Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

2021-02-18 Fivoor - Overleg - Kwartaaloverleg.docx

Microsoft Word 2007+

initial sample

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD

data

dropped

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{5F669EE6-C8B8-44F5-8B10-98F08F0A9EC5}.FSD

data

dropped

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF

data

dropped

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

data

dropped

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{FDF085F0-5246-4600-A9C1-70EEFDDBBCBC}.FSD

data

dropped

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{0E989C07-30AB-4901-9D2A-3CE504568F55}.tmp

data

dropped

C:\Users\user\AppData\Local\Temp\msoB8E3.tmp

GIF image data, version 89a, 15 x 15

dropped

C:\Users\user\AppData\Local\Temp\{2EA589A8-80DC-4151-A705-FB65CDDF635A}

data

dropped

C:\Users\user\AppData\Local\Temp\{68E33153-79B5-4476-8353-B4DAFDE9644D}

data

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

data

dropped

C:\Users\user\Desktop\~$21-02-18 Fivoor - Overleg - Kwartaaloverleg.docx

data

dropped

There are 3 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	2300
Target ID:	0
Parent PID:	584
Name:	WINWORD.EXE
Class:	word
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Commandline:	'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Size:	1424032
MD5:	95C38D04597050285A18F66039EDB456
Time:	21:26:29
Date:	25/02/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x13fa40000
Modulesize:	1437696
Wow64:	false

Domains

Name

Malicious

lemontree1.sharepoint.com

unknown

Details

Name:	lemontree1.sharepoint.com
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Signature Hits	Behavior Group	Mitre Attack
Contains an external reference to another document	Persistence and Installation Behavior
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities	Exploitation for Client Execution
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

Registry

Path

Value

Malicious

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

?#4

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

MTTT

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

j&4

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

i+4

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Version

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@%SystemRoot%\system32\qagentrt.dll,-10

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@%SystemRoot%\System32\fveui.dll,-843

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@%SystemRoot%\System32\fveui.dll,-844

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

@%SystemRoot%\System32\wuaueng.dll,-400

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

LastPurgeTime

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

1033

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

1033

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

WORDFiles

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

SavedLegacySettings

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Blob

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Blob

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Blob

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Blob

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Blob

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Blob

There are 13 hidden registries, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOCReport

Files

Processes

Domains

Registry