fbc60c048caa0befdb10aaebf3fa5fa073d98908df453d2e7f75c6257258dd16

Analysis

max time kernel
35s
max time network
148s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-03-2023 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO0000009936.doc
Size

545.3MB
MD5

9270ef740b9062825ac0d9ebc6556349
SHA1

51490c2112ac9c2512361adccbf54f6903cf2eab
SHA256

78b9f580f1c848004499727ce4ba7c47bb9e4c8fd23937aa28804ccec9b54c6e
SHA512

f60223cb77a7abf0bc05d239a5165a935107568843c845ba179c4504ba9936ada89e1c4a5d0938a6d6d6ab36fa63de7b1b4eaf33fda6a246f8c93bfbd6bbedec
SSDEEP

6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	848	1928	regsvr32.exe	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1928 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

1928 WINWORD.EXE
1928 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1928 WINWORD.EXE
1928 WINWORD.EXE

pid	process
1928	WINWORD.EXE

pid	process
1928	WINWORD.EXE
1928	WINWORD.EXE

pid	process
1928	WINWORD.EXE
1928	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\PO0000009936.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1928

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\084427.tmp"
2⤵
- Process spawned unexpected child process
PID:848

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\084427.tmp"
3⤵
PID:1432

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YlVBKD\FUoxYjsRLeNQIW.dll"
4⤵
PID:1624

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -Embedding
1⤵
PID:1796

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
63194e91bdbcb86b71f4966c5b2ae8f3

SHA1
57f2faf6456167dc2d9cbb2124be9c62230402a4

SHA256
f58ea6c0f5e725748e5849a44865b9c9598bef0a34e36756f56a48267f5d3c43

SHA512
7ed60b43861b5fe326337d0250567dae2302792578d8c342f2eb5e13658c5c470c0bb671986011bb7ff79b65305c2e3a2de910671b4f5ecd46d8acc8776769f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
9bbac1a61c791c2e6640334b03839d8a

SHA1
c8600d145ee6a5aa367cab07dd87be695a5ecccd

SHA256
f3c70de116264ee0a3ce262cc99c637878f038363cb0837eb902b37083e127c0

SHA512
49b6e675308ae1d8ca8e8948fffff3758fe08ebbfaeaef88a41509f8089c1c4a453c273f51c94213fe915aaee5b1deb66bd2bdd9604911677fb5d24221463b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\084427.tmp
Filesize
264.8MB

MD5
a45228380279888465bd374136cc5783

SHA1
8636106eab2df09503614799d304715be4d6c908

SHA256
6d325af83117272be853d5b03b8fd980feeb951a3c6bc7d10c3b85b5c49a6af9

SHA512
e2f0b1cc78d271890a4b54dac710ebda31569d3203608899d2b19973537aaafd52c513e017e7bbcaecec8b1fb5464d98189fd71e62a03479960144c9e31fda76

Download Submit
C:\Users\Admin\AppData\Local\Temp\084439.zip
Filesize
801KB

MD5
b85a01bf62f589613b21720b87341d1a

SHA1
94ec7443cf20ad4273779b7bff0e0df5c1bc3603

SHA256
305b1cebf5ad0c7093bacd53f065ffdc421349cc8b9ae27683f3d5aaae312e68

SHA512
1b979398c3ff59498caa3a2d0722ef19fcfccdefb706c096ae44f96cfa5b27ae8b3f5ab310356c4f3f66ed489de61021d894140b3b90169a3a282f684dc46414

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab64C0.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar68BD.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
\Users\Admin\AppData\Local\Temp\084427.tmp
Filesize
267.6MB

MD5
732bdc7761cce418e53ef475aad4a625

SHA1
bf2b037ade48c9aa8e12032c65884808ed72d3fd

SHA256
b0c26175775f7b66cfb3fe5b05d762baa1731d8ef33ba75f51723202ca09d4ef

SHA512
24d7f8fc819e8d64b098005001c9f77f67d358351949d1b4ee9eca2a8b17c6ebe2c89265bdd984e771c788944780c5c508354c3594c1e26ff62341038909efe6

Download Submit
\Users\Admin\AppData\Local\Temp\084427.tmp
Filesize
267.0MB

MD5
a3f32b432ba464fb61abf3c6a57db71e

SHA1
17837e2ebfc0ffb438762247f559f78e993b6baf

SHA256
5b9a6dea6318b2ad4737ac52de01ce56bd8e53faf8409e6ab9a5704a95423d7a

SHA512
8ee737883d85f36dfbea931106ca2a00e9a2f71c511bd7403abb4ff6d26d533b59e6f570a9a1e316f9498524ef4fee31ac35fe27291377b528c4d62c7355eb47

Download Submit
\Users\Admin\AppData\Local\Temp\Setup00000704\OSETUP.DLL
Filesize
5.5MB

MD5
fcc38158c5d62a39e1ba79a29d532240

SHA1
eca2d1e91c634bc8a4381239eb05f30803636c24

SHA256
e51a5292a06674cdbbcea240084b65186aa1dd2bc3316f61ff433d9d9f542a74

SHA512
0d224474a9358863e4bb8dacc48b219376d9cc89cea13f8d0c6f7b093dd420ceb185eb4d649e5bd5246758419d0531922b4f351df8ad580b3baa0fab88d89ec7

Download Submit
memory/1432-1330-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1624-1337-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1928-81-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-78-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1928-82-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-84-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-88-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-91-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-94-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-97-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-95-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-96-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-98-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-99-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-93-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-92-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-90-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-110-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-89-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-87-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-86-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-85-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-83-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-79-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-80-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-75-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-76-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-73-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-68-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-67-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-66-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-64-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-63-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-77-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-74-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-72-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-71-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-69-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-1143-0x0000000006240000-0x0000000006241000-memory.dmp

Filesize
4KB

Download
memory/1928-70-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-65-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-61-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-62-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-1336-0x0000000006240000-0x0000000006241000-memory.dmp

Filesize
4KB

Download
memory/1928-60-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-59-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-58-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/1928-57-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download