214a52e9fbec29c672e713aa0f1447b52f07445b43d0364fb0878869c4c9f2cd

Analysis

max time kernel
147s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

214a52e9fbec29c672e713aa0f1447b52f07445b43d0364fb0878869c4c9f2cd.doc
Size

8KB
MD5

3cef857d07491e44fbf829dcef248272
SHA1

1502e0a04ec6990457324b36df9ea9441d0d844f
SHA256

214a52e9fbec29c672e713aa0f1447b52f07445b43d0364fb0878869c4c9f2cd
SHA512

ced998b26e8ba43553cba87110e3dc7be69d7d5ba69838291fa3da7edfd9a6fa9d691489eed4f61bfee203ea56eccc718333ecf17bd95d8b1f78d2bd2bbc33cf
SSDEEP

96:Ft/rZTqLy35JJ6upOB4HDsANWe6yFujHoMk/WBmwKjo84gafig0cX:Ft/kwWuQahWVzi+tKPa1P

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1380 WINWORD.EXE

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

WINWORD.EXE

pid	process
1380	WINWORD.EXE
1380	WINWORD.EXE
1380	WINWORD.EXE
1380	WINWORD.EXE
1380	WINWORD.EXE
1380	WINWORD.EXE
1380	WINWORD.EXE
1380	WINWORD.EXE
1380	WINWORD.EXE
1380	WINWORD.EXE
1380	WINWORD.EXE
1380	WINWORD.EXE
1380	WINWORD.EXE
1380	WINWORD.EXE
1380	WINWORD.EXE
1380	WINWORD.EXE
1380	WINWORD.EXE
1380	WINWORD.EXE
1380	WINWORD.EXE
1380	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\214a52e9fbec29c672e713aa0f1447b52f07445b43d0364fb0878869c4c9f2cd.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1380

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1380-54-0x0000000072201000-0x0000000072204000-memory.dmp

Filesize
12KB

Download
memory/1380-55-0x000000006FC81000-0x000000006FC83000-memory.dmp

Filesize
8KB

Download
memory/1380-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1380-57-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1380-58-0x0000000070C6D000-0x0000000070C78000-memory.dmp

Filesize
44KB

Download