4e5ccc03a527b9a344d5e2c452943d003f9cc77a645d33c6e1a54ab826b5d2eb

General

Target

Fattura 329864.doc
Size

548.3MB
MD5

8ad41b75ac260ad12600a77dbf27de25
SHA1

fcf2484ae2913cefe5de026ef39b2537bda10138
SHA256

33a483e9a68e674ba8166300aa38d19197b1ee5bb72ff784a9e48797c5337c9b
SHA512

e9f481765d140bf3a0c716a1f138d75b0b3b12333f84dc9820efa01a2557b4e93797545497937fc82f1e752fc93c3967ddf7639503046fd2d532eecb0783709c
SSDEEP

6144:1620tqUx3Xu+7ZkRIDNGi9a0Va5UAClo:1620tqm3+I2ezcz5U3lo

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1172	1656	regsvr32.exe	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1656 WINWORD.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

WINWORD.EXE

pid process

1656 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1656 WINWORD.EXE
1656 WINWORD.EXE

pid	process
1656	WINWORD.EXE

pid	process
1656	WINWORD.EXE

pid	process
1656	WINWORD.EXE
1656	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Fattura 329864.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1656

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\121943.tmp"
2⤵
- Process spawned unexpected child process
PID:1172

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\121943.tmp"
3⤵
PID:1448

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YHJNAihWfLFQQiE\eokgAMzSOtgjSl.dll"
4⤵
PID:744

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
ff32ef439a60cd8b81be2dad9ca22cbe

SHA1
dc5964ad4b30733eb7d79dfb44e0ca588aab2099

SHA256
33f3adca0839c2099411ac7397cd76391589b9cbcccd1f61a80cd110fe06323d

SHA512
dfca3d93b38f65bfe5ee4cb57606f0618f11da8a60b19c539f8e39a6e28b95120f82f1c5e1fe698b8217d8c7290dfbc53707db597df05370117e7ddc575b3a2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\121943.tmp
Filesize
347.4MB

MD5
00883074fa6f47c15d20342fe97e3bfc

SHA1
ca9fe9300b9d07ae8a1b2e31a50b88f2a745192b

SHA256
4ec8274bd4773d88aac0aef709340e9861f7f98348f8243b33e445fe3b4f84ad

SHA512
85598a2b5fa5a9014052aacea80dba70f897bb1fe50f1913e3b662a26dc1144386f26e050254d309b3a36ca45117a6ecbedacfe8c580839965ad611ee2da32b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\122025.zip
Filesize
836KB

MD5
c69f79318bc0ac1b0991362efad64b61

SHA1
0706300c98b2d542c3449ee6ce676f37d1aad80c

SHA256
f221be2454c7e8edc7dfe2095a9f97f09c94c94379e685fd959293d6ff40acc2

SHA512
87f4472a769a666b5bbc34a48455e52217376f8ead959460682ae92bc9868fca73099906b7c19dff76d695512b733186bf003a705b9779cbe969a790be70f89f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5323.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar54EF.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
\Users\Admin\AppData\Local\Temp\121943.tmp
Filesize
486.6MB

MD5
9e69ad1fc332cdc01d66e52b0184913a

SHA1
16ab1283f0dee3a6cce326ff7804b6436af8c906

SHA256
f589460d95d174b60a058252d3fce68f94def8bb6f31d4b34a8d7fec96be7ce2

SHA512
1f68668787113ec723c94e805393458b0be9f1554f9925ef05cdbda8c4bf6c1c8e68a275fe7a7b81f6196a1b9c484421d44daa9776f0d781cb2af364710e5f5e

Download Submit
\Users\Admin\AppData\Local\Temp\121943.tmp
Filesize
526.7MB

MD5
2185b6a7513716c2a9fa644576f1a554

SHA1
e6c2585f35ad0a8b905a67f96a63fd9a16f098c9

SHA256
4fbaa9a70e1c58c4671230b8568a528e7d802e3276a5dd1847ea4f7a4ae5eff8

SHA512
a379c11b0288db59722d45e59ff134beae61ff22dcf861db009a6679c8fae7a3b2f5ebb4402b8086af620b8265a53dfb2363b3452cbbfde7993723967a906744

Download Submit
memory/744-1417-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1448-1412-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1656-81-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-86-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-64-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-63-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-65-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-67-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-66-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-68-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-71-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-69-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-70-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-72-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-73-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-74-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-75-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-76-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-77-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-78-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-79-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-80-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-62-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-82-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-83-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-84-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-85-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-61-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-87-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-88-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-89-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-90-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-92-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-91-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-93-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-95-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-94-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-97-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-96-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-98-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-100-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-99-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-101-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-102-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-106-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-1215-0x0000000006330000-0x0000000006331000-memory.dmp

Filesize
4KB

Download
memory/1656-60-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-58-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-59-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-57-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/1656-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1656-1418-0x0000000006330000-0x0000000006331000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads