d52b198e0d418f8ab7082267843a8e029b6efd927013ba064c9dcbeb42b41a3c

General

Target

Customer Service Champion Machinery Movers.doc
Size

539.2MB
MD5

d5660953d03208bea455652af1edc55a
SHA1

61315be01a72ef59adceaf4ea8bca9378a514f25
SHA256

5cf898a65831710d8aeff9c74caaa85abce2c3276d810ef9ac95048648c6eda4
SHA512

ff232496743df00dd1bc53eb241386453c7c54ae75a81440447e02e529c8f4004753637b389d400641cfce05f7045f2cb65a3a3fca9bb86a50c775c4afa5f7f6
SSDEEP

3072:eoEW2aOtFjH0lP2IpjctfRcVVwEi/A8NVM1wIOCbX6bYLjWFJuvx7ueK6:ZE1aOtFa2I9c3aVw4zwxCbJ4Jup

Score

1^/10

Malware Config

Signatures

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2012	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2012	WINWORD.EXE
2012	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Customer Service Champion Machinery Movers.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2012-57-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-58-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-59-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-60-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-61-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-63-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-62-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-64-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-65-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-66-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-68-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-67-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-70-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-71-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-73-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-74-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-75-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-77-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-78-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-79-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-80-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-81-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-82-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-76-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-83-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-72-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-69-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-84-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download
memory/2012-111-0x00000000001D0000-0x00000000002D0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing