29a04b4f2156b9bec934e4a50330246b9ccd6c14af7547d26195763a5cd250dd

Analysis

max time kernel
134s
max time network
144s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07-03-2023 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trident Alloys.doc
Size

526.2MB
MD5

b59808aba76dd0095aa06133382de9ed
SHA1

59aed06213b305d2877031e8ef489064ef74ca74
SHA256

2e116e6a43dcc2ee55df34664a7d5bfae36918f3a8ce5af97be6cb99e3a4de5b
SHA512

134c7c9929c277a3ec0403c2246214059d107c78c0056f8190218e0d16ded3cfaa7a4682d695f9e6212c66220cb222589c8fcd19f6ea70a00994eb06eec6566b
SSDEEP

3072:eoEW2aOtFjH0lP2IpjctfRcVVwEi/A8NVM1wIOCbX6bYLjWFJuvx7ueK6:ZE1aOtFa2I9c3aVw4zwxCbJ4Jup

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1408	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1408	WINWORD.EXE
1408	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Trident Alloys.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
20KB

MD5
65e76c56417aceb9ca61c49ada4c4020

SHA1
e98e67f8907bf992730bd5a6d71402c9ecc576e5

SHA256
c8e7efeb555278b9f30740b38907f9d5eae01fa31a25305751699212d843afaf

SHA512
dcd533d78874e72d67be792f11af60a5d251e7aae30b7a253369a740eba842ca35f96e145b71913c913cbde81066b4b0a523562f90c3a88badf9220a543f7e4d

Download Submit
memory/1408-160-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/1408-133-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/1408-81-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/1408-82-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/1408-187-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/1408-106-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/1408-80-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/1408-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1408-83-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/1408-214-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/1408-241-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/1408-268-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/1408-295-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/1408-322-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/1408-79-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/1408-342-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download