c3c3a36d438a5b90449ede0cf6a9c7485edfa5ea7a7642f92e8c42147224ee64

Analysis

max time kernel
52s
max time network
116s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-03-2023 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RechnungsDetails 2023.14.03_1126.doc
Size

522.3MB
MD5

a819cc60e2d88ab55424b2f247990a2f
SHA1

3cd978d94290d93e6f561eadc49365b85923a774
SHA256

d0206174cbfeb1469747405e793f18c23a032ab9aeac891acdd4bf81f9716aae
SHA512

16c6123b02059c79c551ed99d13125e345bacbd507b6f31f986b4034b7a2725912f7e8288adc9ad33021baecc8cc8ea17faf4915423d796c3c4fcdb4e67e205a
SSDEEP

6144:1620tqUx3Xu+7ZkRIDNGi9a0Va5UAClo:1620tqm3+I2ezcz5U3lo

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	240	1980	regsvr32.exe	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1980 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

1980 WINWORD.EXE
1980 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1980 WINWORD.EXE
1980 WINWORD.EXE

pid	process
1980	WINWORD.EXE

pid	process
1980	WINWORD.EXE
1980	WINWORD.EXE

pid	process
1980	WINWORD.EXE
1980	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\RechnungsDetails 2023.14.03_1126.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1980

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\103250.tmp"
2⤵
- Process spawned unexpected child process
PID:240

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\103250.tmp"
3⤵
PID:340

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GZLfJTSHgK\DsMeRsulVBtMLA.dll"
4⤵
PID:1096

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
699d4ad9b073e24ba1683b09a8eb0aac

SHA1
35d02c6ce420bfec4f1ceddd7d8db2364dab6860

SHA256
6c88c312bee79712ec0cc0987688114ecdbeba150719072589ce960489134fe3

SHA512
7a1d9acf6266f6258e0c5740b530c8c27fb9f29f07c1c3622e8534674982b36fc9c1fe4027c07359414d28f7436fea714d5f7c159dd183c16c45172d15a0758a

Download Submit
C:\Users\Admin\AppData\Local\Temp\103250.tmp
Filesize
246.9MB

MD5
86ab286ed5edee530362787ac268866c

SHA1
f9b26e80f231a65fd74a1408f6f032da06dc0fae

SHA256
7b2ff0e6395b546b2496da1bde6f2d4bbb9a309a4125fe49ca37b900b6364e0e

SHA512
d8dc5d40d5b5a3c6963d6d08b41c962a816bee781bf630d0ff3c89f06c26d95bd8f14783940f8c89813875df945c0c34e21c01dc05b2a5e8a40f684063742514

Download Submit
C:\Users\Admin\AppData\Local\Temp\103322.zip
Filesize
854KB

MD5
4e68ba145fa85af5242dfb5be4ac1f24

SHA1
5e948284d6378eee6ec448c944faff43bb2eea37

SHA256
5e73dbb35541709ac1a5887167dd503e7b1bffd3f5acf115df521cb8ea9a63ff

SHA512
9b4b16b253ed6120d97c60f36203e3a764e093902e59d0d415086eb3154ffc6f98d41d81c3c93462fdbbe0d23482cd54e270faa23a480846ea5f2e12af1ba4fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab87CA.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8B0B.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
20KB

MD5
5a276302dcccc8567fb7937e9a1432dd

SHA1
3468631af66265c568cb68f7ff3c4d07e3c83d37

SHA256
b82f862ebc0b131ca659d1449844764b3a88e2160284f2295d325688f6ce227b

SHA512
7eca5b57b7cfe94a448b33690532fa12c115eba97bae81bfd2ae76d48a68c4b4e0680d9d2a183b5c6797ef2c02af5bc608b344eaa3b3989eda828711a51229c4

Download Submit
\Users\Admin\AppData\Local\Temp\103250.tmp
Filesize
245.2MB

MD5
1e6e90b3770a4306929595bdd83c4da6

SHA1
66f7265ab160b673b1685ac2cda7c5a74683b768

SHA256
3c18618b7f4ba113a2d9b35e7df325d302609a0bae5ca59b1495c3e380af7165

SHA512
09f414d6a037daef0be2395d7817cb4478d4e86aa46e92c564528068bfe9810f4c045799507781ad19f235f3b4d21ebdc8d5f886406044d2734273075c88cd6e

Download Submit
\Users\Admin\AppData\Local\Temp\103250.tmp
Filesize
246.6MB

MD5
fb18b9337b180a8da0ff2c8c71dc8c73

SHA1
2706cab9443812e15c718cc47bab417d722f2671

SHA256
3a91db3607d8796d520bf2f575fdbc4e7f755212a379ba36f2f067251e8405ef

SHA512
2411d88a481e19a79d12e95a83d1041d6e246dac2ee89a06e7b468b3ec018801318a829f8ee11da9019039b8c4cb13a73142af74941942b39b400c6a0001467e

Download Submit
memory/340-1412-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/1096-1418-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1980-100-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-90-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-73-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-74-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-75-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-77-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-79-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-80-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-82-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-81-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-85-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-89-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-92-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-96-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-97-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-98-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-99-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-95-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-101-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-66-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-94-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-93-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-102-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-103-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-91-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-71-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-87-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-88-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-86-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-83-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-84-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-78-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-76-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-72-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-69-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-70-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-68-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-64-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-62-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-63-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-59-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-58-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-1210-0x0000000006070000-0x0000000006071000-memory.dmp

Filesize
4KB

Download
memory/1980-67-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-65-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-61-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-60-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-1417-0x0000000006070000-0x0000000006071000-memory.dmp

Filesize
4KB

Download
memory/1980-57-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download
memory/1980-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download