Analysis
-
max time kernel
145s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
11-01-2023 19:01
Behavioral task
behavioral1
Sample
98b8bc053aa48a82968d9d3481d2e622.doc
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
98b8bc053aa48a82968d9d3481d2e622.doc
Resource
win10v2004-20221111-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
98b8bc053aa48a82968d9d3481d2e622.doc
-
Size
25KB
-
MD5
98b8bc053aa48a82968d9d3481d2e622
-
SHA1
0d2c7d4cbdc1ac8df1b89737e70e8aa999920400
-
SHA256
ea4f1df3a4649d42f2428b4f1f1e284035603da7195fbf82a37b82bda466bb97
-
SHA512
aab87986423abb39aed8daa52658d837247a16c3f96bce753725f599d8c8841348cbd99f7d9b68e6d5e1fc525d68f2173348500ed488cbc27a0e611f092725cc
-
SSDEEP
384:pl1TyC+peE/iKcR9PZDMPZ9JXTTxlukyzQ/cfCcPQ0j3QKEVrtUDp:7VD+peEqKAoZ9JyWan4fjMp
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 976 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 21 IoCs
pid Process 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE 976 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\98b8bc053aa48a82968d9d3481d2e622.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:976