Task
task1
Sample
Docs_caa116070d1f2f48f3a9964e695226cc.2.docx
Resource
win7
0 signatures
Task
task2
Sample
Docs_caa116070d1f2f48f3a9964e695226cc.2.docx
Resource
win10
0 signatures
General
-
Target
Docs_caa116070d1f2f48f3a9964e695226cc.2
-
Sample
190917-wamtsbsq4a
-
SHA256
9fe890f4a1393ef301e24b02ab3c173f230ad7a982808ce6daf130c861422208
Score
N/A
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener
-
Suspicious use of SetWindowsHookEx
-
at description ioc Process 13032 File created C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm WINWORD.EXE 15407 File created C:\Users\Admin\AppData\Local\Temp\~$cs_caa116070d1f2f48f3a9964e695226cc.2.docx WINWORD.EXE -
Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
at description ioc Process 15188 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer WINWORD.EXE 15188 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName WINWORD.EXE -
Enumerates system info in registry 2 TTPs 5 IoCs
at description ioc Process 15188 Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE 15188 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE 15203 Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE 15203 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE 15203 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Checks processor information in registry (likely anti-VM) 2 TTPs 2 IoCs
at description ioc Process 15188 Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE 15188 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Suspicious use of WriteProcessMemory 1 IoCs
at description Process procid_target 19094 PID 2964 wrote to memory of 3744 SppExtComObj.exe 42
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_caa116070d1f2f48f3a9964e695226cc.2.docx" /o ""1⤵
- Drops Office document
- Checks system information in the registry (likely anti-VM)
- Enumerates system info in registry
- Checks processor information in registry (likely anti-VM)
PID:4088
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:2964
-
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent1⤵PID:3744