Analysis
-
max time kernel
97s -
max time network
135s -
platform
windows10_x64 -
resource
win10v200217 -
submitted
17-03-2020 22:16
Static task
static1
Behavioral task
behavioral1
Sample
prochollow.doc
Resource
win7v200217
Behavioral task
behavioral2
Sample
prochollow.doc
Resource
win10v200217
General
-
Target
prochollow.doc
-
Size
143KB
-
MD5
b107f3235057bb2b06283030be8f26e4
-
SHA1
b12d2984830eee5ef668032cc13691706efce4a5
-
SHA256
5d077b1341a6472f02aac89488976d4395a91ae4f23657b0344da74f4a560c8d
-
SHA512
b7cb31da8be04e044b3c8aadaf00555277fe990cbc42a81d718812b849be153ba6a87227d37374a6ea3cc3de2a204a749e9b643d8a7c1f39a29aa7beb913b3b8
Malware Config
Signatures
-
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3468 3996 DW20.EXE 66 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3996 wrote to memory of 3468 3996 WINWORD.EXE 71 PID 3996 wrote to memory of 3468 3996 WINWORD.EXE 71 PID 3468 wrote to memory of 3372 3468 DW20.EXE 72 PID 3468 wrote to memory of 3372 3468 DW20.EXE 72 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3996 WINWORD.EXE 3996 WINWORD.EXE 3996 WINWORD.EXE 3996 WINWORD.EXE 3996 WINWORD.EXE 3996 WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3996 WINWORD.EXE 3996 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3996 WINWORD.EXE 3996 WINWORD.EXE 3372 dwwin.exe 3372 dwwin.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\prochollow.doc" /o ""1⤵
- Suspicious use of WriteProcessMemory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
PID:3996 -
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 47962⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 47963⤵
- Suspicious behavior: EnumeratesProcesses
PID:3372
-
-