61e39d6315924cf6e7bd41cdc6b81cc815ad0ef9f6d86f515c43b8f6b35211a4

General

Target

2023-03-08_1025.doc
Size

537.3MB
MD5

183aff7571708bfe62f6fa5970f9291e
SHA1

6e4cf58ed7fa40754f7cca2cb59d8342f47d5b4d
SHA256

a4cc1fff6eae705fab7fe91be559831ca6d55c604897edaeef099a7d9598dd42
SHA512

44c59f2d3178c3ffe0a3ae196cb8a12645e8ab81b4f40260622c6a7e5017840faca522ecc7ad6092e61af4996ce60f7e33121dcb2fae6e80343186435e3b1e30
SSDEEP

6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	816	908	regsvr32.exe	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

908 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

908 WINWORD.EXE
908 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

908 WINWORD.EXE
908 WINWORD.EXE

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
908	WINWORD.EXE

pid	process
908	WINWORD.EXE
908	WINWORD.EXE

pid	process
908	WINWORD.EXE
908	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2023-03-08_1025.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:908

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\022255.tmp"
2⤵
- Process spawned unexpected child process
PID:816

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\022255.tmp"
3⤵
PID:912

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XXJXQVxeHIvwKx\wJNRpAspWlCq.dll"
4⤵
PID:280

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1176

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\022255.tmp
Filesize
359.3MB

MD5
803dbb2ff5dfacce96f9324d83700ebe

SHA1
430604e7a5a361a015a6591a3673e889850eb4a8

SHA256
ef45ffb6b54eab250cffe1a7158ddf156c68f4f4fb95fe8e4cd85281b50e83ab

SHA512
0261814a4fd55fdb6252b21dd39bb593a7c343135a1c6c285975a53c75f75a32afff3fe0f09c6510c2102e5c4a79940b18cc86bab1d7cb28b26b5adadffacd3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\022259.zip
Filesize
867KB

MD5
6c839d892fef2f37d973ca28ce5e7a3b

SHA1
175ee07dc770ad81455d1f95152f1ae07e875e0e

SHA256
b2f19314b692f584203e6711e8d54f32b91a7864adbd203a4eaf6785042d47d9

SHA512
18a1ffa1876554a0e7716cbe5d77ce26a373aeb16992986bb8baaece2af502b576d7001a4271ceda09cec6fbbe750c06c8d40d4449ff8b52d01a924a49462af7

Download Submit
\Users\Admin\AppData\Local\Temp\022255.tmp
Filesize
333.5MB

MD5
a8cf32218a5d620ef8fbced8f5a4b999

SHA1
b227c1532be31ffa590a6f8a46e332fadbfc8090

SHA256
01f561b914b8c557bb37fa519e9d060b2714357d6d88b730d91616769dea049f

SHA512
a34e89728cb6c5e7d38fdc02ff6a68c10b9e24342b48522c93b64028618d099d8409526c71692908d900130958806a2b5717b7f500fa5f9a18256ac3aa689bc3

Download Submit
\Users\Admin\AppData\Local\Temp\022255.tmp
Filesize
373.6MB

MD5
20355e4cf04979bdc9a72b84fed38459

SHA1
0dacfa32ae6893c8ea40b00857991f5c10ae86c9

SHA256
69a2fd080c80dfb81a82a08f332c03017762fe6c203d93170a3ee0484b518ae2

SHA512
c58b19c42bd4a0db9f83d7d505d18ae678e54b271ee4ac3e7975e62d067fe126b39a3c9e4ef0cfaaa0575dbf131a89caa7bd14b253bc992050d5bf704233ce6c

Download Submit
memory/280-1271-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/908-86-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-66-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-58-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-60-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-61-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-62-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-64-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-63-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-65-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-68-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-70-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-69-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-77-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-75-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-91-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-80-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-81-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-83-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-84-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-85-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-87-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-57-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-78-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-59-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-89-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-97-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-94-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-92-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-93-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-98-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-90-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-88-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-95-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-82-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-79-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-76-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-74-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-73-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-71-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-99-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-72-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-67-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-96-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-114-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/908-1072-0x00000000062A0000-0x00000000062A1000-memory.dmp

Filesize
4KB

Download
memory/908-1269-0x00000000062A0000-0x00000000062A1000-memory.dmp

Filesize
4KB

Download
memory/908-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/912-1264-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing