60ce0ae80a367110edfcaf0f25d0f93667752e11a233bdd28639a3cac90ebccb

Analysis

max time kernel
49s
max time network
121s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/03/2023, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
N.271 WAL 14.03.2023.doc
Size 510.3MB
Sample230314-ml7fdaeh62
SHA256 76e94f1bf0af4acd2e3dd307c9cb05ff1cce879a7c611e9e3dc01d8fd7a7f2cc
MD5 732336a4ffdffb6af529c92240c52aaa
SHA1 0f132ee237e3c419422d33a7fdc8687d3a62068f
SHA512 683ea54a98b83cbc857299e9511a165371d99a3f3e08f968faf4f3dba53c13de79d8676203f79a71f91cd68892157a1c37766951d4d81a57468e62be809d436a
SSDEEP 6144:1620tqUx3Xu+7ZkRIDNGi9a0Va5UAClo:1620tqm3+I2ezcz5U3lo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1848	1652	regsvr32.exe	27

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1652	WINWORD.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1652	WINWORD.EXE
1652	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1652	WINWORD.EXE
1652	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\N.271 WAL 14.03.2023.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1652
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\113459.tmp"
  2⤵
  - Process spawned unexpected child process
  PID:1848
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Users\Admin\AppData\Local\Temp\113459.tmp"
    3⤵
    PID:896
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RUqZOztOvNAi\IBbftHiR.dll"
      4⤵
      PID:936
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 61KB
SHA256 95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
MD5 e71c8443ae0bc2e282c73faead0a6dd3
SHA1 0c110c1b01e68edfacaeae64781a37b1995fa94b
SHA512 b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
SSDEEP 1536:Jk3XPi43VgGp0gB2itudTSRAn/TWTdWftu:CHa43V5p022iZ4CgA
MD5 SHA1 SHA512 SSDEEP

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 c9a7175dc2773d35c17df257691e696ff6c9dc4cacdae13488e6835154a44a99
MD5 127792e0434b8ae80760bfc96ae99bc2
SHA1 dd19735cd5545a17643000cfa14326d2c7993760
SHA512 ba902f4fc3cffab12bef157f702ab0be7c0360acf367ddc4e734bf30666073cf7df4379a53d8ad10e353f5ee66819e86d2de81994bee996064fcafa37f2a4709
MD5 SHA1 SHA512

Submit Download

113459.tmp

Path C:\Users\Admin\AppData\Local\Temp\113459.tmp
Size 520.5MB
SHA256 49cee0bc0eab473e54d654cc0d78dd82dbfd7c63a1a35890608a02c3168d52a4
MD5 5b052d774d42bbc4524541c8324d92b0
SHA1 3dff02e5e9b105fa758765cc85cb1c1008368bd1
SHA512 a141f16a770b4c3e93d268b7110c578e5f93743f65fc81e1efd91c7720a1b8caf5907f2a90b6014eaf688bd22b12e2b00352a7d1805ee3fe7a45ec7c784a7356
SSDEEP 12288:dffuNdDQDXPm6oQ/nK+Uc/F6qtkQk2N5owORa:dHwd0DXPQQ/K+5NKhALOR
MD5 SHA1 SHA512 SSDEEP

