Analysis

  • max time kernel
    152s
  • max time network
    113s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    13-12-2022 22:47

General

  • Target

    EBD57AEC150E11814AD41D54BE26B98366541DEB34D62BEEB3F05755A170ECAF.docx

  • Size

    10KB

  • MD5

    1eb546f2028e09bb7c67f2bf50ac9fa7

  • SHA1

    2fb75be209fe59a7a661363a783264fbdc0ddf8a

  • SHA256

    ebd57aec150e11814ad41d54be26b98366541deb34d62beeb3f05755a170ecaf

  • SHA512

    f053a8c341b2c07bf3880490ae8dc678796f350cafb45d1963abe2ab011ff84ebfc9a4fb9eac3696f222bae65d5e121a1baf1a8b404bd18beda354d11094ff1b

  • SSDEEP

    192:ScIMmtPqCJuEG/bBLgOcjhz2ru5JhBH3kZ:SPXyJTJgO3aJrg

Score
7/10

Malware Config

Signatures

  • Abuses OpenXML format to download file from external location 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\EBD57AEC150E11814AD41D54BE26B98366541DEB34D62BEEB3F05755A170ECAF.docx"
    1⤵
    • Abuses OpenXML format to download file from external location
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:744

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/744-54-0x0000000072D31000-0x0000000072D34000-memory.dmp
    Filesize

    12KB

  • memory/744-55-0x00000000707B1000-0x00000000707B3000-memory.dmp
    Filesize

    8KB

  • memory/744-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

  • memory/744-57-0x0000000075FF1000-0x0000000075FF3000-memory.dmp
    Filesize

    8KB

  • memory/744-58-0x000000007179D000-0x00000000717A8000-memory.dmp
    Filesize

    44KB

  • memory/744-59-0x000000007179D000-0x00000000717A8000-memory.dmp
    Filesize

    44KB