499806af033a9b03bf56e924b7daf5053a15f7577c726bb39abc3bedd9f1480f

Analysis

max time kernel
144s
max time network
161s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 10:07

Target

499806af033a9b03bf56e924b7daf5053a15f7577c726bb39abc3bedd9f1480f.doc
Size

72KB
MD5

eb0209febd5951a28e6680b56c75d740
SHA1

9612f12f1ba75846b72100bbfdc29aba1cbcb976
SHA256

499806af033a9b03bf56e924b7daf5053a15f7577c726bb39abc3bedd9f1480f
SHA512

21fbde52d82b83624f2e5d662f7454a24e4a9e60d1be4508ed1ab9d74570e3bfdb94f62ab397999be5e6d1d0f517aa1818b4b9fed5c15b4bd4f9f41705a5b0a0
SSDEEP

768:LjogMgIFBuwbPUXFKJlKi4cCkEsIvpuiVKXSe7WNTEyB5hb:LjNQuwbPdJlKPBkEsSMiVmx7WNTX

Score

4^/10

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

Modify Registry

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1180 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1180 WINWORD.EXE
1180 WINWORD.EXE

pid	process
1180	WINWORD.EXE

pid	process
1180	WINWORD.EXE
1180	WINWORD.EXE

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1180-54-0x00000000729A1000-0x00000000729A4000-memory.dmp

Filesize
12KB

Download
memory/1180-55-0x0000000070421000-0x0000000070423000-memory.dmp

Filesize
8KB

Download
memory/1180-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1180-57-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1180-58-0x000000007140D000-0x0000000071418000-memory.dmp

Filesize
44KB

Download
memory/1180-59-0x000000007140D000-0x0000000071418000-memory.dmp

Filesize
44KB

Download
memory/1180-60-0x0000000000871000-0x0000000000875000-memory.dmp

Filesize
16KB

Download
memory/1180-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1180-62-0x000000007140D000-0x0000000071418000-memory.dmp

Filesize
44KB

Download