96912bdc44215d8d228e66c2d16809643a70e0f9ff64b13d1881b5befee7c0ca

General

Target

Invoice Number 979646.doc
Size

535.3MB
MD5

2855f6b1a3801c210b75146462a1d704
SHA1

224516c91e780e7917521182ddc5b14afad7de6d
SHA256

5be08e46bbe7dc937ad38deb70d95fa9d64595191baf16afb84f45a58ea494c1
SHA512

442209ea678952e34699e91dd6ae50c445cd201caa7ec085e73a5c3ebc2cd0516ee89bcc600fd4e5653e4824c2c4604dae02f57bc21c46bc7e1d33f197b82695
SSDEEP

6144:1620tqUx3Xu+7ZkRIDNGi9a0Va5UAClo:1620tqm3+I2ezcz5U3lo

Score

1^/10

Malware Config

Signatures

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1376 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1376 WINWORD.EXE
1376 WINWORD.EXE

pid	process
1376	WINWORD.EXE

pid	process
1376	WINWORD.EXE
1376	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Invoice Number 979646.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1376

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
68be5e6604d672eaeee4102188d7a497

SHA1
bb6a72704585035fb11e54c695ee1035a5f638ec

SHA256
b82e7c9d0b47e772b4d77f65594acd51ec03bb43baa0dbed3ec71374bb0e49d9

SHA512
8865da1bce1ccd7c4ad6e23707e858e8d5f28893e8f1c40c82aba4163a9fc60ac626047032043b24a8c60eaaede8c1bcc010b0d8dde345110f843f7d2416651e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4BD3.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4D41.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
memory/1376-97-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-98-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-84-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-86-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-87-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-90-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-88-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-91-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-92-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-96-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1376-95-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-93-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-83-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-99-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-94-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-100-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-89-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-85-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-101-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-124-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-169-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-82-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-81-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-80-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1376-79-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing