6009d4b5fa09ca6115a5e3f3d393dde2d7d11e08b9ea72b04654df23817004d4

Analysis

max time kernel
139s
max time network
139s
platform
windows10_x64
resource
win10v200430
submitted
11-07-2020 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

inchiesta.07.20.doc
Size

134KB
MD5

57227f5d6d7ae3551ccbb22639201fc6
SHA1

ca1ead5a10dd55248dfae699c96dde8909210e64
SHA256

6009d4b5fa09ca6115a5e3f3d393dde2d7d11e08b9ea72b04654df23817004d4
SHA512

6fea07aef9a7b6bc078b01cbb22032d7ec9b9c8822644367fb05a7070f40dd460e9b8e37ba65fcfe29167df6f1008a9048fb5a556fc1c9f7e84db53afb179b27

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

WINWORD.EXE

pid	process
3216	WINWORD.EXE
3216	WINWORD.EXE
3216	WINWORD.EXE
3216	WINWORD.EXE
3216	WINWORD.EXE
3216	WINWORD.EXE
3216	WINWORD.EXE
3216	WINWORD.EXE
3216	WINWORD.EXE
3216	WINWORD.EXE
3216	WINWORD.EXE
3216	WINWORD.EXE
3216	WINWORD.EXE
3216	WINWORD.EXE
3216	WINWORD.EXE
3216	WINWORD.EXE
3216	WINWORD.EXE
3216	WINWORD.EXE
3216	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3216 WINWORD.EXE
3216 WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\inchiesta.07.20.doc" /o ""
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
- Enumerates system info in registry
PID:3216

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads