cff8ce540886d96bc449ffbc6784e2d1c6761586990d824bd546f3f86c7f8dc3

Analysis

max time kernel
0s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1f81a16de19d4f4a746cb2e4ff42eedf.doc
Size

30KB
MD5

1f81a16de19d4f4a746cb2e4ff42eedf
SHA1

6f4b3ba1130fa08ff83857447e221e281b3d9616
SHA256

cff8ce540886d96bc449ffbc6784e2d1c6761586990d824bd546f3f86c7f8dc3
SHA512

bee82380fa84b955a563801002c6f5f59b8f32e13853c9f7210055351084fc80ad4fdc16e5fef07564223696d3682a3987d14299ae89b82586683ce9cde2a5fc
SSDEEP

192:FxV5oDwBVd6nu0/rwjXeiUYtepx9uiUHoA1l0YgLVMnCxd:7roDwYnu0zwjXeiRt4CikoAj0YHn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1f81a16de19d4f4a746cb2e4ff42eedf.doc"
1⤵
- Modifies Internet Explorer settings
PID:1620
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-0-0x000000002F761000-0x000000002F762000-memory.dmp

Filesize
4KB

Download
memory/1620-2-0x0000000070D4D000-0x0000000070D58000-memory.dmp

Filesize
44KB

Download
memory/1620-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1620-9-0x0000000000680000-0x0000000000780000-memory.dmp

Filesize
1024KB

Download
memory/1620-8-0x0000000000680000-0x0000000000780000-memory.dmp

Filesize
1024KB

Download
memory/1620-7-0x0000000000680000-0x0000000000780000-memory.dmp

Filesize
1024KB

Download
memory/1620-6-0x0000000000680000-0x0000000000780000-memory.dmp

Filesize
1024KB

Download
memory/1620-24-0x0000000070D4D000-0x0000000070D58000-memory.dmp

Filesize
44KB

Download
memory/1620-25-0x0000000000680000-0x0000000000780000-memory.dmp

Filesize
1024KB

Download
memory/1620-28-0x0000000000680000-0x0000000000780000-memory.dmp

Filesize
1024KB

Download
memory/1620-26-0x0000000000680000-0x0000000000780000-memory.dmp

Filesize
1024KB

Download
memory/1620-44-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download