Analysis
-
max time kernel
145s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14-03-2023 08:51
Behavioral task
behavioral1
Sample
0af0c5a6fa15435b47e2b1e822346576.doc
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0af0c5a6fa15435b47e2b1e822346576.doc
Resource
win10v2004-20230220-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
0af0c5a6fa15435b47e2b1e822346576.doc
-
Size
12KB
-
MD5
0af0c5a6fa15435b47e2b1e822346576
-
SHA1
eb194a5adfc73a5233a29e0c4c3c2d55ec8f5f30
-
SHA256
ca394facf6ef4eac93b6b3caab7f8c000535dfea2d54295fc222c92756f1e9a0
-
SHA512
395fa8f199e8fee083f1c124ac2dc4a2a50582a1d3d38b33ea9310315934b4b6af6959c56c30f9eb02715cde18487c97cbc0bbcba332334456405c9292c0e9c5
-
SSDEEP
192:uXAK7fr4cH1O6JN0j26/Grtvxkd6fs3a:hcRJN0jLertJkd60
Score
1/10
Malware Config
Signatures
-
Processes:
WINWORD.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 748 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 21 IoCs
Processes:
WINWORD.EXEpid process 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE 748 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0af0c5a6fa15435b47e2b1e822346576.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/748-54-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB