bb10723b84120a064a026abf0fad37f083a8bd776763b5c9e1362a7193ca64c7

Analysis

max time kernel
166s
max time network
144s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 13:58

Target

bb10723b84120a064a026abf0fad37f083a8bd776763b5c9e1362a7193ca64c7.doc
Size

203KB
MD5

037fed1c59d443a13f13adc60d6cd392
SHA1

a20de0dba57eea6715aa79194e94632acef3a29b
SHA256

bb10723b84120a064a026abf0fad37f083a8bd776763b5c9e1362a7193ca64c7
SHA512

357b3b68ceaaaa62fb48705b7c52c799e7bafc41a395386f0f8c751740e22edda3fedfc8cf563214c8ac47ad9673550b5973ca344cea7454c05d6b16302eb88d
SSDEEP

1536:ULdvcU1+kBMX/4voB688zD58B7XibxLW85ZesoIC1VkGA3T//vOkZN4ZsNAEgfZV:g1dWPzyehmZULklzOkj4smVeq

Score

4^/10

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

Modify Registry

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

868 WINWORD.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

WINWORD.EXE

pid process

868 WINWORD.EXE
868 WINWORD.EXE
868 WINWORD.EXE

pid	process
868	WINWORD.EXE

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/868-54-0x0000000072691000-0x0000000072694000-memory.dmp

Filesize
12KB

Download
memory/868-55-0x0000000070111000-0x0000000070113000-memory.dmp

Filesize
8KB

Download
memory/868-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/868-57-0x00000000753D1000-0x00000000753D3000-memory.dmp

Filesize
8KB

Download
memory/868-58-0x00000000710FD000-0x0000000071108000-memory.dmp

Filesize
44KB

Download
memory/868-59-0x00000000710FD000-0x0000000071108000-memory.dmp

Filesize
44KB

Download
memory/868-60-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/868-61-0x00000000710FD000-0x0000000071108000-memory.dmp

Filesize
44KB

Download