953d4204061b6047b1e877ac36eafa05ac2a1ed18d664e087b479b59ed65f75a

Analysis

max time kernel
76s
max time network
143s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-03-2023 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rech.doc
Size

503.3MB
MD5

4ba3208978bd0a61df72015340c72d14
SHA1

927ed9e1883ce74b59728b11cd3f7956e151e4bf
SHA256

ce7baabab7bc9cdf8584f53f87283d96a763d6a1c5ca141b801ce8e7eb909597
SHA512

8d6b18ed26cd7ac4f000c4ea75d0aad935eabb3379da8a884994cf6963f395595bd4494ebe2f3823831f918bd1176ccdfea50b2d07375cf2ce5070fed1c6e403
SSDEEP

6144:1620tqUx3Xu+7ZkRIDNGi9a0Va5UAClo:1620tqm3+I2ezcz5U3lo

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1384	940	regsvr32.exe	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

940 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

940 WINWORD.EXE
940 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

940 WINWORD.EXE
940 WINWORD.EXE

pid	process
940	WINWORD.EXE

pid	process
940	WINWORD.EXE
940	WINWORD.EXE

pid	process
940	WINWORD.EXE
940	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Rech.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:940

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\130608.tmp"
2⤵
- Process spawned unexpected child process
PID:1384

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\130608.tmp"
3⤵
PID:1984

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LDJoXWHf\imUbFTCdjbJgup.dll"
4⤵
PID:608

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
2d0ed9606608ca72175180dd4bc9e8cc

SHA1
426599898d17f204628f86e2468c428626c89b92

SHA256
9778bd07fd69b6e9b6ef6ac6d85ad0332c630cd12eb795be529837fe5d2d799d

SHA512
80cf2525486267dfba12a583cc7ee5647c66faf2b95a1a889d09f9309b6d494b537ddfc86838219a4fd5e4a132af8c251d89a546d75a438394fce3dc46cd6d5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\130608.tmp
Filesize
321.4MB

MD5
8a68c9a91c33c18d22887da4c36fca0e

SHA1
d779fa81401250d04c14b9a29ed61338f653598b

SHA256
8acaf57ab50e2571118c865fdd78271ee26cc48c7fd47710d94514bdfaf07786

SHA512
6d84697ee939caa4ea1f8e74d6705de65f1f46c386c69c875b81fb2a2cab28bff033052b2339fd67d3108bc453141276d61ac6da3d8a416eb4c95b6e7dd31d02

Download Submit
C:\Users\Admin\AppData\Local\Temp\130706.zip
Filesize
836KB

MD5
af7fcc7c59c94402ea5a0212a9afdc60

SHA1
1f732ca2337d61e7bd7d6a50c5ef9e51695c9ed6

SHA256
458f8f0107984a508d1ad2288b5056efd7506ca61c4d34e6b5812cd4deba64e3

SHA512
72d5f1b792859fe0d50aa4ca874e08d837bec4505f92452fe87ab49ef356be63beccc9d775bfb18406cbce49ca22337352320d8cbc367bf048739e9f6c3c672f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7534.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7895.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
20KB

MD5
21ecf2d7cd6f8e118d9780ec111ae064

SHA1
9d7ab1e980c76bfd84f6a14f54d9b6986187ed2f

SHA256
de9ecc32a6e89e6da7b8629badc44687a22e60d3dd2d61e6bf6329f9ff642631

SHA512
f59367cd357a9fd5eed79d4dc244696a9c039c5bd932d4bf1638664ce23d295b1bd45a1cdc604ba956d757c7a9043131a77ee3bbf5ad50e8bb68b883206d993e

Download Submit
\Users\Admin\AppData\Local\Temp\130608.tmp
Filesize
367.5MB

MD5
b12bbbc141076c6aa273adccf4b14a20

SHA1
abd54fea23b190e023aec84beb492c3f9365ad53

SHA256
1f2df096b7d314c65cd1d5d6a998dfe00e9f13c568919de303bca164a908c1a8

SHA512
78352bb53ce42267fe73837cb6ae3de600c5a58e6873a22426943d4da814a06fc43ddc8c9879546eb1961e716d9070eb7f3cfe5340fed4d412c20d7d2812a1db

Download Submit
\Users\Admin\AppData\Local\Temp\130608.tmp
Filesize
447.0MB

MD5
61c32c17dd78d51549b18e7e56627a92

SHA1
e7c42efa2340e12899f3ac6ea17723d2b3237961

SHA256
5c8d527165a23fd4992fb80ef11c0f01c90647fcd07484af3f097239d1b7745e

SHA512
bf5e6fb499265958d7fd0b85772de6defd40fe5b21ae38e258174eaf7f85a05040ab530dcba7a638df471bedfae1485668ae2382d55e1552a740ff37589d829b

Download Submit
memory/608-1413-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/940-87-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-169-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-91-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-93-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-92-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-94-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-95-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-90-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-96-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-98-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-97-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-100-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-99-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-101-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-124-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-89-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-177-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/940-88-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-86-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-85-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-84-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-1215-0x0000000006380000-0x0000000006381000-memory.dmp

Filesize
4KB

Download
memory/940-83-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-82-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-81-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-79-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-80-0x0000000000350000-0x0000000000450000-memory.dmp

Filesize
1024KB

Download
memory/940-1418-0x0000000006380000-0x0000000006381000-memory.dmp

Filesize
4KB

Download
memory/1984-1412-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download