2f4a7d026c4085d8a4a8ce49a6a0c0811709967063c6300a4ba5b56951c63a85

General

Target

954895897851030__2023-08-03_0953.doc
Size

502.3MB
MD5

a59e9fe46fe7ccd8c74b1dc39553d1a5
SHA1

6b2699157dd7bb19cdb7f0ffb959c20c90318e9c
SHA256

4792472bd90dab5885a789793a3309109b7f8d305203faa011d92b0efdf1720b
SHA512

cfc9951ccf2e7001184b71855c1074c5c8a74b8739494121f5df6f8151d90af6ff5f9ea6b524f71fc4d5b3a3ded608172372c49cb9f7771c6594cb19d179435d
SSDEEP

6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1536	1120	regsvr32.exe	WINWORD.EXE

Loads dropped DLL 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1536 regsvr32.exe
316 regsvr32.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

pid	process
1536	regsvr32.exe
316	regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1120 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

316 regsvr32.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

WINWORD.EXE

pid process

1120 WINWORD.EXE
1120 WINWORD.EXE
1120 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1120 WINWORD.EXE
1120 WINWORD.EXE

pid	process
1120	WINWORD.EXE

pid	process
316	regsvr32.exe

pid	process
1120	WINWORD.EXE
1120	WINWORD.EXE
1120	WINWORD.EXE

pid	process
1120	WINWORD.EXE
1120	WINWORD.EXE

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

WINWORD.EXEregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1120 wrote to memory of 1536	1120	WINWORD.EXE	regsvr32.exe
PID 1120 wrote to memory of 1536	1120	WINWORD.EXE	regsvr32.exe
PID 1120 wrote to memory of 1536	1120	WINWORD.EXE	regsvr32.exe
PID 1120 wrote to memory of 1536	1120	WINWORD.EXE	regsvr32.exe
PID 1120 wrote to memory of 1536	1120	WINWORD.EXE	regsvr32.exe
PID 1120 wrote to memory of 1536	1120	WINWORD.EXE	regsvr32.exe
PID 1120 wrote to memory of 1536	1120	WINWORD.EXE	regsvr32.exe
PID 1536 wrote to memory of 316	1536	regsvr32.exe	regsvr32.exe
PID 1536 wrote to memory of 316	1536	regsvr32.exe	regsvr32.exe
PID 1536 wrote to memory of 316	1536	regsvr32.exe	regsvr32.exe
PID 1536 wrote to memory of 316	1536	regsvr32.exe	regsvr32.exe
PID 1536 wrote to memory of 316	1536	regsvr32.exe	regsvr32.exe
PID 1536 wrote to memory of 316	1536	regsvr32.exe	regsvr32.exe
PID 1536 wrote to memory of 316	1536	regsvr32.exe	regsvr32.exe
PID 316 wrote to memory of 1948	316	regsvr32.exe	regsvr32.exe
PID 316 wrote to memory of 1948	316	regsvr32.exe	regsvr32.exe
PID 316 wrote to memory of 1948	316	regsvr32.exe	regsvr32.exe
PID 316 wrote to memory of 1948	316	regsvr32.exe	regsvr32.exe
PID 316 wrote to memory of 1948	316	regsvr32.exe	regsvr32.exe
PID 1120 wrote to memory of 840	1120	WINWORD.EXE	splwow64.exe
PID 1120 wrote to memory of 840	1120	WINWORD.EXE	splwow64.exe
PID 1120 wrote to memory of 840	1120	WINWORD.EXE	splwow64.exe
PID 1120 wrote to memory of 840	1120	WINWORD.EXE	splwow64.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\954895897851030__2023-08-03_0953.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\051303.tmp"
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\051303.tmp"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\EtoWssabapbHsqDGN\sbYFuGloBVlZmNfJ.dll"
4⤵
PID:1948

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:840

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\051303.tmp
Filesize
525.5MB

MD5
1b90c8c4f02ecc6637186127ed3d10b9

SHA1
6422278a0347e618c4e9936fd95182389b3b7ef6

SHA256
3cb46a4056e6ac1c5f605003334e215526c4cb6d07da1eca187c620e958eaf2a

SHA512
e89e4b4e3d217e61480aeb307097e40b62b137b5824ccf7b1ed923f13a00f3d1703a45c030973918b35787621c93f9e3127cd4f6e56a78275e63727519010383

Download Submit
C:\Users\Admin\AppData\Local\Temp\051309.zip
Filesize
820KB

MD5
a15b8684891df0bddf58efdcb27755fb

SHA1
32b09a7b69397829be27331d15777743a845551d

SHA256
fc21145c5742e1ab2299c1b74ae1251d49492330512312bf2b310be58ed674c3

SHA512
0c478a95e7152562d8b6cad14fae83329190f542b35d65b1c1dfb6a3cf71e66b1890fbb6a79e404c2dceeb87c149be3134d16ce69efbd795fe9006816ed17224

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
20KB

MD5
d48342312f9c9c2935cd774dfa7110ca

SHA1
eff23470e554e66872a647d5fbec4270e2cde2c2

SHA256
87ddc06b9224ad56045e048f6b9611cddc4755ebc132b241102fb55d78678c29

SHA512
f8aff6d28a83ebb48e06ea4a62e0dac70a126d1dddf1462ad8d776cf6458c3894b2d447d7cb7fcc265ecd010b52dc16496f98f9686c81210d630552ac52302a9

Download Submit
\Users\Admin\AppData\Local\Temp\051303.tmp
Filesize
525.5MB

MD5
1b90c8c4f02ecc6637186127ed3d10b9

SHA1
6422278a0347e618c4e9936fd95182389b3b7ef6

SHA256
3cb46a4056e6ac1c5f605003334e215526c4cb6d07da1eca187c620e958eaf2a

SHA512
e89e4b4e3d217e61480aeb307097e40b62b137b5824ccf7b1ed923f13a00f3d1703a45c030973918b35787621c93f9e3127cd4f6e56a78275e63727519010383

Download Submit
\Users\Admin\AppData\Local\Temp\051303.tmp
Filesize
525.5MB

MD5
1b90c8c4f02ecc6637186127ed3d10b9

SHA1
6422278a0347e618c4e9936fd95182389b3b7ef6

SHA256
3cb46a4056e6ac1c5f605003334e215526c4cb6d07da1eca187c620e958eaf2a

SHA512
e89e4b4e3d217e61480aeb307097e40b62b137b5824ccf7b1ed923f13a00f3d1703a45c030973918b35787621c93f9e3127cd4f6e56a78275e63727519010383

Download Submit
memory/316-1262-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1120-80-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-83-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-60-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-61-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-62-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-64-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-65-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-66-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-67-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-68-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-69-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-70-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-71-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-72-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-74-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-75-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-77-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-76-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-78-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-79-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-58-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-81-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-82-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-59-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-84-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-85-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-86-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-87-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-88-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-73-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-89-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-90-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-93-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-92-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-91-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-94-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-95-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-97-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-96-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-98-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-63-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-57-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-99-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-101-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1120-1077-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/1120-1263-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/1120-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1948-1264-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads