2afe5e32b4abc18e1240720b13fe4ad136f697afb688314cf6de276761f6bb5c

Analysis

max time kernel
177s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

综布标准模版（附CAD图）/综布标准模版（附CAD图）/综合布线标准模板.doc
Size

265KB
MD5

780d838bf210f7baadc96bde7aa83eab
SHA1

4ab18c4a4f4374b4504f792a7bec7d127098447c
SHA256

fe4d50d94926f6513df1a7449450b4cb5ed36bf5cec7f9406cdc043a25feb644
SHA512

efb2444ab681ba9e6543b8374e3d3231cc6b7d0bddf873e6e0c024da0322d60de71f5a19db995f7866f4d50e6a770c771ee1d2e94010a40e5751637cb345d8cf
SSDEEP

3072:ovUFldNi7QkMrmBoVRcCZxWDptN/+8KoyEg9T7:oo3i7QkvoPZEDp3/1K/9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1828 WINWORD.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

WINWORD.EXE

pid process

1828 WINWORD.EXE
1828 WINWORD.EXE
1828 WINWORD.EXE
1828 WINWORD.EXE
1828 WINWORD.EXE
1828 WINWORD.EXE

pid	process
1828	WINWORD.EXE

pid	process
1828	WINWORD.EXE
1828	WINWORD.EXE
1828	WINWORD.EXE
1828	WINWORD.EXE
1828	WINWORD.EXE
1828	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\综布标准模版（附CAD图）\综布标准模版（附CAD图）\综合布线标准模板.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1828

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1828-54-0x0000000072191000-0x0000000072194000-memory.dmp

Filesize
12KB

Download
memory/1828-55-0x000000006FC11000-0x000000006FC13000-memory.dmp

Filesize
8KB

Download
memory/1828-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1828-57-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1828-58-0x0000000070BFD000-0x0000000070C08000-memory.dmp

Filesize
44KB

Download
memory/1828-59-0x0000000070BFD000-0x0000000070C08000-memory.dmp

Filesize
44KB

Download