Analysis
-
max time kernel
21s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
10-03-2023 11:00
General
-
Target
2023-03-08_1254.doc
-
Size
515.3MB
-
MD5
56fa3a6a45a6c48a6582c8ce100cb094
-
SHA1
79fa05d995a6dab74a6b85259ad83533fb4ecd08
-
SHA256
b4337a636049658bd281de947f0357e33efa17f3f80c3904d959cf6777df001d
-
SHA512
c65a4eab76532c4ca48eefe5814affc614b990eb2eac3e7cbcfe308ef9f0521382c9562be5aed5c338ddb9d761c3da66eda9de4638990c794bd33bc640252b35
-
SSDEEP
6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 9 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2023-03-08_1254.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\120120.tmp"2⤵
- Process spawned unexpected child process
-
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\120120.tmp"3⤵
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\YjbZCsbUAEuNua\VhDDinnw.dll"4⤵
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
131.2MB
MD5a7e4e807689b488f3a5393ac7a9baac1
SHA1de7d6282892dfb5b84e3580a99e6ffd5c151ef37
SHA256b651a5038cff0057f6db221b03e97132dd23550addaf731ebde0cb97ae9b60af
SHA512211d02cc7434d49db911df6aa1e1415457e872b7654b8f59c7a43e884a8bc149b34e68a7f07d0229f3257836ceb8c8146c9dd62d4c0796a7ec2cae61d17975d0
-
Filesize
867KB
MD56c839d892fef2f37d973ca28ce5e7a3b
SHA1175ee07dc770ad81455d1f95152f1ae07e875e0e
SHA256b2f19314b692f584203e6711e8d54f32b91a7864adbd203a4eaf6785042d47d9
SHA51218a1ffa1876554a0e7716cbe5d77ce26a373aeb16992986bb8baaece2af502b576d7001a4271ceda09cec6fbbe750c06c8d40d4449ff8b52d01a924a49462af7
-
Filesize
128.1MB
MD5a684b9d4c53435959f263c4ca196a84d
SHA135d3d0ab9f5d09eab27e2bd70eea4d9907076873
SHA25632332556f81135af5f2c10ec33565e7faa69f0f7c9b293ff4c51939681191323
SHA5129ddb500499a1cf716cc42d4d558e6880ed83772618304de7dab291ba3c6c9b0669910272e1b26257d156626b761ddcdd5e10b1342acf44cd3c7fe476e1801353
-
Filesize
91.5MB
MD5177d920cb4b13884e29d7247e655506b
SHA1f81270eff5d6a21cd303cdd2aa02bf155ef35577
SHA25658760e5a47e1a4dfd3a8770dd043cd07c4b6290f98a5a74c1625406193c90b82
SHA5129182654abf26ab021fec29bae37b6d04715bdfee622a70272e044de44396770af1c8f7b1e80bc7d69b44b7fe4e1d5a4dc9046fca1da4e4fe990cc0bf99d424a9
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB