Analysis
-
max time kernel
145s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14-03-2023 08:50
Behavioral task
behavioral1
Sample
72aa67307eacec9a58f1277ad9e113b3.doc
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
72aa67307eacec9a58f1277ad9e113b3.doc
Resource
win10v2004-20230221-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
72aa67307eacec9a58f1277ad9e113b3.doc
-
Size
12KB
-
MD5
72aa67307eacec9a58f1277ad9e113b3
-
SHA1
2675e53d03de7a2fa826686c26cc828345a9a420
-
SHA256
7ec1b313a7ad8ad39b3bf492af5d2a58d2ab60c716eb3984e8f5ba9d133f93fe
-
SHA512
43b49c09e8ac38470c49786e5baf510973ed36f4b50284479bcf18fc93569c9d43efde79e22414608b3fa38d9099771bb996b7593322a5f53b9d750dc44d327c
-
SSDEEP
192:E9ZKD7fr4cH1O6JN0jsIKrGrt5VTkd6ka:GMEcRJN0jsVKrtDTkd6
Score
1/10
Malware Config
Signatures
-
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1320 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 21 IoCs
Processes:
WINWORD.EXEpid process 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE 1320 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\72aa67307eacec9a58f1277ad9e113b3.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1320-54-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB