66477ce15f6c66f63ec772a849b4a9fea8f3810591294878fa6adb63f63c14a4

Analysis

max time kernel
64s
max time network
129s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-03-2023 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4943633551919646, Great Britain.doc
Size

541.3MB
MD5

c4c9ff74262835e0e6f333cba594c362
SHA1

639a7aa1684350d363eed67a0cfd77ad0d20d984
SHA256

86342b941e496055fe8657b9195f71475c7cb139a42718030a270cbd056706f3
SHA512

d0687f6e5718196af54dd8269195f4fe43be84da48c32c925a15233e81ae782b5f19aefeffe43a252266463f56f887835c5d58fbec55231582ccd076e8ffae24
SSDEEP

6144:1620tqUx3Xu+7ZkRIDNGi9a0Va5UAClo:1620tqm3+I2ezcz5U3lo

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1804	1116	regsvr32.exe	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1116 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

1116 WINWORD.EXE
1116 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1116 WINWORD.EXE
1116 WINWORD.EXE

pid	process
1116	WINWORD.EXE

pid	process
1116	WINWORD.EXE
1116	WINWORD.EXE

pid	process
1116	WINWORD.EXE
1116	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4943633551919646, Great Britain.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1116

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\141116.tmp"
2⤵
- Process spawned unexpected child process
PID:1804

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\141116.tmp"
3⤵
PID:1052

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YKTlZbsGYeE\XjUXVU.dll"
4⤵
PID:1512

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1448

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
b252ca8ee7880391e6cdb22579fe1c15

SHA1
f57efcd87d5c54c7701e9202245ee8751ef63a15

SHA256
1e9ce1cc841e8ba43785ae9705cc2096deb997629c1e93919f5889b1eed80d4c

SHA512
47d564daa8dc81e12c98588962a1548701f9195770cd8cbd12ae4a3fce30202d3b9d578e8b54a93aa744332b50588b75694e7ef5df8ec6552129883b742e76c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\141116.tmp
Filesize
206.6MB

MD5
9ad853a2640c37ae3dbbb38a9aee9e08

SHA1
51e83a967c0aa9357d91601d81805e6f750ccbc1

SHA256
8b0fd9f8bba2256dc4a64e8ebea40035f9fe69f79e9b54eaeb672d06274ad34a

SHA512
8e12e81349da0c53578a0c28dc1a857a9b771b43dafb0cbbc188c6d372e981691810fa7ae744a01edfb1ac29eff1277a3aba6b57841a0668ef4a21b46d91c804

Download Submit
C:\Users\Admin\AppData\Local\Temp\141158.zip
Filesize
807KB

MD5
29e2d222bd12220dce9a8d50033ccb5c

SHA1
8395359176311bd02d8be06f200ccd2b72bf57d6

SHA256
36a0eba1c1a3a6d28a0bc4ccede8adacd35426e213773fbcba64185697310853

SHA512
c247ac90bfa8c0958bab87b4c186d4a465c15b00e025bb6bc19ac0352c720211075b86ec0feb6254be972b6c6491581d6a24a2fb595ad6c0ed24512495973864

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6B64.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6F9F.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
20KB

MD5
60b961e3c99e4864d1c407d7a142acf7

SHA1
a9bc5ea53cbea9945f25a169689efc1745202ddc

SHA256
47ccbcfd497a3b52accf1ebf8e6ad51b61c9ad94b0fe68485e29df99ea9b6260

SHA512
4e58a543d8bf3ca2b2e03a3b9cfcb40c1877b8da40400a1fb61c21fe6055bd2ee0bb7cfc65b69dcb91230b298448813a984d68866feec0513664e36583763ce1

Download Submit
\Users\Admin\AppData\Local\Temp\141116.tmp
Filesize
205.3MB

MD5
bf5545d082e3acd84b55db3b3ceaac20

SHA1
001bbd071fa2691066b54bc2712116c4ed16b30e

SHA256
33089f6e532eddfd0e5da9d8181fd5617d281d0ba008a53afb4c51e6dadd2abb

SHA512
5ac405e20d38dc13152c3427b8b7ff443c852dc6090430c3bceac0299bf25b8f88996055a25bcda5e14fd2702beb04514c35287a9b17c9aab92d0511dff6eb3d

Download Submit
\Users\Admin\AppData\Local\Temp\141116.tmp
Filesize
204.7MB

MD5
e42750aaa94ea5ed4ba6d0fc0eaeb40f

SHA1
34937b5a3637c5f33c13b87a6c6dd141f37a4eb7

SHA256
13452984aa24d99ec68bced276be8244428769fb59a622c69baa1d3197a4679f

SHA512
14536d637660066a928e0a68ece1e269a18482c51e42c9c3b90b412c30d59dc2910c28f5e3faae67d2317514ebeb42d0d96dbe76a001f50843a3273dfea517f4

Download Submit
memory/1052-1412-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1116-82-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-85-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-66-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-64-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-63-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-62-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-67-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-68-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-69-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-70-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-71-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-73-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-72-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-75-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-74-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-77-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-76-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-79-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-78-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-80-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-61-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-81-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-83-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-84-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-86-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-65-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-88-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-87-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-90-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-89-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-92-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-91-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-94-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-93-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-99-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-98-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-97-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-96-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-95-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-100-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-101-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-102-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-1215-0x00000000062F0000-0x00000000062F1000-memory.dmp

Filesize
4KB

Download
memory/1116-59-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-60-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-58-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-57-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1116-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1116-1418-0x00000000062F0000-0x00000000062F1000-memory.dmp

Filesize
4KB

Download
memory/1512-1417-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download