Analysis
-
max time kernel
146s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 09:11
Behavioral task
behavioral1
Sample
055c7e27af7f47519d7b7e373824404d2380b758d9484fe95ccb3c9d40b111c8.doc
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
055c7e27af7f47519d7b7e373824404d2380b758d9484fe95ccb3c9d40b111c8.doc
Resource
win10v2004-20221111-en
General
-
Target
055c7e27af7f47519d7b7e373824404d2380b758d9484fe95ccb3c9d40b111c8.doc
-
Size
19KB
-
MD5
1f4f9331a62c3f232f4e49459eaf80f2
-
SHA1
d147ee9ef3dbee38de242dafa3708072e5c23254
-
SHA256
055c7e27af7f47519d7b7e373824404d2380b758d9484fe95ccb3c9d40b111c8
-
SHA512
2ffa02d1a0368cacab3f4c3653f62c3cc73828182eaadb652cc892671ce0e641536f1eafaae227fdcd66d8b047050ab6f44e2b2a8fa4fa373f44148b45c6c675
-
SSDEEP
192:mP74w02N7yAl/TZWYya8Z0jphl4tXvQr/MnMDd+XVCbTaW:a4N2h7D8Z0jXatGUnMDd+lC
Malware Config
Signatures
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1768 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
Processes:
WINWORD.EXEpid process 1768 WINWORD.EXE 1768 WINWORD.EXE 1768 WINWORD.EXE 1768 WINWORD.EXE 1768 WINWORD.EXE 1768 WINWORD.EXE 1768 WINWORD.EXE 1768 WINWORD.EXE 1768 WINWORD.EXE 1768 WINWORD.EXE 1768 WINWORD.EXE 1768 WINWORD.EXE 1768 WINWORD.EXE 1768 WINWORD.EXE 1768 WINWORD.EXE 1768 WINWORD.EXE 1768 WINWORD.EXE 1768 WINWORD.EXE 1768 WINWORD.EXE 1768 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\055c7e27af7f47519d7b7e373824404d2380b758d9484fe95ccb3c9d40b111c8.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1768-54-0x0000000072111000-0x0000000072114000-memory.dmpFilesize
12KB
-
memory/1768-55-0x000000006FB91000-0x000000006FB93000-memory.dmpFilesize
8KB
-
memory/1768-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1768-57-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/1768-58-0x0000000070B7D000-0x0000000070B88000-memory.dmpFilesize
44KB