83e2c692ec2dae7f7fa0f5a905077d9d7cb8db68c48b8fc13d0c1cd3da361e51

Analysis

max time kernel
152s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83e2c692ec2dae7f7fa0f5a905077d9d7cb8db68c48b8fc13d0c1cd3da361e51.docm
Size

16KB
MD5

83b45a86e6e4f556b96dbeb9a301f141
SHA1

22deef5b3c5f760ae10e408440c69a62ac0d0ec2
SHA256

83e2c692ec2dae7f7fa0f5a905077d9d7cb8db68c48b8fc13d0c1cd3da361e51
SHA512

736e9d940df06309d1c8c0894233d537f8cbc47c7ba7bc1cd56552bbc7e21a2ff3540ddc3dc4c2ec636b0fe5c7857a5cb1a0c29328e6ce5bb5b2b3fe9288820c
SSDEEP

384:CTe7C9ro/yLs2CrSGYWoxfsQQ06Q6oVOLIQ1A:373Kw2CloxUJPfIQO

Score

10^/10

Malware Config

Extracted

Language

vba

URLs

vba.dropper

https://windows

Signatures

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1368 WINWORD.EXE
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

1368 WINWORD.EXE
1368 WINWORD.EXE
1368 WINWORD.EXE
1368 WINWORD.EXE
1368 WINWORD.EXE
1368 WINWORD.EXE
1368 WINWORD.EXE

pid	process
1368	WINWORD.EXE

pid	process
1368	WINWORD.EXE
1368	WINWORD.EXE
1368	WINWORD.EXE
1368	WINWORD.EXE
1368	WINWORD.EXE
1368	WINWORD.EXE
1368	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\83e2c692ec2dae7f7fa0f5a905077d9d7cb8db68c48b8fc13d0c1cd3da361e51.docm"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-54-0x0000000072641000-0x0000000072644000-memory.dmp

Filesize
12KB

Download
memory/1368-55-0x00000000700C1000-0x00000000700C3000-memory.dmp

Filesize
8KB

Download
memory/1368-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1368-57-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1368-58-0x00000000710AD000-0x00000000710B8000-memory.dmp

Filesize
44KB

Download
memory/1368-59-0x000000000061C000-0x0000000000620000-memory.dmp

Filesize
16KB

Download
memory/1368-61-0x000000000061C000-0x0000000000620000-memory.dmp

Filesize
16KB

Download
memory/1368-60-0x000000000061C000-0x0000000000620000-memory.dmp

Filesize
16KB

Download