4e0947b236edd55683577f64ee4928c9d493de91cb71bcdcbeb0dded0799417d

Resubmissions

14-03-2023 10:34

230314-mmgaksgh5z 8

14-03-2023 10:29

230314-mh7xqsgh4w 8

14-03-2023 10:24

230314-mfw3fsgh2z 10

Analysis

max time kernel
112s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-03-2023 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14032023.doc
Size

514.4MB
MD5

de985fab7d0e11eff3ae0a1044868092
SHA1

3fce21270bc18ac725fc843e60dcd356c2ddc542
SHA256

1c50a2316e7d9a3710d705c7f6b26b87a6e1b16175925c66591c476d8482eaea
SHA512

cd9dbac7913ba63482700a338c76ca769354e070ae3654fba42080aaf8d12459450acb3fbe05cfadaadb83943945019218fe79c95fddd77587352d01d9499076
SSDEEP

6144:5yk1RgZZXbN63GW1Z7krKSUzMNYJJdKkOl950uH54Lg4Ne9C:5/MXJ6WW1Z7ktUgNYJJdKkOHC4D409

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1628	1976	regsvr32.exe	WINWORD.EXE

Loads dropped DLL 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1628 regsvr32.exe
992 regsvr32.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

pid	process
1628	regsvr32.exe
992	regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 11 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1976 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

992 regsvr32.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

WINWORD.EXE

pid process

1976 WINWORD.EXE
1976 WINWORD.EXE
1976 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1976 WINWORD.EXE
1976 WINWORD.EXE

description	flow	ioc
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
1976	WINWORD.EXE

pid	process
992	regsvr32.exe

pid	process
1976	WINWORD.EXE
1976	WINWORD.EXE
1976	WINWORD.EXE

pid	process
1976	WINWORD.EXE
1976	WINWORD.EXE

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

WINWORD.EXEregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1976 wrote to memory of 520	1976	WINWORD.EXE	splwow64.exe
PID 1976 wrote to memory of 520	1976	WINWORD.EXE	splwow64.exe
PID 1976 wrote to memory of 520	1976	WINWORD.EXE	splwow64.exe
PID 1976 wrote to memory of 520	1976	WINWORD.EXE	splwow64.exe
PID 1976 wrote to memory of 1628	1976	WINWORD.EXE	regsvr32.exe
PID 1976 wrote to memory of 1628	1976	WINWORD.EXE	regsvr32.exe
PID 1976 wrote to memory of 1628	1976	WINWORD.EXE	regsvr32.exe
PID 1976 wrote to memory of 1628	1976	WINWORD.EXE	regsvr32.exe
PID 1976 wrote to memory of 1628	1976	WINWORD.EXE	regsvr32.exe
PID 1976 wrote to memory of 1628	1976	WINWORD.EXE	regsvr32.exe
PID 1976 wrote to memory of 1628	1976	WINWORD.EXE	regsvr32.exe
PID 1628 wrote to memory of 992	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 992	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 992	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 992	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 992	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 992	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 992	1628	regsvr32.exe	regsvr32.exe
PID 992 wrote to memory of 112	992	regsvr32.exe	regsvr32.exe
PID 992 wrote to memory of 112	992	regsvr32.exe	regsvr32.exe
PID 992 wrote to memory of 112	992	regsvr32.exe	regsvr32.exe
PID 992 wrote to memory of 112	992	regsvr32.exe	regsvr32.exe
PID 992 wrote to memory of 112	992	regsvr32.exe	regsvr32.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\14032023.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:520

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\112552.tmp"
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\112552.tmp"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BYkICPWoSWiF\MgfVpcrj.dll"
4⤵
PID:112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\112552.tmp
Filesize
535.5MB

MD5
dc11f5b33804d7991dcf9a1a6a438bd5

SHA1
a498aff2629ef6a731079f971b69f44b828aa1f0

SHA256
0d908451da28a89bfd9397637349eee16892055fdaae2c8778c38e5e5d646c30

SHA512
e00dc941c6cb882c66d48bd30e8682ee98324b142b0352c0a91b7e4b8e5c76ff222f6de950feefdaa81b2a33d1350d22dc92b53190b2609f73a2e1dd4452ba75

Download Submit
C:\Users\Admin\AppData\Local\Temp\112558.zip
Filesize
842KB

MD5
2e76aa8b66e2e738aaf2b77afded17c0

SHA1
cc83f22bd257b81cf04de0c5079761f82507b1d7

SHA256
1e986cbf3a5c969d08121ad171978ef595163bdbf8d209d3218206aaf50be918

SHA512
500d0334b853b1e3581ed79e4fdf741c321728dcde78ad9696fe2db80ed828369a52bd7e517af56fa886bf6a2611073b66e38f062f48fdf91ed14f5f84eff6fb

Download Submit
\Users\Admin\AppData\Local\Temp\112552.tmp
Filesize
535.5MB

MD5
dc11f5b33804d7991dcf9a1a6a438bd5

SHA1
a498aff2629ef6a731079f971b69f44b828aa1f0

SHA256
0d908451da28a89bfd9397637349eee16892055fdaae2c8778c38e5e5d646c30

SHA512
e00dc941c6cb882c66d48bd30e8682ee98324b142b0352c0a91b7e4b8e5c76ff222f6de950feefdaa81b2a33d1350d22dc92b53190b2609f73a2e1dd4452ba75

Download Submit
\Users\Admin\AppData\Local\Temp\112552.tmp
Filesize
504.6MB

MD5
38eae39fcb0470f21ea64a1db31756e3

SHA1
4a51eb0117dc5ec99bfd5082512265b775fe5468

SHA256
c0c5e76f7697d9674bd4a84903b621fa2fa7688cd5b07dd6653e4310778c9dcf

SHA512
69c0819ecbf745ce4aba318ead8ea6a6bdf1b863adfe5f7eec79cad647c97ee1b6d95d23572689f7b4755aed0954e059a6af68c8f0a61d3501551b68833dfa67

Download Submit
memory/112-1745-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/992-1738-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1976-86-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-105-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-60-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-62-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-63-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-64-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-61-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-65-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-66-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-68-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-69-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-70-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-67-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-90-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-72-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-73-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-74-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-75-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-76-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-77-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-78-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-79-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-80-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-81-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-82-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-83-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-84-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-85-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-58-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-87-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-88-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-59-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-71-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-91-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-92-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-93-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-94-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-95-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-96-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-97-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-98-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-99-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-100-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-101-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-102-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-103-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-104-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-107-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-106-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-109-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-110-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-112-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-113-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-114-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-115-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-116-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-117-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-111-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1976-108-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-89-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/1976-1481-0x00000000069F0000-0x00000000069F1000-memory.dmp

Filesize
4KB

Download
memory/1976-1732-0x00000000069F0000-0x00000000069F1000-memory.dmp

Filesize
4KB

Download