d389909c34d00248d0b07bda1aea5d07eed77932f80a4f42c9cf3fd59f8a55ef

Analysis

max time kernel
184s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-11-2022 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e108036b2269cea9072b51f7a5645740.doc
Size

21KB
MD5

e108036b2269cea9072b51f7a5645740
SHA1

642cf06d812e9e822dbcef404a8f4ffa14690e9a
SHA256

d389909c34d00248d0b07bda1aea5d07eed77932f80a4f42c9cf3fd59f8a55ef
SHA512

9906c4af01c8d0db462ddad924dfdb5d3619dfd76b926fd0d451ac970f68999a3029b8d95a4376482e9dffcdf4d0553ae7049eee12db82c7b9ecbd12c4817f3e
SSDEEP

384:wtn+pek/iWcS111lkt56tTsukyzQ/BDQ6yB50jRJQKEMtHU:wn+pekqWF111i56hWBobsCj9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1072 WINWORD.EXE

Suspicious use of SetWindowsHookEx 21 IoCs

Processes:

WINWORD.EXE

pid	process
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE
1072	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e108036b2269cea9072b51f7a5645740.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1072

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-54-0x0000000072C51000-0x0000000072C54000-memory.dmp

Filesize
12KB

Download
memory/1072-55-0x00000000706D1000-0x00000000706D3000-memory.dmp

Filesize
8KB

Download
memory/1072-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1072-57-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1072-58-0x00000000716BD000-0x00000000716C8000-memory.dmp

Filesize
44KB

Download