Analysis
-
max time kernel
139s -
max time network
136s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09-07-2020 15:07
Static task
static1
Behavioral task
behavioral1
Sample
d8fc308f94016f51cafa022193fbfe26778451b981c413f8f73206730599b466.doc
Resource
win7
Behavioral task
behavioral2
Sample
d8fc308f94016f51cafa022193fbfe26778451b981c413f8f73206730599b466.doc
Resource
win10v200430
General
-
Target
d8fc308f94016f51cafa022193fbfe26778451b981c413f8f73206730599b466.doc
-
Size
147KB
-
MD5
70812f69666fb0a7a305038253920457
-
SHA1
f4c3e9dec1d2cd4e5d4de9ca39265c784894e836
-
SHA256
d8fc308f94016f51cafa022193fbfe26778451b981c413f8f73206730599b466
-
SHA512
8b64c034762008d800fe874968bf3bd3ee9e928e8c850834cdfb342f53d81a8d3acd80a29c3d009fa4fc308a89512ed3dc61ac3ef127f5897f59c2c83a8e41b4
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious use of SetWindowsHookEx 19 IoCs
Processes:
WINWORD.EXEpid process 1872 WINWORD.EXE 1872 WINWORD.EXE 1872 WINWORD.EXE 1872 WINWORD.EXE 1872 WINWORD.EXE 1872 WINWORD.EXE 1872 WINWORD.EXE 1872 WINWORD.EXE 1872 WINWORD.EXE 1872 WINWORD.EXE 1872 WINWORD.EXE 1872 WINWORD.EXE 1872 WINWORD.EXE 1872 WINWORD.EXE 1872 WINWORD.EXE 1872 WINWORD.EXE 1872 WINWORD.EXE 1872 WINWORD.EXE 1872 WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 1872 WINWORD.EXE 1872 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3448 1872 regsvr32.exe WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 1872 wrote to memory of 3448 1872 WINWORD.EXE regsvr32.exe PID 1872 wrote to memory of 3448 1872 WINWORD.EXE regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d8fc308f94016f51cafa022193fbfe26778451b981c413f8f73206730599b466.doc" /o ""1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Checks processor information in registry
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" Nv.tmp2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1872-0-0x000001D292B2B000-0x000001D292B30000-memory.dmpFilesize
20KB
-
memory/1872-1-0x000001D292B2B000-0x000001D292B30000-memory.dmpFilesize
20KB
-
memory/1872-2-0x000001D292B26000-0x000001D292B2B000-memory.dmpFilesize
20KB
-
memory/3448-3-0x0000000000000000-mapping.dmp