bffcf2ff1db596f0ba2f68678b6d05e8d53f72aefce2876c4

Analysis

max time kernel
204s
max time network
110s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22-11-2022 21:29

Target

607b0392ded37f2de8bc42e4c5199896.doc
Size

82KB
MD5

607b0392ded37f2de8bc42e4c5199896
SHA1

b235e97291112833963b70650abdfffd9db48046
SHA256

3f9c536dce15055bffcf2ff1db596f0ba2f68678b6d05e8d53f72aefce2876c4
SHA512

ff5495212f5a40a93b3cc4dd90aed473b6bf1cef4886307a65ea43ee86cfd121c109f1309fa9f811556e77876d2bd67f5e2f1c0bf6f38edcffd9b90d18774092
SSDEEP

768:U4Yp5Dyz8nyktad8jEprJ2sDXLWXoMnNS7y3C8KbmXrZbp8I4NWsMCIl+JbwVSaj:eDyz8nTUdLrJV7WXW8+b8NCIl8XnCwu

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 9 IoCs

Modify Registry

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1396 WINWORD.EXE
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

1396 WINWORD.EXE
1396 WINWORD.EXE
1396 WINWORD.EXE
1396 WINWORD.EXE
1396 WINWORD.EXE
1396 WINWORD.EXE
1396 WINWORD.EXE
1396 WINWORD.EXE

pid	process
1396	WINWORD.EXE

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1396-54-0x00000000728E1000-0x00000000728E4000-memory.dmp

Filesize
12KB

Download
memory/1396-55-0x0000000070361000-0x0000000070363000-memory.dmp

Filesize
8KB

Download
memory/1396-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1396-57-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download
memory/1396-58-0x000000007134D000-0x0000000071358000-memory.dmp

Filesize
44KB

Download
memory/1396-59-0x000000007134D000-0x0000000071358000-memory.dmp

Filesize
44KB

Download
memory/1396-60-0x0000000000567000-0x000000000056B000-memory.dmp

Filesize
16KB

Download
memory/1396-61-0x0000000000567000-0x000000000056B000-memory.dmp

Filesize
16KB

Download
memory/1396-62-0x0000000000567000-0x000000000056B000-memory.dmp

Filesize
16KB

Download
memory/1396-63-0x0000000000567000-0x000000000056B000-memory.dmp

Filesize
16KB

Download
memory/1396-64-0x0000000000567000-0x000000000056B000-memory.dmp

Filesize
16KB

Download
memory/1396-65-0x0000000000567000-0x000000000056B000-memory.dmp

Filesize
16KB

Download