4879d68f64e84f0fb5b64b2dd212f76462a01f8e10f4d8ed6287cac8421e589c

Analysis

max time kernel
100s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-03-2023 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4373179537.doc
Size

533.4MB
MD5

9fbce537ab324aa323e681b6b0024492
SHA1

b5626da4171f32811440381d01392db523e69118
SHA256

e7664734d76bfd668aeb42789758976d72086e2dfd408b96f6b3c0d84d395e88
SHA512

1736d2aaee14543db22dacc34477f341d3c5f45b02d95492ef59127b6568378905adef976386ddaf945db9ea1e8d4109267928719372ba5a68d072afdfc76859
SSDEEP

6144:5yk1RgZZXbN63GW1Z7krKSUzMNYJJdKkOl950uH54Lg4Ne9C:5/MXJ6WW1Z7ktUgNYJJdKkOHC4D409

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	364	2028	regsvr32.exe	WINWORD.EXE

Loads dropped DLL 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

364 regsvr32.exe
1968 regsvr32.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

pid	process
364	regsvr32.exe
1968	regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 11 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

2028 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

1968 regsvr32.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

WINWORD.EXE

pid process

2028 WINWORD.EXE
2028 WINWORD.EXE
2028 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

2028 WINWORD.EXE
2028 WINWORD.EXE

description	flow	ioc
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
2028	WINWORD.EXE

pid	process
1968	regsvr32.exe

pid	process
2028	WINWORD.EXE
2028	WINWORD.EXE
2028	WINWORD.EXE

pid	process
2028	WINWORD.EXE
2028	WINWORD.EXE

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

WINWORD.EXEregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2028 wrote to memory of 584	2028	WINWORD.EXE	splwow64.exe
PID 2028 wrote to memory of 584	2028	WINWORD.EXE	splwow64.exe
PID 2028 wrote to memory of 584	2028	WINWORD.EXE	splwow64.exe
PID 2028 wrote to memory of 584	2028	WINWORD.EXE	splwow64.exe
PID 2028 wrote to memory of 364	2028	WINWORD.EXE	regsvr32.exe
PID 2028 wrote to memory of 364	2028	WINWORD.EXE	regsvr32.exe
PID 2028 wrote to memory of 364	2028	WINWORD.EXE	regsvr32.exe
PID 2028 wrote to memory of 364	2028	WINWORD.EXE	regsvr32.exe
PID 2028 wrote to memory of 364	2028	WINWORD.EXE	regsvr32.exe
PID 2028 wrote to memory of 364	2028	WINWORD.EXE	regsvr32.exe
PID 2028 wrote to memory of 364	2028	WINWORD.EXE	regsvr32.exe
PID 364 wrote to memory of 1968	364	regsvr32.exe	regsvr32.exe
PID 364 wrote to memory of 1968	364	regsvr32.exe	regsvr32.exe
PID 364 wrote to memory of 1968	364	regsvr32.exe	regsvr32.exe
PID 364 wrote to memory of 1968	364	regsvr32.exe	regsvr32.exe
PID 364 wrote to memory of 1968	364	regsvr32.exe	regsvr32.exe
PID 364 wrote to memory of 1968	364	regsvr32.exe	regsvr32.exe
PID 364 wrote to memory of 1968	364	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 1044	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 1044	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 1044	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 1044	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 1044	1968	regsvr32.exe	regsvr32.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4373179537.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:584

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\132148.tmp"
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:364

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\132148.tmp"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\SjCBfBrvZBmem\VQHLoSsmVHl.dll"
4⤵
PID:1044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\132148.tmp

Filesize
533.5MB

MD5
e658809e3b8fd15426058f074b257e79

SHA1
fb88375f5d8e2449143401cf7082eec71ef206bf

SHA256
8f7e111598ee9fbe029438505a7623d971f71c765208d95150d38c0defe904b2

SHA512
4126030cb0eb24c743eb954376729a7a4732b902225b24d784e241e1dbc96d61b608dab08d2f4a37e39632b2af0e4a47f8363c5364bee9aed9b957c0f474b055

Download Submit
C:\Users\Admin\AppData\Local\Temp\132153.zip

Filesize
840KB

MD5
8ae7a394de5df498b34e9677c9c209bd

SHA1
8c2a0666ec403bc006bf86fca4b619537d5a09e6

SHA256
733f152143e5c0d3ebc152fff63b59593a5e5ca12eff1e61220a080a23d51dc2

SHA512
2d358b8f83507fa3dd7ad03706678bfa84cca4444d95982e980d31fbe65eb0135bfafa5a3781b73602d5c4624727ebe19b9684b0925697550398c8f3512705f7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
20KB

MD5
499cf23e60b57d28aae91982846f05db

SHA1
64adc4c9548e56ac6ab73a67318dbcc422d19c71

SHA256
2ac738c176d29b5ecca63e8ffbce6183b4f8c280f70a410e6d29b03d9fe3a785

SHA512
6704094acc5270e8b62313693e4e00ee7b7ca1b89c7b9a86547b7f1f28894d6d5313aca48730d87e3d359b8b8a878c3265bc8329dc0f2016c089c33a2eb3a465

Download Submit
\Users\Admin\AppData\Local\Temp\132148.tmp

Filesize
533.5MB

MD5
e658809e3b8fd15426058f074b257e79

SHA1
fb88375f5d8e2449143401cf7082eec71ef206bf

SHA256
8f7e111598ee9fbe029438505a7623d971f71c765208d95150d38c0defe904b2

SHA512
4126030cb0eb24c743eb954376729a7a4732b902225b24d784e241e1dbc96d61b608dab08d2f4a37e39632b2af0e4a47f8363c5364bee9aed9b957c0f474b055

Download Submit
\Users\Admin\AppData\Local\Temp\132148.tmp

Filesize
533.5MB

MD5
e658809e3b8fd15426058f074b257e79

SHA1
fb88375f5d8e2449143401cf7082eec71ef206bf

SHA256
8f7e111598ee9fbe029438505a7623d971f71c765208d95150d38c0defe904b2

SHA512
4126030cb0eb24c743eb954376729a7a4732b902225b24d784e241e1dbc96d61b608dab08d2f4a37e39632b2af0e4a47f8363c5364bee9aed9b957c0f474b055

Download Submit
memory/1044-1744-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1968-1739-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2028-108-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-102-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-86-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-91-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-92-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-93-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-90-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-96-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-95-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-99-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-98-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-97-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-94-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-89-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-101-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-104-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-106-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2028-109-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-107-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-105-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-88-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-103-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-100-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-110-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-111-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-112-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-113-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-115-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-116-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-139-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-114-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-140-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-87-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-1481-0x0000000006B30000-0x0000000006B31000-memory.dmp

Filesize
4KB

Download
memory/2028-80-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-85-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-84-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-83-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-82-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download
memory/2028-1745-0x0000000006B30000-0x0000000006B31000-memory.dmp

Filesize
4KB

Download
memory/2028-81-0x0000000000480000-0x0000000000580000-memory.dmp

Filesize
1024KB

Download