36f47fdefbb3ffe04a223d438c549805dde1945edb0da8bf067595db07187536

Analysis

max time kernel
31s
max time network
46s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-03-2023 06:47

Target

sin título_9.doc
Size

547.4MB
MD5

d6d262cef373f6138c14fc5d1c4106d2
SHA1

6e858b0e6645148e1ce33de472eb88319376bb0b
SHA256

a2b814ddbc78ce727559c9cac6d80ad8776f8030ac9764382205731388facdb2
SHA512

a10ab044ef573a41419a4a8bc998eea9f8362d78871f404c7123649401c89a5ee7d9fe0f0cd5d1b2ea421ebfd8f2ffec979eae6c1d455b3d7fbe9d1f2a3e944b
SSDEEP

6144:zZRtBPT4N/uQaNULlPUvauNTklB7ShcbYdFf8UOPv:zZvJhfKd2amwYdKUq

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 9 IoCs

Modify Registry

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1244 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1244 WINWORD.EXE
1244 WINWORD.EXE

pid	process
1244	WINWORD.EXE

pid	process
1244	WINWORD.EXE
1244	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 1244 wrote to memory of 540	1244	WINWORD.EXE	splwow64.exe
PID 1244 wrote to memory of 540	1244	WINWORD.EXE	splwow64.exe
PID 1244 wrote to memory of 540	1244	WINWORD.EXE	splwow64.exe
PID 1244 wrote to memory of 540	1244	WINWORD.EXE	splwow64.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1244-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download