Analysis
-
max time kernel
147s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
31-01-2023 17:31
Behavioral task
behavioral1
Sample
d9a3a6ee60a3d70c7d22ca968a936765.doc
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d9a3a6ee60a3d70c7d22ca968a936765.doc
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
d9a3a6ee60a3d70c7d22ca968a936765.doc
-
Size
47KB
-
MD5
d9a3a6ee60a3d70c7d22ca968a936765
-
SHA1
fd030ee960bcda4bcf8cadf5b3f4bd042ea19438
-
SHA256
0d9da259d9d65a1b7b56f1c8cd0d4cba4a2b3e9e3c6450e6bcd73bfce8f846b6
-
SHA512
05a7adf7cc5bd9f9fc0da88b992b3f7f3bcf7a6a1c187389361a442539684db2c8f73d24200d5545b4fb46217abf7ad00cc27ac2c7ad847814e813c2cb12c4f7
-
SSDEEP
768:rx5i7l8PFHS1h0p0EdB3qTeJuGfcJj8cmXEb6ijcjcc1jcdtvc0aDpIdbcecVc07:rfO4dpp0SNNJuuEb6iIEvdQfj
Score
1/10
Malware Config
Signatures
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 848 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 21 IoCs
Processes:
WINWORD.EXEpid process 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d9a3a6ee60a3d70c7d22ca968a936765.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/848-54-0x00000000729D1000-0x00000000729D4000-memory.dmpFilesize
12KB
-
memory/848-55-0x0000000070451000-0x0000000070453000-memory.dmpFilesize
8KB
-
memory/848-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/848-57-0x00000000767C1000-0x00000000767C3000-memory.dmpFilesize
8KB
-
memory/848-58-0x000000007143D000-0x0000000071448000-memory.dmpFilesize
44KB