922116d96a87d62e02fb7571b39e943929b3a9774dc3ddc47c503cecae42d0b1

Analysis

max time kernel
61s
max time network
59s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11-03-2023 04:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-03_1003.doc
Size

501.3MB
MD5

0b73336fd74afdbaa04abb044c6733fd
SHA1

1f91b4b74c9643631318b4d58f6660bb4d292782
SHA256

922116d96a87d62e02fb7571b39e943929b3a9774dc3ddc47c503cecae42d0b1
SHA512

99141d9b8694a12e89134c2ebd91b2887a7011df4b44498ff55471314ca57bfeabbf30ee90800d9b68615b7c730fda496123b1083378b2c44457e22df044f3e6
SSDEEP

6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1700	1988	regsvr32.exe	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 3 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1988 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

1988 WINWORD.EXE
1988 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1988 WINWORD.EXE
1988 WINWORD.EXE

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
1988	WINWORD.EXE

pid	process
1988	WINWORD.EXE
1988	WINWORD.EXE

pid	process
1988	WINWORD.EXE
1988	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2023-08-03_1003.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1988

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\054054.tmp"
2⤵
- Process spawned unexpected child process
PID:1700

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\054054.tmp"
3⤵
PID:1692

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\EOpWOefLiluhg\nWauSmbEHpamR.dll"
4⤵
PID:1060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\054054.tmp

Filesize
543.7MB

MD5
1cd2550e072ec2792339b133005549ed

SHA1
c2839a8bc63517bcee9ec16a222690e0f8aa3a74

SHA256
af9f8a5c3e4edb4798c25b6fe3e41eeba5d4a41782dbf81a7ba5b3a93652a02a

SHA512
e77442d144cad2635a3078a5359b24d9febc164fdfb6424cff5b4d02775ece2df3bdf6575170a9eec9b1d3ce22370efb726c9c611db86fac8d530ce2e9a7903e

Download Submit
C:\Users\Admin\AppData\Local\Temp\054058.zip

Filesize
867KB

MD5
6c839d892fef2f37d973ca28ce5e7a3b

SHA1
175ee07dc770ad81455d1f95152f1ae07e875e0e

SHA256
b2f19314b692f584203e6711e8d54f32b91a7864adbd203a4eaf6785042d47d9

SHA512
18a1ffa1876554a0e7716cbe5d77ce26a373aeb16992986bb8baaece2af502b576d7001a4271ceda09cec6fbbe750c06c8d40d4449ff8b52d01a924a49462af7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
20KB

MD5
d9da06d502e1045a472501ed6a5435d4

SHA1
49ab8cf7e01473caa36b56d1ec908e9bd9161f64

SHA256
37b32a6e4b1abea70dee7d6016a48a65208c9f36038d42841fed0e40aecbbea4

SHA512
389e4f9ec5b65c9b8bd53629c6647fac4ae07980a9f4568147c6812342dc8bc0797632dc4d515a91ab80a87b7ee314212076a5785bc6953ee469375b4e2e36ef

Download Submit
\Users\Admin\AppData\Local\Temp\054054.tmp

Filesize
450.2MB

MD5
e626f0548ffb3e705d98013fe7120004

SHA1
274d45c94ccb4a9c65ba0f82171b41b188c30a89

SHA256
81a9bd306cca52a53eb11f02440b897b81292406660ce18e75f6e95d2cb0ae2e

SHA512
7a9ad33cd5788928c8b0030e05004a684eddf253fb95a0d3ee57bebc41890755ca540dc09ccc800797813c91bacbc62cc4e2ba5b629eaed3eb981aa8d8a3d92d

Download Submit
\Users\Admin\AppData\Local\Temp\054054.tmp

Filesize
543.7MB

MD5
1cd2550e072ec2792339b133005549ed

SHA1
c2839a8bc63517bcee9ec16a222690e0f8aa3a74

SHA256
af9f8a5c3e4edb4798c25b6fe3e41eeba5d4a41782dbf81a7ba5b3a93652a02a

SHA512
e77442d144cad2635a3078a5359b24d9febc164fdfb6424cff5b4d02775ece2df3bdf6575170a9eec9b1d3ce22370efb726c9c611db86fac8d530ce2e9a7903e

Download Submit
memory/1060-1272-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/1692-1265-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1988-80-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-84-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-61-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-60-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-62-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-63-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-64-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-66-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-67-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-69-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-70-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-72-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-73-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-74-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-75-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-76-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-77-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-78-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-79-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-58-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-81-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-82-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-83-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-59-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-85-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-87-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-88-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-89-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-91-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-92-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-93-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-94-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-95-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-97-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-96-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-90-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-86-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-71-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-68-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-98-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-65-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-99-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-1072-0x0000000006220000-0x0000000006221000-memory.dmp

Filesize
4KB

Download
memory/1988-57-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1988-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1988-1264-0x0000000006220000-0x0000000006221000-memory.dmp

Filesize
4KB

Download