60ce0ae80a367110edfcaf0f25d0f93667752e11a233bdd28639a3cac90ebccb

Analysis

max time kernel
49s
max time network
121s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-03-2023 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

N.271 WAL 14.03.2023.doc
Size

510.3MB
MD5

732336a4ffdffb6af529c92240c52aaa
SHA1

0f132ee237e3c419422d33a7fdc8687d3a62068f
SHA256

76e94f1bf0af4acd2e3dd307c9cb05ff1cce879a7c611e9e3dc01d8fd7a7f2cc
SHA512

683ea54a98b83cbc857299e9511a165371d99a3f3e08f968faf4f3dba53c13de79d8676203f79a71f91cd68892157a1c37766951d4d81a57468e62be809d436a
SSDEEP

6144:1620tqUx3Xu+7ZkRIDNGi9a0Va5UAClo:1620tqm3+I2ezcz5U3lo

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1848	1652	regsvr32.exe	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1652 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

1652 WINWORD.EXE
1652 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1652 WINWORD.EXE
1652 WINWORD.EXE

pid	process
1652	WINWORD.EXE

pid	process
1652	WINWORD.EXE
1652	WINWORD.EXE

pid	process
1652	WINWORD.EXE
1652	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\N.271 WAL 14.03.2023.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1652

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\113459.tmp"
2⤵
- Process spawned unexpected child process
PID:1848

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\113459.tmp"
3⤵
PID:896

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RUqZOztOvNAi\IBbftHiR.dll"
4⤵
PID:936

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
127792e0434b8ae80760bfc96ae99bc2

SHA1
dd19735cd5545a17643000cfa14326d2c7993760

SHA256
c9a7175dc2773d35c17df257691e696ff6c9dc4cacdae13488e6835154a44a99

SHA512
ba902f4fc3cffab12bef157f702ab0be7c0360acf367ddc4e734bf30666073cf7df4379a53d8ad10e353f5ee66819e86d2de81994bee996064fcafa37f2a4709

Download Submit
C:\Users\Admin\AppData\Local\Temp\113459.tmp
Filesize
520.5MB

MD5
5b052d774d42bbc4524541c8324d92b0

SHA1
3dff02e5e9b105fa758765cc85cb1c1008368bd1

SHA256
49cee0bc0eab473e54d654cc0d78dd82dbfd7c63a1a35890608a02c3168d52a4

SHA512
a141f16a770b4c3e93d268b7110c578e5f93743f65fc81e1efd91c7720a1b8caf5907f2a90b6014eaf688bd22b12e2b00352a7d1805ee3fe7a45ec7c784a7356

Download Submit
C:\Users\Admin\AppData\Local\Temp\113537.zip
Filesize
826KB

MD5
cd29b97669086317dc0efb6a4070d671

SHA1
f44fab5b63a797115944caae4e9c25a2c3da9d0f

SHA256
56f87aebf126f019f553d125995f61ac3bef0b53fc896f17dad8597662d44389

SHA512
94ca9bcc40ac967d9ad5f7c2814010b54140f81d08be89076e5427960e291c5103fa98bcc706e65843c0485ecf89468c4b2268dbddd5f2079372cf0735b87cb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab37A8.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3AAB.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
20KB

MD5
785c47a02cfd820dc30d1887455c07d4

SHA1
1da7bb8fa71885f3e5fb06c874f14138c7c22b7e

SHA256
f4cd0506df067c07a6aafe030daf821c3f7a8c87ab393c10221e2037d2fbaa33

SHA512
94369ffa7366c6a9363a11b601aeb99a02ba8a8cbc82a077651f80be1a2d83895a10d999c805fca4c93a12e58d498f29b8da4523bd15b51e6a43a2cbb5045164

Download Submit
\Users\Admin\AppData\Local\Temp\113459.tmp
Filesize
520.5MB

MD5
5b052d774d42bbc4524541c8324d92b0

SHA1
3dff02e5e9b105fa758765cc85cb1c1008368bd1

SHA256
49cee0bc0eab473e54d654cc0d78dd82dbfd7c63a1a35890608a02c3168d52a4

SHA512
a141f16a770b4c3e93d268b7110c578e5f93743f65fc81e1efd91c7720a1b8caf5907f2a90b6014eaf688bd22b12e2b00352a7d1805ee3fe7a45ec7c784a7356

Download Submit
\Users\Admin\AppData\Local\Temp\113459.tmp
Filesize
461.6MB

MD5
c7dfe3a3265cbe509a8e13e061b0e7a4

SHA1
b16a98c95a4b817988d2eef0bf3c439fd772ab99

SHA256
483a4fe4685b744b407828b6603ae268cba6dd8f7ffbf2734ee269ed3ed3fcb0

SHA512
c797d7bd7af2ff63e089b420af723833f98405aefa64c8628ba98a3025d6b7fade8f59881524785ae5c4014482ed40401a80982ec2cf78ac72b40501e0f8582b

Download Submit
memory/896-1412-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/936-1417-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1652-1215-0x0000000006170000-0x0000000006171000-memory.dmp

Filesize
4KB

Download
memory/1652-618-0x0000000005660000-0x0000000005760000-memory.dmp

Filesize
1024KB

Download
memory/1652-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1652-1418-0x0000000006170000-0x0000000006171000-memory.dmp

Filesize
4KB

Download
memory/1652-573-0x0000000005660000-0x0000000005760000-memory.dmp

Filesize
1024KB

Download