Analysis
-
max time kernel
30s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
20-03-2023 12:58
Behavioral task
behavioral1
Sample
sin título_9.doc
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
sin título_9.doc
Resource
win10v2004-20230220-en
General
-
Target
sin título_9.doc
-
Size
547.4MB
-
MD5
d6d262cef373f6138c14fc5d1c4106d2
-
SHA1
6e858b0e6645148e1ce33de472eb88319376bb0b
-
SHA256
a2b814ddbc78ce727559c9cac6d80ad8776f8030ac9764382205731388facdb2
-
SHA512
a10ab044ef573a41419a4a8bc998eea9f8362d78871f404c7123649401c89a5ee7d9fe0f0cd5d1b2ea421ebfd8f2ffec979eae6c1d455b3d7fbe9d1f2a3e944b
-
SSDEEP
6144:zZRtBPT4N/uQaNULlPUvauNTklB7ShcbYdFf8UOPv:zZvJhfKd2amwYdKUq
Malware Config
Signatures
-
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1488 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1488 WINWORD.EXE 1488 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 1488 wrote to memory of 1956 1488 WINWORD.EXE splwow64.exe PID 1488 wrote to memory of 1956 1488 WINWORD.EXE splwow64.exe PID 1488 wrote to memory of 1956 1488 WINWORD.EXE splwow64.exe PID 1488 wrote to memory of 1956 1488 WINWORD.EXE splwow64.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\sin título_9.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1488-54-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1488-59-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-60-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-61-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-62-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-63-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-58-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-65-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-66-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-67-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-68-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-69-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-70-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-72-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-73-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-71-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-64-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-75-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-74-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-77-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-78-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-81-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-84-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-87-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-86-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-85-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-83-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-82-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-80-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-79-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-76-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-88-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-90-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-92-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-93-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-94-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-96-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-95-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-97-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-100-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-99-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-98-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-91-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-89-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-101-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/1488-111-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB