d144887ca7c5dd00322b380fd5f335976bf9a3ac7c7d7e59b1a328fa27332bb1

Analysis

max time kernel
118s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-03-2023 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Untitled_9143.doc
Size

540.4MB
MD5

a2859aeb3b15be66f55cfd7b0bb2f974
SHA1

46e75f07a23e897a3353e7bae30f3d775309bf9d
SHA256

df2d994e5f815928ef637c683843d33e2c8d2ea15c04b821400d7b185b275bfd
SHA512

5dcb869dca2b45ddff9b9433dfc8033fe67c2887a81f547cbfa8f573e5edfb60f4a176849e09ad63c842d35de753a58fd54f1b541bdd8dbc549293b6b0398198
SSDEEP

6144:5yk1RgZZXbN63GW1Z7krKSUzMNYJJdKkOl950uH54Lg4Ne9C:5/MXJ6WW1Z7ktUgNYJJdKkOHC4D409

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	988	1744	regsvr32.exe	WINWORD.EXE

Loads dropped DLL 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

988 regsvr32.exe
576 regsvr32.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

pid	process
988	regsvr32.exe
576	regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 11 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1744 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

576 regsvr32.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

WINWORD.EXE

pid process

1744 WINWORD.EXE
1744 WINWORD.EXE
1744 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1744 WINWORD.EXE
1744 WINWORD.EXE

description	flow	ioc
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
1744	WINWORD.EXE

pid	process
576	regsvr32.exe

pid	process
1744	WINWORD.EXE
1744	WINWORD.EXE
1744	WINWORD.EXE

pid	process
1744	WINWORD.EXE
1744	WINWORD.EXE

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

WINWORD.EXEregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1744 wrote to memory of 2004	1744	WINWORD.EXE	splwow64.exe
PID 1744 wrote to memory of 2004	1744	WINWORD.EXE	splwow64.exe
PID 1744 wrote to memory of 2004	1744	WINWORD.EXE	splwow64.exe
PID 1744 wrote to memory of 2004	1744	WINWORD.EXE	splwow64.exe
PID 1744 wrote to memory of 988	1744	WINWORD.EXE	regsvr32.exe
PID 1744 wrote to memory of 988	1744	WINWORD.EXE	regsvr32.exe
PID 1744 wrote to memory of 988	1744	WINWORD.EXE	regsvr32.exe
PID 1744 wrote to memory of 988	1744	WINWORD.EXE	regsvr32.exe
PID 1744 wrote to memory of 988	1744	WINWORD.EXE	regsvr32.exe
PID 1744 wrote to memory of 988	1744	WINWORD.EXE	regsvr32.exe
PID 1744 wrote to memory of 988	1744	WINWORD.EXE	regsvr32.exe
PID 988 wrote to memory of 576	988	regsvr32.exe	regsvr32.exe
PID 988 wrote to memory of 576	988	regsvr32.exe	regsvr32.exe
PID 988 wrote to memory of 576	988	regsvr32.exe	regsvr32.exe
PID 988 wrote to memory of 576	988	regsvr32.exe	regsvr32.exe
PID 988 wrote to memory of 576	988	regsvr32.exe	regsvr32.exe
PID 988 wrote to memory of 576	988	regsvr32.exe	regsvr32.exe
PID 988 wrote to memory of 576	988	regsvr32.exe	regsvr32.exe
PID 576 wrote to memory of 1112	576	regsvr32.exe	regsvr32.exe
PID 576 wrote to memory of 1112	576	regsvr32.exe	regsvr32.exe
PID 576 wrote to memory of 1112	576	regsvr32.exe	regsvr32.exe
PID 576 wrote to memory of 1112	576	regsvr32.exe	regsvr32.exe
PID 576 wrote to memory of 1112	576	regsvr32.exe	regsvr32.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Untitled_9143.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:2004

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\152748.tmp"
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:988

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\152748.tmp"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XTSyczyrhLIAg\XdlyYGDt.dll"
4⤵
PID:1112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\152748.tmp
Filesize
536.5MB

MD5
08cdd2d7dc4d14f56453e2b5e0a02af8

SHA1
60eacaec0a1f464317072edaf22e3611c47855d8

SHA256
173d61731e6dc372e9ab4bf0aaa0f21d9e1230fef39912058bef5825808005ea

SHA512
380f95b314bf77802455687bb37b35450a300a34b408f9bf94ed3a7849b407c2bd139ad6d80431b3e909a2795afed2fbe46754ccdcb511401a04969cd4610e20

Download Submit
C:\Users\Admin\AppData\Local\Temp\152754.zip
Filesize
843KB

MD5
b2034e76b8c3ae360fd5cab92d1b5ad2

SHA1
e9c111cb4880e85bda5f89ee7ef2edbdab6643f5

SHA256
ce3b4b4859b3d0eeb960353926c62c908a2f4797715b60b3a87ab7f9439b411a

SHA512
63ef8c2d4949d008a49ce847cee6203022a54d4151075565137658854ff7f9b2764991ce9f81a4ae8e6e92a866c467098d4814837fdcdb7193ebc981efa477bb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
20KB

MD5
b2592600120132385adc4bcdb8e3e6a1

SHA1
83f07af3e5f449a98ae7e948afcc8305a20ba388

SHA256
c3db25ebc0535b5df235f41cae5b43446e498314a5a2554ceb401037c42abdd8

SHA512
1f9220a99eb745f81e25ffb01f71b9cfd23880fc8cc5e9286bce1c59f8f4fc44d3f22738c306082c977e5d2fee80084e31fe12d7caff908675964d58ac54b03e

Download Submit
\Users\Admin\AppData\Local\Temp\152748.tmp
Filesize
536.5MB

MD5
08cdd2d7dc4d14f56453e2b5e0a02af8

SHA1
60eacaec0a1f464317072edaf22e3611c47855d8

SHA256
173d61731e6dc372e9ab4bf0aaa0f21d9e1230fef39912058bef5825808005ea

SHA512
380f95b314bf77802455687bb37b35450a300a34b408f9bf94ed3a7849b407c2bd139ad6d80431b3e909a2795afed2fbe46754ccdcb511401a04969cd4610e20

Download Submit
\Users\Admin\AppData\Local\Temp\152748.tmp
Filesize
536.5MB

MD5
08cdd2d7dc4d14f56453e2b5e0a02af8

SHA1
60eacaec0a1f464317072edaf22e3611c47855d8

SHA256
173d61731e6dc372e9ab4bf0aaa0f21d9e1230fef39912058bef5825808005ea

SHA512
380f95b314bf77802455687bb37b35450a300a34b408f9bf94ed3a7849b407c2bd139ad6d80431b3e909a2795afed2fbe46754ccdcb511401a04969cd4610e20

Download Submit
memory/576-1739-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1112-1741-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1744-82-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-1740-0x0000000006CF0000-0x0000000006CF1000-memory.dmp

Filesize
4KB

Download
memory/1744-61-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-62-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-63-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-64-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-65-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-66-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-67-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-68-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-69-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-70-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-71-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-93-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-73-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-74-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-76-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-78-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-77-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-75-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-79-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-80-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-81-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-84-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-83-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-85-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-86-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-59-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-87-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-88-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-90-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-60-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-72-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-96-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-95-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-94-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-92-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-89-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-98-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-97-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-99-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-100-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-101-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-102-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-103-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-104-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-105-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-106-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-108-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-109-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-110-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-111-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-107-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-112-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-113-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-115-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-114-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-116-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-117-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-1486-0x0000000006CF0000-0x0000000006CF1000-memory.dmp

Filesize
4KB

Download
memory/1744-91-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-58-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/1744-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download