a66276f066d74f9bd08be56707f334df41ad38561a2b39381a68a166fd4ac35c

Analysis

max time kernel
23s
max time network
90s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15-03-2023 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fattura 98978.doc
Size

537.3MB
MD5

8064fcb1beed9f3ae6d71c5c18f7da08
SHA1

bc964aeda83f862e4f0b5248fc3d9c2ed5949cff
SHA256

01792c064f0125ee220c2665746b52dfd91e1eeb8b5f58b0dc4f8d19212c5e07
SHA512

ce5d7cba167dc3b2c6822f847afa8acd250c9d6d5a8aa6db0d007422d08166b132e63d4795c6bd5293265079d3bcbce50ed6738a85b3b224a2d5fc3af2602cf5
SSDEEP

6144:1620tqUx3Xu+7ZkRIDNGi9a0Va5UAClo:1620tqm3+I2ezcz5U3lo

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1536	2028	regsvr32.exe	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

2028 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

2028 WINWORD.EXE
2028 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

2028 WINWORD.EXE
2028 WINWORD.EXE

pid	process
2028	WINWORD.EXE

pid	process
2028	WINWORD.EXE
2028	WINWORD.EXE

pid	process
2028	WINWORD.EXE
2028	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Fattura 98978.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2028

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\090824.tmp"
2⤵
- Process spawned unexpected child process
PID:1536

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\090824.tmp"
3⤵
PID:1672

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VwmrShVShYZ\vqNhXCuXXfUzbDMI.dll"
4⤵
PID:1752

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1728

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
1e95ed9f9cec7cab04ec76f350075def

SHA1
d250fb07daac49add6a166f79f14e59e8359f729

SHA256
36effd912442d3d0289b0a504c6a8919f89cce92e6ae05ddf8d17748652589eb

SHA512
de31f5157dc95e601d2cbd1b36cbc0b71a87d47f3c1db0fd67146fb972cbdc3cbd7a55dc70a8ed49979a7dcd3c11124d00778463cda86cc0a7589f3eb6929f02

Download Submit
C:\Users\Admin\AppData\Local\Temp\090824.tmp
Filesize
364.3MB

MD5
4b97981fed358d95b38554b5bc590ed1

SHA1
4c1293c2ccca0ffa2fb04506257a50952a658361

SHA256
a022e646c3b9a166a907933f6d29488248490426492c4a09af71d32da5df20e4

SHA512
fd988b2fe3f03d8ee379b3295202035a9055a741a6000f62c4522f9a1e9a4be41cc30edcf1d39d0de729e93af96c3924f00e168455177bec16a92443fee7017d

Download Submit
C:\Users\Admin\AppData\Local\Temp\090830.zip
Filesize
848KB

MD5
6ca08498216e84fe3c72d921398f0795

SHA1
66d202b530cf08f7482d0a99c96b11528ec6fd44

SHA256
c3d815983921d2913b0f92f45e75068044fd0652ad7983cb96470034cd13591d

SHA512
145af7b6fef38976c8c5e83b0c9e3a365921b0907be171a9d6c16d6a72221ae293710c03453168761fd9e0b026212268dd58b78c36f46dc3bb3e71f080cccddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4493.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar45C2.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
20KB

MD5
d04e4156b94df25c666ec4d20bb15c35

SHA1
5102f18bd24f5554f0701b1f794547c77c20deef

SHA256
7659105c98112497357b07d557cb329b16ff8bbd99504911080a5ed3458e1a39

SHA512
ad4d5d5df83ff22b840dc067b2c9b3f03dddf26426f726cbb6b9438002271ba23812acd35553d4416d0b690ead8f7e500f127855cce3b6d0a2b66d7c0c31d0e4

Download Submit
\Users\Admin\AppData\Local\Temp\090824.tmp
Filesize
368.2MB

MD5
0bafdf03128e9733860a405e4df48eca

SHA1
41ecab239f9bf9bbadade681c5a79ccfdf0da4d0

SHA256
e983e85b55fb12ce0f0a1c62bf925cce2c343ed16244da7e6db93ded0328c02d

SHA512
2920eb30bb7e524b6eda973fe52ff35a3db04ebe7eac578bc84a3088d26bc8d596255bd862daf9fecbf3ae11a2c917ba26c288145e97a1292475c3d7288a4908

Download Submit
\Users\Admin\AppData\Local\Temp\090824.tmp
Filesize
368.7MB

MD5
ee404a50d1ad47555b8b305cfd380b64

SHA1
97bff1e6e500ce8060145f2eb529d319de93867b

SHA256
4c101f9fba50ac2f838d31966052fa605f565cc00220069bad66288f1d58dd08

SHA512
98ddeb15ae7c366cf3dac7a0f174560a8a46fd10dc6080f0406e94a5988ccfd8517215fd21610c78e960bd8d94b86caf6f6b60f08f92ca69fd0d772c2bfb8628

Download Submit
memory/1672-1416-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2028-1279-0x0000000005B10000-0x0000000005C10000-memory.dmp

Filesize
1024KB

Download
memory/2028-1280-0x0000000005B10000-0x0000000005C10000-memory.dmp

Filesize
1024KB

Download
memory/2028-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2028-1269-0x0000000005B10000-0x0000000005C10000-memory.dmp

Filesize
1024KB

Download
memory/2028-1224-0x0000000005B10000-0x0000000005C10000-memory.dmp

Filesize
1024KB

Download
memory/2028-1417-0x0000000006260000-0x0000000006261000-memory.dmp

Filesize
4KB

Download
memory/2028-1215-0x0000000006260000-0x0000000006261000-memory.dmp

Filesize
4KB

Download