7d7b4ade1d7099b8b30d2d317898d4e5cd4be07dbcc9b989174758be8297587a

Analysis

max time kernel
139s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d7b4ade1d7099b8b30d2d317898d4e5cd4be07dbcc9b989174758be8297587a.docm
Size

247KB
MD5

2c5596394c6013dcc214534d7bbdf8af
SHA1

e48345b9e06dd1eea451ed2164e6ecb108f37557
SHA256

7d7b4ade1d7099b8b30d2d317898d4e5cd4be07dbcc9b989174758be8297587a
SHA512

792081e94d7df28d06384350aa3dd1f22f5b49efb7eeff553b7b3ecfe79f6dce4b5fef2f6c6546fa446e4b96e72d2b69751740b7db8f3b4ef4af7ebbe32b817f
SSDEEP

6144:2ZPGGhzIEgwb8aDbAmS4ucqclDOW9DRbGhz:iGAIEgcZbAmeclD5tRbMz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1772 WINWORD.EXE
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

WINWORD.EXE

pid process

1772 WINWORD.EXE
1772 WINWORD.EXE
1772 WINWORD.EXE
1772 WINWORD.EXE

pid	process
1772	WINWORD.EXE

pid	process
1772	WINWORD.EXE
1772	WINWORD.EXE
1772	WINWORD.EXE
1772	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7d7b4ade1d7099b8b30d2d317898d4e5cd4be07dbcc9b989174758be8297587a.docm"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1772

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1772-54-0x0000000072231000-0x0000000072234000-memory.dmp

Filesize
12KB

Download
memory/1772-55-0x000000006FCB1000-0x000000006FCB3000-memory.dmp

Filesize
8KB

Download
memory/1772-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1772-57-0x0000000070C9D000-0x0000000070CA8000-memory.dmp

Filesize
44KB

Download
memory/1772-58-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download