Analysis
-
max time kernel
135s -
max time network
132s -
platform
windows10_x64 -
resource
win10 -
submitted
11-07-2020 07:18
Static task
static1
Behavioral task
behavioral1
Sample
dettagli-07.08.2020.doc
Resource
win7
Behavioral task
behavioral2
Sample
dettagli-07.08.2020.doc
Resource
win10
General
-
Target
dettagli-07.08.2020.doc
-
Size
147KB
-
MD5
3b7a15f5094bbab789626ba83d70ec1f
-
SHA1
1c562038115775343ae7f8159410401381bf1cd3
-
SHA256
1009aea4a8bbbd5395bfec97a0cf88c62577c68a98d32c161ffc97cbd869e7cb
-
SHA512
e0e59328605009abb0004a80958741aca108338c594d3187552aa71641b38380a5e3b5b2c72058941e3ac98896779129289b154f72369875d83569fb3e2162eb
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious use of SetWindowsHookEx 19 IoCs
Processes:
WINWORD.EXEpid process 3404 WINWORD.EXE 3404 WINWORD.EXE 3404 WINWORD.EXE 3404 WINWORD.EXE 3404 WINWORD.EXE 3404 WINWORD.EXE 3404 WINWORD.EXE 3404 WINWORD.EXE 3404 WINWORD.EXE 3404 WINWORD.EXE 3404 WINWORD.EXE 3404 WINWORD.EXE 3404 WINWORD.EXE 3404 WINWORD.EXE 3404 WINWORD.EXE 3404 WINWORD.EXE 3404 WINWORD.EXE 3404 WINWORD.EXE 3404 WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3404 WINWORD.EXE 3404 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 508 3404 regsvr32.exe WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 3404 wrote to memory of 508 3404 WINWORD.EXE regsvr32.exe PID 3404 wrote to memory of 508 3404 WINWORD.EXE regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\dettagli-07.08.2020.doc" /o ""1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Checks processor information in registry
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" EA.tmp2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/508-3-0x0000000000000000-mapping.dmp
-
memory/3404-0-0x000002877A0F4000-0x000002877A0FC000-memory.dmpFilesize
32KB
-
memory/3404-1-0x000002877A0F4000-0x000002877A0FC000-memory.dmpFilesize
32KB
-
memory/3404-2-0x000002877A189000-0x000002877A18E000-memory.dmpFilesize
20KB