Analysis

  • max time kernel
    106s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    14-03-2023 08:53

General

  • Target

    09bc8adfe0ffd0fccff2be1dda684beb.doc

  • Size

    1.1MB

  • MD5

    09bc8adfe0ffd0fccff2be1dda684beb

  • SHA1

    e29f863614917427451331f6da1904eb2fa88ea3

  • SHA256

    d74e39811a50e6fec07b45cdd4fcb5237616ee6af5e0e834aa55bc98332d4c43

  • SHA512

    863f8a6c3006c414a856c2b989cf378f9633615391cb3ececa489c717a49b1b8a907371666ae58de42e618d049679ae447575c4f5bb93a453ac6b74f4d598025

  • SSDEEP

    24576:c1Gjm3E180RVWTWrlGmKJWVlyiQo6E0tRpzAY:c1Ga3EL2MGmK2lDQtZn

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\09bc8adfe0ffd0fccff2be1dda684beb.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1768

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      76c2a48a188750668cc14fc59a184ad0

      SHA1

      716d68ae8d4153adaa348e5a216823deafb2e0eb

      SHA256

      9710ea6314cedd4e2663848cb6191f8e5509dc4c3ba2ea8b4d391e6a94e9e060

      SHA512

      3e4d90db6b502fdddd0137fce9d16ce817616423b8d5c3be0968a5ef302a8b625833f011b491a4ce62222f4028e231aeaf0b377224db1dfee44b378517f2f2f4

    • memory/1724-54-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1724-57-0x0000000000480000-0x0000000000580000-memory.dmp
      Filesize

      1024KB

    • memory/1724-58-0x0000000000480000-0x0000000000580000-memory.dmp
      Filesize

      1024KB

    • memory/1724-59-0x0000000000480000-0x0000000000580000-memory.dmp
      Filesize

      1024KB

    • memory/1724-60-0x0000000000480000-0x0000000000580000-memory.dmp
      Filesize

      1024KB

    • memory/1724-84-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB