f5024a888b01cfd4af5a839245c1d2bf840ad2e8506808b68ebe8b8d8d521f92

Analysis

max time kernel
147s
max time network
56s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 11:28

Target

f5024a888b01cfd4af5a839245c1d2bf840ad2e8506808b68ebe8b8d8d521f92.doc
Size

32KB
MD5

9532aa7b05008fff94e7c1f91159a074
SHA1

56d2ce952701b6291136e2ecf64e9bb7e36ba9a8
SHA256

f5024a888b01cfd4af5a839245c1d2bf840ad2e8506808b68ebe8b8d8d521f92
SHA512

79c856b5d730a59d85ee46cc44b25095ce8f950df073cc3779194dcd89c968abced86176c39f0cb8065778e6873f5059c8cf93dd83085b99246f59bb97176ef2
SSDEEP

192:whaZyZEvA+6/6rT5bk8xgNAOR62qvEvPyOfpXFC5af/tv60jJ0KoVmlt7qh+t2sM:whSiSY5U2tyAC5af1v60jGKo8qQtn/N

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 9 IoCs

Modify Registry

Processes:

WINWORD.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1032 WINWORD.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

WINWORD.EXE

pid process

1032 WINWORD.EXE
1032 WINWORD.EXE
1032 WINWORD.EXE
1032 WINWORD.EXE
1032 WINWORD.EXE
1032 WINWORD.EXE

pid	process
1032	WINWORD.EXE

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1032-54-0x0000000072671000-0x0000000072674000-memory.dmp

Filesize
12KB

Download
memory/1032-55-0x00000000700F1000-0x00000000700F3000-memory.dmp

Filesize
8KB

Download
memory/1032-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1032-57-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1032-58-0x00000000710DD000-0x00000000710E8000-memory.dmp

Filesize
44KB

Download
memory/1032-79-0x00000000710DD000-0x00000000710E8000-memory.dmp

Filesize
44KB

Download