9e3c0895682b32bb04a2021277e273e34217fb11997c6131bbf83054afd65568

Analysis

max time kernel
30s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-03-2023 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

untitled_14032023.doc
Size

501.4MB
MD5

50eb90f3e451375804fd9d98d6138cdc
SHA1

5b1619c3a35724b9ddd6665c49114f16b715dacd
SHA256

671860b937257d8c1112283d78357c8c7f4de998dfff62e8a13c7b80f4fe2676
SHA512

9d1d9035de7aa01ff612b20c12c12b4aebee9e4941269c6cddcf988acacedc270a288e5e0b5fe5447fb97be46b39776c3fe80e021c709b90d8c3091fae2668a8
SSDEEP

6144:5yk1RgZZXbN63GW1Z7krKSUzMNYJJdKkOl950uH54Lg4Ne9C:5/MXJ6WW1Z7ktUgNYJJdKkOHC4D409

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1904	840	regsvr32.exe	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 11 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

840 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

840 WINWORD.EXE
840 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

840 WINWORD.EXE
840 WINWORD.EXE

description	flow	ioc
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
840	WINWORD.EXE

pid	process
840	WINWORD.EXE
840	WINWORD.EXE

pid	process
840	WINWORD.EXE
840	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 840 wrote to memory of 2008	840	WINWORD.EXE	splwow64.exe
PID 840 wrote to memory of 2008	840	WINWORD.EXE	splwow64.exe
PID 840 wrote to memory of 2008	840	WINWORD.EXE	splwow64.exe
PID 840 wrote to memory of 2008	840	WINWORD.EXE	splwow64.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\untitled_14032023.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:2008

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\144510.tmp"
2⤵
- Process spawned unexpected child process
PID:1904

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\144510.tmp"
3⤵
PID:308

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ItleDRdRABniKHoyl\WeOVe.dll"
4⤵
PID:1576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\144510.tmp
Filesize
438.4MB

MD5
560d8a1ae3b7422076e1fa274622c1b7

SHA1
bda06893f77d37244b294fb006a1ef73d5dda89d

SHA256
2381fbc3c60fd93c867cf66ae33cefd39122f16b16faaa9369fbc1bc36254300

SHA512
53175675f39586f9029e6c81b628cb8c6a5e841c729e65ab0fd7497979faa099ee585db8c970cf83df80d03d927ad9a8466b9e9cdf14d77a1124cdb7f0cd7c81

Download Submit
C:\Users\Admin\AppData\Local\Temp\144517.zip
Filesize
840KB

MD5
9d981a69aabf1188886040d54fb4aa9b

SHA1
ffc01610fa628cc6ca68d7eb42f9f6b6cbb3e033

SHA256
741ba2304437d0197941620fc6fc5ceb03e5661e463aa7a634f0c1a814216047

SHA512
d3aa46a8edc40099171454e2647d78dc89cc987111216ee388d864edbfe34275beb205498f52bf2b54cec77041b98c16734544c5d853045990c9367eb955dc4d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
20KB

MD5
a0fb82fb3afefb4266f27d59d1345e5a

SHA1
af7cf50bb123831dee7742a4c9318f25d8002251

SHA256
da933b0ffc12f5c4e0768a4f812fafa38f5aefaf665a1970ee73895de38e5e57

SHA512
74b2f3428f635d144c71103f1160f5759d69a4052908bed6a8a80a16deecd84ccdb108fa5921c5c9fedcea02e11f1385a15de435558ca59312919b7685ac389e

Download Submit
\Users\Admin\AppData\Local\Temp\144510.tmp
Filesize
460.8MB

MD5
6ba58c5cdcb10058af40aa9744549f55

SHA1
408f69cf078f959bda5c6f78849eb088d6bcfff0

SHA256
c65da8e88276463620e29c532c58a951ac12b6ca93005c3b076cea1d618f5bbf

SHA512
443978d51638d22b0735fc81bd019cde806eb8d4a8f0c7a63ad5acadca15f7136d278f1b6ad6ac20d3f231f3fca9fa0dbc4a70d3b94532f3f1cb5d454636a554

Download Submit
\Users\Admin\AppData\Local\Temp\144510.tmp
Filesize
486.2MB

MD5
9c5f59dfe19e568abdcfaa2e12202425

SHA1
6672571899232587386dab20235b7b7591454bd2

SHA256
24dec74f8bc2124672d4f4f523bc5a9d6b75b142c378f5447582d0de778fadee

SHA512
c49cde3e41ccdbb34f0c584653e57c739e3e4bcebbd788f9239076bf163af895e430814c3c6e4f8f720c8a53bb2557a65a498b24936a63962d84ecfda1cd4299

Download Submit
memory/308-1739-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/840-86-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-68-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-61-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-60-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-62-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-63-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-64-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-65-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-66-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-67-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-91-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-69-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-70-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-71-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-73-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-72-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-74-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-75-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-76-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-77-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-78-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-79-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-80-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-81-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-83-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-84-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-82-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-85-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-58-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-89-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/840-113-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-59-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-87-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-92-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-93-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-94-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-95-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-96-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-97-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-98-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-99-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-100-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-101-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-103-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-104-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-105-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-102-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-106-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-107-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-108-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-109-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-110-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-111-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-112-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-114-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-115-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-116-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-117-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-88-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-1486-0x0000000006950000-0x0000000006951000-memory.dmp

Filesize
4KB

Download
memory/840-90-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/840-1744-0x0000000006950000-0x0000000006951000-memory.dmp

Filesize
4KB

Download
memory/1576-1745-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download