Analysis
-
max time kernel
135s -
max time network
135s -
platform
windows10_x64 -
resource
win10 -
submitted
11-07-2020 07:23
Static task
static1
Behavioral task
behavioral1
Sample
statistica,07.08.20.doc
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
statistica,07.08.20.doc
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
statistica,07.08.20.doc
-
Size
134KB
-
MD5
e5a90bc8ee5cf5f57620fd0afcbbe9ab
-
SHA1
5cdaf6674a983440a4dd62a13750286a62279e1b
-
SHA256
51e234ae15e4d96c2077f57a5544aab335d75f7a301442c102eaf63351b48151
-
SHA512
b2c9e9b0d383bef435931d1bb9992f36e94fa87ab8c6878c47124004514787a7d2dce96befae63c2b9120c56cccd3492a6fb585506b38391c04392c551735ed2
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious use of SetWindowsHookEx 19 IoCs
pid Process 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2168 WINWORD.EXE 2168 WINWORD.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\statistica,07.08.20.doc" /o ""1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
PID:2168