d74f90be0162da0299e15e8f576bfcd1266cea55465d37cfa4a9ff1d9171aa61

General

Target

Invio documento rif.3973184 del 14.03.2023.doc
Size

541.3MB
MD5

c4c9ff74262835e0e6f333cba594c362
SHA1

639a7aa1684350d363eed67a0cfd77ad0d20d984
SHA256

86342b941e496055fe8657b9195f71475c7cb139a42718030a270cbd056706f3
SHA512

d0687f6e5718196af54dd8269195f4fe43be84da48c32c925a15233e81ae782b5f19aefeffe43a252266463f56f887835c5d58fbec55231582ccd076e8ffae24
SSDEEP

6144:1620tqUx3Xu+7ZkRIDNGi9a0Va5UAClo:1620tqm3+I2ezcz5U3lo

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1916	1104	regsvr32.exe	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1104 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

1104 WINWORD.EXE
1104 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1104 WINWORD.EXE
1104 WINWORD.EXE

pid	process
1104	WINWORD.EXE

pid	process
1104	WINWORD.EXE
1104	WINWORD.EXE

pid	process
1104	WINWORD.EXE
1104	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Invio documento rif.3973184 del 14.03.2023.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1104

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\130150.tmp"
2⤵
- Process spawned unexpected child process
PID:1916

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\130150.tmp"
3⤵
PID:836

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CDJHJs\EWRu.dll"
4⤵
PID:880

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1568

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
a1c3c52a9ee58b1bda984679f1138349

SHA1
9aa7f216ef3c86956adf1cc95ba5b6d675b49004

SHA256
1cf5fcd1cff9bda5d9c9845020d21c36bffec876c76ddeb5081303cde359c39f

SHA512
c23f46a1e5586b22e202c29e6dced12c8e7bb70f0ac6a8048c7c2816473377cd993f32efaa8012a81fe1983a753992de9ff6872c2637b0578cd518290ef6a077

Download Submit
C:\Users\Admin\AppData\Local\Temp\130150.tmp
Filesize
360.3MB

MD5
98ed308c6a6188e3e5998783d3086594

SHA1
736f1bf198512df2f9a33a8444c334cfba9fb58c

SHA256
27b9835959e4ea8267bb3786ba53a66981e07064cc629338d2e715af29fd8d5e

SHA512
7680259c72352499affd8525fb622b2f6c2385a9bedc6497dd1d67074364306e1984e674c41c45e9b572fc28c4b311bbef545b3b4bf0fad395c13b572668ccf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\130227.zip
Filesize
807KB

MD5
29e2d222bd12220dce9a8d50033ccb5c

SHA1
8395359176311bd02d8be06f200ccd2b72bf57d6

SHA256
36a0eba1c1a3a6d28a0bc4ccede8adacd35426e213773fbcba64185697310853

SHA512
c247ac90bfa8c0958bab87b4c186d4a465c15b00e025bb6bc19ac0352c720211075b86ec0feb6254be972b6c6491581d6a24a2fb595ad6c0ed24512495973864

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8106.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar82B2.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
\Users\Admin\AppData\Local\Temp\130150.tmp
Filesize
354.9MB

MD5
7c21f86e99ec543dbb6b915b27ed9a75

SHA1
da8b1dad6a6a9745208691635a210b380b6ba657

SHA256
f7abbc1901f4b0c107c93e3d13d782383cb7b71e113c21b299f49b16838c4bc2

SHA512
0e4a7a64ea962825e9125235d5c03ec3e0a5bdc4927d7056ced5fa4b980b88a501cb626e41e4fe7c332eebd4291b9915b620cf836e96c081dfd2e7b66e0c6c21

Download Submit
\Users\Admin\AppData\Local\Temp\130150.tmp
Filesize
356.8MB

MD5
36198dc580a0a256ad9136fe680dcb54

SHA1
43af36c9ffef4bf06d4f21c7f44fa5af8fa664d5

SHA256
68171103be4901652d9dc0038101e3bba3365a0a7a54488324a9926268d83838

SHA512
9382f8edef201f01c1f4ef86c615a404a76be470bc5bd84bdec3b2d4ef07c07283516e3abc7c6c1682df41a8cd39940e0069b3d05fcc314506c5c7a986dc66b0

Download Submit
memory/836-1412-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/880-1417-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1104-89-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-100-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-67-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-68-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-65-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-71-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-73-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-74-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-75-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-77-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-79-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-78-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-76-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-80-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-82-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-86-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-88-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-91-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-62-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-90-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-92-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-94-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-98-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-99-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-101-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-61-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-96-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-97-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-95-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-93-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-87-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-85-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-102-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-84-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-83-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-81-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-72-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-69-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-70-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-66-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-64-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-63-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-1215-0x0000000006400000-0x0000000006401000-memory.dmp

Filesize
4KB

Download
memory/1104-60-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-59-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-58-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-57-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1104-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1104-1418-0x0000000006400000-0x0000000006401000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads