Analysis
-
max time kernel
104s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14-03-2023 12:03
Behavioral task
behavioral1
Sample
info-1403.doc
Resource
win7-20230220-en
General
-
Target
info-1403.doc
-
Size
535.4MB
-
MD5
ee37e947ee3e520ffb9b905296ab51ba
-
SHA1
9f889ea283045f5fe6985d1143702b1ba94bc077
-
SHA256
f9c78e60e71636f7e4b2262e1e39fcc9b7e0a9a4c2807bb9d291660bb869dc13
-
SHA512
9f868600db747adac75e87b056901bc43f2d2c684b659a719ad7edbcf9f3a5cefe2d548495cea703ccfc59cb31162e758d1884459a44f48597a48367cb0cdb7c
-
SSDEEP
6144:5yk1RgZZXbN63GW1Z7krKSUzMNYJJdKkOl950uH54Lg4Ne9C:5/MXJ6WW1Z7ktUgNYJJdKkOHC4D409
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 1924 1220 regsvr32.exe WINWORD.EXE -
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 1924 regsvr32.exe 1536 regsvr32.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 11 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1220 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
regsvr32.exepid process 1536 regsvr32.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
WINWORD.EXEpid process 1220 WINWORD.EXE 1220 WINWORD.EXE 1220 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1220 WINWORD.EXE 1220 WINWORD.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
WINWORD.EXEregsvr32.exeregsvr32.exedescription pid process target process PID 1220 wrote to memory of 992 1220 WINWORD.EXE splwow64.exe PID 1220 wrote to memory of 992 1220 WINWORD.EXE splwow64.exe PID 1220 wrote to memory of 992 1220 WINWORD.EXE splwow64.exe PID 1220 wrote to memory of 992 1220 WINWORD.EXE splwow64.exe PID 1220 wrote to memory of 1924 1220 WINWORD.EXE regsvr32.exe PID 1220 wrote to memory of 1924 1220 WINWORD.EXE regsvr32.exe PID 1220 wrote to memory of 1924 1220 WINWORD.EXE regsvr32.exe PID 1220 wrote to memory of 1924 1220 WINWORD.EXE regsvr32.exe PID 1220 wrote to memory of 1924 1220 WINWORD.EXE regsvr32.exe PID 1220 wrote to memory of 1924 1220 WINWORD.EXE regsvr32.exe PID 1220 wrote to memory of 1924 1220 WINWORD.EXE regsvr32.exe PID 1924 wrote to memory of 1536 1924 regsvr32.exe regsvr32.exe PID 1924 wrote to memory of 1536 1924 regsvr32.exe regsvr32.exe PID 1924 wrote to memory of 1536 1924 regsvr32.exe regsvr32.exe PID 1924 wrote to memory of 1536 1924 regsvr32.exe regsvr32.exe PID 1924 wrote to memory of 1536 1924 regsvr32.exe regsvr32.exe PID 1924 wrote to memory of 1536 1924 regsvr32.exe regsvr32.exe PID 1924 wrote to memory of 1536 1924 regsvr32.exe regsvr32.exe PID 1536 wrote to memory of 908 1536 regsvr32.exe regsvr32.exe PID 1536 wrote to memory of 908 1536 regsvr32.exe regsvr32.exe PID 1536 wrote to memory of 908 1536 regsvr32.exe regsvr32.exe PID 1536 wrote to memory of 908 1536 regsvr32.exe regsvr32.exe PID 1536 wrote to memory of 908 1536 regsvr32.exe regsvr32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\info-1403.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\130430.tmp"2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\130430.tmp"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\GCvJzUNQl\mIWxaBqbjbrRS.dll"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\130430.tmpFilesize
527.5MB
MD56ea930620e66f8cb84e1774d0a6c0b2d
SHA1748404bba874a143cdce8af9422fda733993dc89
SHA256bd55dcc2e45d2274f6575f862f7fb7f52a898e44b4910cdbb4bd71a44620b44a
SHA5126c62986b29171f4d5b1616e103c711d51120677e796a90eed83a5823835f63bf7aa4d4260f92597856b39d8afd39a8ff7be941ca9b1e2750529d4c1f405a2c18
-
C:\Users\Admin\AppData\Local\Temp\130437.zipFilesize
834KB
MD5cf86a720a67639874a9b3b8de8e144a7
SHA1faf52019395bd4c8f30c39564712b0fce0ada472
SHA2562c7dfb631c1482ee65c1b2af2eba544f7efe1724fe8e39c9bb2ec86bbd77fdd2
SHA51215ca8279ab68fa5f2ee175641cd5570f8fe6b4195d62a3420cd02c157614af4d395e9a1e2ea57ce9229f09fcacf1a99ccc19d44ae06627b0302926643c5c0008
-
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotmFilesize
20KB
MD577552cfe6e30fffb059959bb3852c343
SHA1d5e942aa22c38b10571dd9c24d3eacfbe2856720
SHA256f330e186b56c4097be56f9f40acc1c737acd9a58f004e96638d9773b1c817729
SHA512faa10b477c595b230950b730895f114cd5e757b36df4e6f41cffbe872e6169477f49821678e93e10b7569195e25efc027ae022322548983b8b0d89e5a4561e20
-
\Users\Admin\AppData\Local\Temp\130430.tmpFilesize
527.5MB
MD56ea930620e66f8cb84e1774d0a6c0b2d
SHA1748404bba874a143cdce8af9422fda733993dc89
SHA256bd55dcc2e45d2274f6575f862f7fb7f52a898e44b4910cdbb4bd71a44620b44a
SHA5126c62986b29171f4d5b1616e103c711d51120677e796a90eed83a5823835f63bf7aa4d4260f92597856b39d8afd39a8ff7be941ca9b1e2750529d4c1f405a2c18
-
\Users\Admin\AppData\Local\Temp\130430.tmpFilesize
527.5MB
MD56ea930620e66f8cb84e1774d0a6c0b2d
SHA1748404bba874a143cdce8af9422fda733993dc89
SHA256bd55dcc2e45d2274f6575f862f7fb7f52a898e44b4910cdbb4bd71a44620b44a
SHA5126c62986b29171f4d5b1616e103c711d51120677e796a90eed83a5823835f63bf7aa4d4260f92597856b39d8afd39a8ff7be941ca9b1e2750529d4c1f405a2c18
-
memory/908-1745-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/1220-87-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-1481-0x0000000006A30000-0x0000000006A31000-memory.dmpFilesize
4KB
-
memory/1220-61-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-62-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-63-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-64-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-65-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-66-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-67-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-68-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-91-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-70-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-71-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-72-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-74-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-73-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-75-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-76-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-77-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-78-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-79-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-80-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-81-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-82-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-83-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-84-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-85-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-86-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-59-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-88-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-58-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-60-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-69-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-92-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-93-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-94-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-95-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-96-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-97-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-98-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-99-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-100-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-101-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-102-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-104-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-103-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-105-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-106-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-108-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-107-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-109-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-110-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-111-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-112-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-113-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-114-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-115-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-116-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-117-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-90-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-1740-0x0000000006A30000-0x0000000006A31000-memory.dmpFilesize
4KB
-
memory/1220-89-0x00000000006C0000-0x00000000007C0000-memory.dmpFilesize
1024KB
-
memory/1220-54-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1536-1739-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB