Analysis
-
max time kernel
115s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14-03-2023 15:18
Behavioral task
behavioral1
Sample
DETAILS 14032023.doc
Resource
win7-20230220-en
General
-
Target
DETAILS 14032023.doc
-
Size
518.4MB
-
MD5
f30f9eed1fc654c010ab7dec52291fbd
-
SHA1
b17388dbcf3a8e437358865c597ba372c7a4a79d
-
SHA256
32b73674bef1bf5a7893ddfff9ab38c3efb281f09838c723cbf5c9f1f5cca10c
-
SHA512
7485d2adad87bbc74281dc555e9e97284a4ef2513093b6e1448c06ddb1fa32bbbf13515a88af2ea14b6136c4f6726ffe4f7929619ab9f57c3d840b36d9cd1faf
-
SSDEEP
6144:5yk1RgZZXbN63GW1Z7krKSUzMNYJJdKkOl950uH54Lg4Ne9C:5/MXJ6WW1Z7ktUgNYJJdKkOHC4D409
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 1276 940 regsvr32.exe WINWORD.EXE -
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 1276 regsvr32.exe 1188 regsvr32.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 11 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 940 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
regsvr32.exepid process 1188 regsvr32.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
WINWORD.EXEpid process 940 WINWORD.EXE 940 WINWORD.EXE 940 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 940 WINWORD.EXE 940 WINWORD.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
WINWORD.EXEregsvr32.exeregsvr32.exedescription pid process target process PID 940 wrote to memory of 1500 940 WINWORD.EXE splwow64.exe PID 940 wrote to memory of 1500 940 WINWORD.EXE splwow64.exe PID 940 wrote to memory of 1500 940 WINWORD.EXE splwow64.exe PID 940 wrote to memory of 1500 940 WINWORD.EXE splwow64.exe PID 940 wrote to memory of 1276 940 WINWORD.EXE regsvr32.exe PID 940 wrote to memory of 1276 940 WINWORD.EXE regsvr32.exe PID 940 wrote to memory of 1276 940 WINWORD.EXE regsvr32.exe PID 940 wrote to memory of 1276 940 WINWORD.EXE regsvr32.exe PID 940 wrote to memory of 1276 940 WINWORD.EXE regsvr32.exe PID 940 wrote to memory of 1276 940 WINWORD.EXE regsvr32.exe PID 940 wrote to memory of 1276 940 WINWORD.EXE regsvr32.exe PID 1276 wrote to memory of 1188 1276 regsvr32.exe regsvr32.exe PID 1276 wrote to memory of 1188 1276 regsvr32.exe regsvr32.exe PID 1276 wrote to memory of 1188 1276 regsvr32.exe regsvr32.exe PID 1276 wrote to memory of 1188 1276 regsvr32.exe regsvr32.exe PID 1276 wrote to memory of 1188 1276 regsvr32.exe regsvr32.exe PID 1276 wrote to memory of 1188 1276 regsvr32.exe regsvr32.exe PID 1276 wrote to memory of 1188 1276 regsvr32.exe regsvr32.exe PID 1188 wrote to memory of 1692 1188 regsvr32.exe regsvr32.exe PID 1188 wrote to memory of 1692 1188 regsvr32.exe regsvr32.exe PID 1188 wrote to memory of 1692 1188 regsvr32.exe regsvr32.exe PID 1188 wrote to memory of 1692 1188 regsvr32.exe regsvr32.exe PID 1188 wrote to memory of 1692 1188 regsvr32.exe regsvr32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\DETAILS 14032023.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\161949.tmp"2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\161949.tmp"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\WzbFbFEuVzBcrTPfV\lJgZeyrUlPHOkXXF.dll"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\161949.tmpFilesize
518.5MB
MD55d82ffd92fedcf51f9d0567c00bbc86f
SHA1937136806d35f012dce1bb41234f1b4fb6706817
SHA256dddc9be1b18831d21eb3b403ba0190e9e3e6ec839694081642d9e934be335b31
SHA512a690d8245dbad71979f69350d5fd37aa2b0be9045ee67cf040f7db8ddf4f6eaa07409f633829950a9f2ec90e9b1839c878b75e4b554c5d4459f470e903963171
-
C:\Users\Admin\AppData\Local\Temp\161956.zipFilesize
825KB
MD5d2d461a0329936877bff5c9e5376ea7b
SHA15385fc7976a2c3d53ec55d069eee4a76be7307ff
SHA256fc9376193c41997754a373c33d5f10cf380ee295da28b0aa3e550e648bb9d45d
SHA512a672d4ef9144a276b9f451a564229a54173edb0725ccee1e15b49224e411623b97521bcfc06a69cdbc6cd35415ba9a5130be2f9516bda050dee9422561174061
-
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotmFilesize
20KB
MD506e4d4a85c46e4654b062d59663d54ef
SHA128b89f2e93e54df3e428695bddebcc60ebd1498b
SHA2561da29239355fd1111ba3f70786a8b0add847216120116a71140c2dfa615f9690
SHA5123d968444c82897ac6f9b600d9a233cf88127558b7473c20d1ae2212d33d834a8aa5e5fa02abdbf869718495ece7e9d67acc420acfcab4d6b4b29813ec52b7a2b
-
\Users\Admin\AppData\Local\Temp\161949.tmpFilesize
518.5MB
MD55d82ffd92fedcf51f9d0567c00bbc86f
SHA1937136806d35f012dce1bb41234f1b4fb6706817
SHA256dddc9be1b18831d21eb3b403ba0190e9e3e6ec839694081642d9e934be335b31
SHA512a690d8245dbad71979f69350d5fd37aa2b0be9045ee67cf040f7db8ddf4f6eaa07409f633829950a9f2ec90e9b1839c878b75e4b554c5d4459f470e903963171
-
\Users\Admin\AppData\Local\Temp\161949.tmpFilesize
518.5MB
MD55d82ffd92fedcf51f9d0567c00bbc86f
SHA1937136806d35f012dce1bb41234f1b4fb6706817
SHA256dddc9be1b18831d21eb3b403ba0190e9e3e6ec839694081642d9e934be335b31
SHA512a690d8245dbad71979f69350d5fd37aa2b0be9045ee67cf040f7db8ddf4f6eaa07409f633829950a9f2ec90e9b1839c878b75e4b554c5d4459f470e903963171
-
memory/940-87-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-117-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-61-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-62-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-63-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-58-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-64-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-65-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-66-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-67-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-92-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-69-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-70-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-71-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-72-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-73-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-76-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-75-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-77-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-78-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-74-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-80-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-81-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-82-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-83-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-79-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-84-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-85-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-86-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-59-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-1740-0x0000000006B10000-0x0000000006B11000-memory.dmpFilesize
4KB
-
memory/940-60-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-68-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-90-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-89-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-94-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-95-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-96-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-97-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-93-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-98-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-99-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-100-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-101-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-102-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-104-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-105-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-106-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-108-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-109-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-107-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-103-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-110-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-111-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-112-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-113-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-114-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-116-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-115-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-91-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-1481-0x0000000006B10000-0x0000000006B11000-memory.dmpFilesize
4KB
-
memory/940-88-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/940-54-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1188-1739-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB