9f4539a6519bac34a0d63908ae999e77de2535f2168faa494163ca85f585ca6c

Analysis

max time kernel
251s
max time network
353s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 10:08

Target

9f4539a6519bac34a0d63908ae999e77de2535f2168faa494163ca85f585ca6c.doc
Size

37KB
MD5

dedbfb668a93267cc7e696bddb86fa8f
SHA1

13b7fda8cf1cab2f1f6bcf2703986df11f52d527
SHA256

9f4539a6519bac34a0d63908ae999e77de2535f2168faa494163ca85f585ca6c
SHA512

51d600fadf3426e4d2d0ff4d0977741f26b02313e31c2250731ab0e38f26ab41d19629c8f9b3fa233bd19d5b8906349db5c39d08a058d6e151b6c699187d07bf
SSDEEP

384:jCGbiSdJ7U/vMXtGX0jUqMDJgnmDyfktRIutGl6U6L:jnJgc2ryPfaltGl6

Score

4^/10

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

Modify Registry

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

268 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

268 WINWORD.EXE
268 WINWORD.EXE

pid	process
268	WINWORD.EXE

pid	process
268	WINWORD.EXE
268	WINWORD.EXE

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/268-54-0x0000000072511000-0x0000000072514000-memory.dmp

Filesize
12KB

Download
memory/268-55-0x000000006FF91000-0x000000006FF93000-memory.dmp

Filesize
8KB

Download
memory/268-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/268-57-0x0000000070F7D000-0x0000000070F88000-memory.dmp

Filesize
44KB

Download
memory/268-58-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download
memory/268-59-0x000000000056B000-0x0000000000570000-memory.dmp

Filesize
20KB

Download
memory/268-61-0x00000000004C3000-0x00000000004C7000-memory.dmp

Filesize
16KB

Download
memory/268-60-0x000000000056B000-0x0000000000570000-memory.dmp

Filesize
20KB

Download
memory/268-62-0x000000000056B000-0x0000000000570000-memory.dmp

Filesize
20KB

Download
memory/268-63-0x000000000056B000-0x0000000000570000-memory.dmp

Filesize
20KB

Download
memory/268-64-0x0000000070F7D000-0x0000000070F88000-memory.dmp

Filesize
44KB

Download
memory/268-65-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/268-66-0x0000000070F7D000-0x0000000070F88000-memory.dmp

Filesize
44KB

Download