Analysis
-
max time kernel
150s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 10:02
Behavioral task
behavioral1
Sample
df04307cbc6f2ed58ca38cfa4663214a1eac440668408bc8e40b3471485b244e.doc
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
df04307cbc6f2ed58ca38cfa4663214a1eac440668408bc8e40b3471485b244e.doc
Resource
win10v2004-20220812-en
General
-
Target
df04307cbc6f2ed58ca38cfa4663214a1eac440668408bc8e40b3471485b244e.doc
-
Size
38KB
-
MD5
b40da2cd4b83ac44eaff9702623ba439
-
SHA1
0b30860618f2d967392b755b25d6592bb7213dd7
-
SHA256
df04307cbc6f2ed58ca38cfa4663214a1eac440668408bc8e40b3471485b244e
-
SHA512
96e258efeaa52588bc85eaa2c183e4cb2acca1f38a70f487674e7ec3548997fcaae8ef7a73ec5cd2b5c104e19a83e76fad67004097f35742d1c49c7fff93ba24
-
SSDEEP
384:Cg3JJkzXAlCQDbqaQs1tMrtLITUvw50jsacezveFi2by4RTiOa6Y8p:jJJk8EQv4eA0IveFi2byyGdb8p
Malware Config
Signatures
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1508 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
Processes:
WINWORD.EXEpid process 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\df04307cbc6f2ed58ca38cfa4663214a1eac440668408bc8e40b3471485b244e.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1508-54-0x00000000720B1000-0x00000000720B4000-memory.dmpFilesize
12KB
-
memory/1508-55-0x000000006FB31000-0x000000006FB33000-memory.dmpFilesize
8KB
-
memory/1508-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1508-57-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB
-
memory/1508-58-0x0000000070B1D000-0x0000000070B28000-memory.dmpFilesize
44KB