Analysis
-
max time kernel
147s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 09:22
Behavioral task
behavioral1
Sample
849c085c8f78da222e15fa2b7a6fd08071b7d1863da4ed339b797e614b15a393.doc
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
849c085c8f78da222e15fa2b7a6fd08071b7d1863da4ed339b797e614b15a393.doc
Resource
win10v2004-20221111-en
General
-
Target
849c085c8f78da222e15fa2b7a6fd08071b7d1863da4ed339b797e614b15a393.doc
-
Size
16KB
-
MD5
89d90f25dde79f6ef5d8417ceff148ef
-
SHA1
3e399ea263d544bcc7a5fd6e9a4f7281fbf93546
-
SHA256
849c085c8f78da222e15fa2b7a6fd08071b7d1863da4ed339b797e614b15a393
-
SHA512
5e98c61ae84aa524804f49bab8f1bdeaf2c8cc85c1fe31834a9b225574a976e4665a2033ee4df6bc600c4e911e912cf110750f4f17700e315c95f3c38f0b9ada
-
SSDEEP
192:Kf8/9kC6gmORA5S+2Q8F8YukPCeqd+9Y5QG8YavvamST:CU96pCOpkPKb8Ya
Malware Config
Signatures
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1696 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
Processes:
WINWORD.EXEpid process 1696 WINWORD.EXE 1696 WINWORD.EXE 1696 WINWORD.EXE 1696 WINWORD.EXE 1696 WINWORD.EXE 1696 WINWORD.EXE 1696 WINWORD.EXE 1696 WINWORD.EXE 1696 WINWORD.EXE 1696 WINWORD.EXE 1696 WINWORD.EXE 1696 WINWORD.EXE 1696 WINWORD.EXE 1696 WINWORD.EXE 1696 WINWORD.EXE 1696 WINWORD.EXE 1696 WINWORD.EXE 1696 WINWORD.EXE 1696 WINWORD.EXE 1696 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\849c085c8f78da222e15fa2b7a6fd08071b7d1863da4ed339b797e614b15a393.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1696
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1696-54-0x0000000072DE1000-0x0000000072DE4000-memory.dmpFilesize
12KB
-
memory/1696-55-0x0000000070861000-0x0000000070863000-memory.dmpFilesize
8KB
-
memory/1696-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1696-57-0x00000000766D1000-0x00000000766D3000-memory.dmpFilesize
8KB
-
memory/1696-58-0x000000007184D000-0x0000000071858000-memory.dmpFilesize
44KB