Submit Download

113537.zip

Path C:\Users\Admin\AppData\Local\Temp\113537.zip
Size 826KB
SHA256 56f87aebf126f019f553d125995f61ac3bef0b53fc896f17dad8597662d44389
MD5 cd29b97669086317dc0efb6a4070d671
SHA1 f44fab5b63a797115944caae4e9c25a2c3da9d0f
SHA512 94ca9bcc40ac967d9ad5f7c2814010b54140f81d08be89076e5427960e291c5103fa98bcc706e65843c0485ecf89468c4b2268dbddd5f2079372cf0735b87cb1
SSDEEP 6144:t9KJyGDzaLwRO0f4ZeNpM/OPhvRvtHMkAxAYpzDemD1f1G7i4ZL6sT:zKJ35ROGAC1RvIx/9emD1dG7iIT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cab37A8.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab37A8.tmp
Size 61KB
SHA256 10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
MD5 fc4666cbca561e864e7fdf883a9e6661
SHA1 2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA512 c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
SSDEEP 1536:pvl2gmukMiArbge/oKIxf+Q9yNJLaRCfIElhUuDz:pvl2gmZhpehIxfJsJLawfIElhUu3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar3AAB.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar3AAB.tmp
Size 161KB
SHA256 1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
MD5 be2bec6e8c5653136d3e72fe53c98aa3
SHA1 a8182d6db17c14671c3d5766c72e58d87c0810de
SHA512 0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
SSDEEP 1536:fUTJXlCUs0Rv0/29TFrJW5ibN/5YJkKCdru2hRIwjYvjCQ9vbmt6tT:fcJXq0Rn5JaJkHru2h2jCEvtt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Normal.dotm

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Size 20KB
SHA256 f4cd0506df067c07a6aafe030daf821c3f7a8c87ab393c10221e2037d2fbaa33
MD5 785c47a02cfd820dc30d1887455c07d4
SHA1 1da7bb8fa71885f3e5fb06c874f14138c7c22b7e
SHA512 94369ffa7366c6a9363a11b601aeb99a02ba8a8cbc82a077651f80be1a2d83895a10d999c805fca4c93a12e58d498f29b8da4523bd15b51e6a43a2cbb5045164
SSDEEP 384:Pjl/SU5R5LV+bheG6F7//oqoVi4UBppzbCkK4XMAPJNZ:j6Q4UB7mkKPAR
MD5 SHA1 SHA512 SSDEEP

Submit Download

113459.tmp

Path \Users\Admin\AppData\Local\Temp\113459.tmp
Size 520.5MB
SHA256 49cee0bc0eab473e54d654cc0d78dd82dbfd7c63a1a35890608a02c3168d52a4
MD5 5b052d774d42bbc4524541c8324d92b0
SHA1 3dff02e5e9b105fa758765cc85cb1c1008368bd1
SHA512 a141f16a770b4c3e93d268b7110c578e5f93743f65fc81e1efd91c7720a1b8caf5907f2a90b6014eaf688bd22b12e2b00352a7d1805ee3fe7a45ec7c784a7356
SSDEEP 12288:dffuNdDQDXPm6oQ/nK+Uc/F6qtkQk2N5owORa:dHwd0DXPQQ/K+5NKhALOR
MD5 SHA1 SHA512 SSDEEP

Submit Download

113459.tmp

Path \Users\Admin\AppData\Local\Temp\113459.tmp
Size 461.6MB
SHA256 483a4fe4685b744b407828b6603ae268cba6dd8f7ffbf2734ee269ed3ed3fcb0
MD5 c7dfe3a3265cbe509a8e13e061b0e7a4
SHA1 b16a98c95a4b817988d2eef0bf3c439fd772ab99
SHA512 c797d7bd7af2ff63e089b420af723833f98405aefa64c8628ba98a3025d6b7fade8f59881524785ae5c4014482ed40401a80982ec2cf78ac72b40501e0f8582b
SSDEEP 12288:dffuNdDQDXPm6oQ/nK+Uc/F6qtkQk2N5owORa:dHwd0DXPQQ/K+5NKhALOR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/896-1412-0x0000000000120000-0x0000000000121000-memory.dmp

Download

memory/936-1417-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/1652-1215-0x0000000006170000-0x0000000006171000-memory.dmp

Download

memory/1652-618-0x0000000005660000-0x0000000005760000-memory.dmp

Download

memory/1652-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/1652-1418-0x0000000006170000-0x0000000006171000-memory.dmp

Download

memory/1652-573-0x0000000005660000-0x0000000005760000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads