Analysis
-
max time kernel
138s -
max time network
133s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09-07-2020 09:50
Static task
static1
Behavioral task
behavioral1
Sample
4f970fe5a0df88373022185d178b21fbb5db754176042f60317e46d5d20a01c0.doc
Resource
win7
Behavioral task
behavioral2
Sample
4f970fe5a0df88373022185d178b21fbb5db754176042f60317e46d5d20a01c0.doc
Resource
win10v200430
General
-
Target
4f970fe5a0df88373022185d178b21fbb5db754176042f60317e46d5d20a01c0.doc
-
Size
147KB
-
MD5
7bc2c2949bc0fe5e91f4ab0fbf557f9c
-
SHA1
d7a8ce829138f409be74498ecd74d3eefe738215
-
SHA256
4f970fe5a0df88373022185d178b21fbb5db754176042f60317e46d5d20a01c0
-
SHA512
c7463c3709989f9ff6fb71061f0a49f5e5e357bd104f18786bad6ea7ab78cfbb1b3b1148178e2fd02f45749db50836ac36531405d1f70526efcd7429ca0a6d66
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious use of SetWindowsHookEx 19 IoCs
Processes:
WINWORD.EXEpid process 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 2804 WINWORD.EXE 2804 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3000 2804 regsvr32.exe WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 2804 wrote to memory of 3000 2804 WINWORD.EXE regsvr32.exe PID 2804 wrote to memory of 3000 2804 WINWORD.EXE regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4f970fe5a0df88373022185d178b21fbb5db754176042f60317e46d5d20a01c0.doc" /o ""1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Checks processor information in registry
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" o.tmp2⤵
- Process spawned unexpected child process