Analysis
-
max time kernel
148s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 09:15
Behavioral task
behavioral1
Sample
7a2422c7c9de57b2b1160f42bcc4b6a1a837134cbfd9ced11712df1553d70324.doc
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7a2422c7c9de57b2b1160f42bcc4b6a1a837134cbfd9ced11712df1553d70324.doc
Resource
win10v2004-20221111-en
General
-
Target
7a2422c7c9de57b2b1160f42bcc4b6a1a837134cbfd9ced11712df1553d70324.doc
-
Size
19KB
-
MD5
da0214f415e441fb88cb4f79d0820699
-
SHA1
16fa4cd82880bdee0aa4c10233ae4a21eec91e90
-
SHA256
7a2422c7c9de57b2b1160f42bcc4b6a1a837134cbfd9ced11712df1553d70324
-
SHA512
bb6cd017e186ae176575bb34afba93b7b3faf05d4fb4ee882be552f43da656be3dedabc2d6cadc725df369794014d3d0129cb8b999d2a6d11e444b0067f47272
-
SSDEEP
192:RbhHcNPh0QooIJTpxiOZBf9Q+My0950jBXht4hnfvuaemajpac:LHcNPKQooUxp+J950jBxtYeaemaZ
Malware Config
Signatures
-
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 304 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 21 IoCs
Processes:
WINWORD.EXEpid process 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE 304 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7a2422c7c9de57b2b1160f42bcc4b6a1a837134cbfd9ced11712df1553d70324.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:304
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/304-54-0x00000000726D1000-0x00000000726D4000-memory.dmpFilesize
12KB
-
memory/304-55-0x0000000070151000-0x0000000070153000-memory.dmpFilesize
8KB
-
memory/304-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/304-57-0x0000000076121000-0x0000000076123000-memory.dmpFilesize
8KB
-
memory/304-58-0x000000007113D000-0x0000000071148000-memory.dmpFilesize
44KB