Analysis
-
max time kernel
147s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
22-11-2022 21:29
Behavioral task
behavioral1
Sample
15e5fd5da7e0c399d4cc110e8a3de1a0.doc
Resource
win7-20220901-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
15e5fd5da7e0c399d4cc110e8a3de1a0.doc
Resource
win10v2004-20221111-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
15e5fd5da7e0c399d4cc110e8a3de1a0.doc
-
Size
24KB
-
MD5
15e5fd5da7e0c399d4cc110e8a3de1a0
-
SHA1
f95f89cc8e0ed63e849dbe07795eabf6c8d962e5
-
SHA256
9c99f39aa789216d1d1599ecb28c8e6d27b69153392389b12ad9972b9a7f58bd
-
SHA512
098e57c9f0ddc17cd9eb1e3bb657d96e7f30896b328107d0500525d221eec125ca03a9515e15223d33c293373dce6e9ad3b1483a2c77de64966fbe3dc708bd28
-
SSDEEP
384:fhq450jdRCKMK+peg/ikoSPObPjkyzQ/ZA5TPWKsxgT7pf:f3odsKMK+pegqkoKO9WITPVsaT
Score
1/10
Malware Config
Signatures
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1328 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
Processes:
WINWORD.EXEpid process 1328 WINWORD.EXE 1328 WINWORD.EXE 1328 WINWORD.EXE 1328 WINWORD.EXE 1328 WINWORD.EXE 1328 WINWORD.EXE 1328 WINWORD.EXE 1328 WINWORD.EXE 1328 WINWORD.EXE 1328 WINWORD.EXE 1328 WINWORD.EXE 1328 WINWORD.EXE 1328 WINWORD.EXE 1328 WINWORD.EXE 1328 WINWORD.EXE 1328 WINWORD.EXE 1328 WINWORD.EXE 1328 WINWORD.EXE 1328 WINWORD.EXE 1328 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\15e5fd5da7e0c399d4cc110e8a3de1a0.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1328-54-0x0000000072721000-0x0000000072724000-memory.dmpFilesize
12KB
-
memory/1328-55-0x00000000701A1000-0x00000000701A3000-memory.dmpFilesize
8KB
-
memory/1328-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1328-57-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB
-
memory/1328-58-0x000000007118D000-0x0000000071198000-memory.dmpFilesize
44KB