Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    13/03/2024, 19:42

General

  • Target

    Matematica 1/UNIDAD 1/Operaciones de los conjuntos numéricos.docx

  • Size

    14KB

  • MD5

    fee4386fc5c66926a89b085553bb1fa2

  • SHA1

    a2ac7e08cb8289c8a78b400f710350022b63ceb5

  • SHA256

    841695cbd7d1de6535dc904d79d4a83c59ba1571b4f120688fbb341faf7e1817

  • SHA512

    5fbcb7b6ab370b142829e8ff5a1a4b512fb48e0b31ad0738ae383348bec47b45bb32015986f2436639bf40a071c694954189d1b2d900c3f1caf3ed76ca3bc307

  • SSDEEP

    192:xmSOkwhr48hUymLHebl2+V4qcZ0+YkF8zJB4tnrKRdB7hh5vhaf0e:hOcHSbzV4qi1Y79B4traXFh5vhase

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Matematica 1\UNIDAD 1\Operaciones de los conjuntos numéricos.docx"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:3064

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      53824e198debd52217103ccba563af51

      SHA1

      ce371bcc4fe383878b35998e64600d3202fff5ec

      SHA256

      e64af05caed4fdcfc1cc1d717205c07d697db0d1f1aeba32ed70a94f68646967

      SHA512

      a6e25bd41eff508db47374f1af2a07d69bd34ece30539649d1c874dfd6982bf0cee21193383f41fe2b262974beec410eb8bec0f9a7eb72bc305c9405591e833b

    • memory/2916-0-0x000000002F9C1000-0x000000002F9C2000-memory.dmp

      Filesize

      4KB

    • memory/2916-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2916-2-0x00000000717FD000-0x0000000071808000-memory.dmp

      Filesize

      44KB

    • memory/2916-14-0x00000000717FD000-0x0000000071808000-memory.dmp

      Filesize

      44KB

    • memory/2916-35-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB