Analysis
-
max time kernel
152s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 05:39
Behavioral task
behavioral1
Sample
2ffb08e74dd1529e3d1e2eca9ce81e65bcf4dd360c8825dbe4c6905f46b039e3.doc
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2ffb08e74dd1529e3d1e2eca9ce81e65bcf4dd360c8825dbe4c6905f46b039e3.doc
Resource
win10v2004-20221111-en
General
-
Target
2ffb08e74dd1529e3d1e2eca9ce81e65bcf4dd360c8825dbe4c6905f46b039e3.doc
-
Size
789KB
-
MD5
9c878d95d08aa3083f2e9cb9c80472ed
-
SHA1
368350f1d39a016044ad687116075a6efb118f92
-
SHA256
2ffb08e74dd1529e3d1e2eca9ce81e65bcf4dd360c8825dbe4c6905f46b039e3
-
SHA512
1f5f720f186aa16348d65f42e99efbb5574f26d5a9344befc3094b2dd6b14d3f06670851cc006defd615673c2975b50bfdc3a96ba9666845a3ce92946a9ccc02
-
SSDEEP
24576:SJkibpcQbQCkfWjbPZOdVEVqpjoaIRqmWHc6:SJkibpcQbQCkfWjbP
Malware Config
Signatures
-
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1732 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 21 IoCs
Processes:
WINWORD.EXEpid process 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE 1732 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2ffb08e74dd1529e3d1e2eca9ce81e65bcf4dd360c8825dbe4c6905f46b039e3.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1732
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1732-54-0x0000000072461000-0x0000000072464000-memory.dmpFilesize
12KB
-
memory/1732-55-0x000000006FEE1000-0x000000006FEE3000-memory.dmpFilesize
8KB
-
memory/1732-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1732-57-0x0000000075531000-0x0000000075533000-memory.dmpFilesize
8KB
-
memory/1732-58-0x0000000070ECD000-0x0000000070ED8000-memory.dmpFilesize
44KB