d7b0e383ce85ee2508a8726261cf8d628c34ce71515de3f7d1f7db0ead9cf3e7

Analysis

max time kernel
42s
max time network
53s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 07:31

Target

d7b0e383ce85ee2508a8726261cf8d628c34ce71515de3f7d1f7db0ead9cf3e7.docm
Size

53KB
MD5

5bb70af56c5707aee75853d55cf192fd
SHA1

444c9749a1cc6eb6be8840c798a4df8cc0f6e8da
SHA256

d7b0e383ce85ee2508a8726261cf8d628c34ce71515de3f7d1f7db0ead9cf3e7
SHA512

293ec26b50bf542be737e8621724b76a4b3146779a3c311042043be2bab7c609e0b792face1266e489943531ced3c663c97885c6b4054b40b8a2969886140768
SSDEEP

1536:ZPev13UF8iEkto5LpbZRJnLOpO/bTDXkdRKss5HpOSaBvdK:lev13UFjEOo59ZOpO/bUDs5Hj4K

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 9 IoCs

Modify Registry

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

896 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

896 WINWORD.EXE
896 WINWORD.EXE

pid	process
896	WINWORD.EXE

pid	process
896	WINWORD.EXE
896	WINWORD.EXE

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/896-54-0x0000000072A51000-0x0000000072A54000-memory.dmp

Filesize
12KB

Download
memory/896-55-0x00000000704D1000-0x00000000704D3000-memory.dmp

Filesize
8KB

Download
memory/896-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/896-57-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/896-58-0x00000000714BD000-0x00000000714C8000-memory.dmp

Filesize
44KB

Download
memory/896-84-0x00000000714BD000-0x00000000714C8000-memory.dmp

Filesize
44KB

Download