Analysis

  • max time kernel
    57s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25-05-2024 03:01

General

  • Target

    028ac77779f633c65a2890ad69de64b605453ed809b456dfaff5c5c17d136d28.doc

  • Size

    32KB

  • MD5

    feebb06fb9cde906e1ed6e204e19303a

  • SHA1

    3f43ebbee9623e2f4167deb9c35794fff53a864a

  • SHA256

    028ac77779f633c65a2890ad69de64b605453ed809b456dfaff5c5c17d136d28

  • SHA512

    63c5c02705a9abeb6b8d2f0d1eaf83565e82f7881d527bd8f3856a047f8c00adc2e08d17f121441d541366283926dc76d04525e3bd43691f8f632e72c72b3f97

  • SSDEEP

    192:7UoH8AZEvAqgT8tQ6/6rJ984woO+QHj1mqOdXa/UDTgI9DtnC50ja+//tpH4/a:7UGliSJPw+QD1mqZU4gnC50jV/t94

Score
1/10

Malware Config

Signatures

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\028ac77779f633c65a2890ad69de64b605453ed809b456dfaff5c5c17d136d28.doc"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2872

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1952-0-0x000000002FDD1000-0x000000002FDD2000-memory.dmp

      Filesize

      4KB

    • memory/1952-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1952-2-0x000000007104D000-0x0000000071058000-memory.dmp

      Filesize

      44KB

    • memory/1952-10-0x00000000006D0000-0x00000000007D0000-memory.dmp

      Filesize

      1024KB

    • memory/1952-15-0x000000007104D000-0x0000000071058000-memory.dmp

      Filesize

      44KB

    • memory/1952-16-0x00000000006D0000-0x00000000007D0000-memory.dmp

      Filesize

      1024KB