Analysis
-
max time kernel
135s -
max time network
134s -
platform
windows10_x64 -
resource
win10 -
submitted
11/07/2020, 07:24
Static task
static1
Behavioral task
behavioral1
Sample
caricare,07.20.doc
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
caricare,07.20.doc
Resource
win10
0 signatures
0 seconds
General
-
Target
caricare,07.20.doc
-
Size
134KB
-
MD5
8f970304783c8aa3d23f287b4be714eb
-
SHA1
e0c30b6e95c686c663878e16b067418e4e0ef6c9
-
SHA256
00ea129930da0a14d84e659de72d16b4edcb9574ab665466e6b931676fe95aed
-
SHA512
0f58e98169975eca6009b83028ca80defbeb638232aba07da9bf873e04c57c4d780eb5e3e71cdfe8096700a097a398b4cb3733dce8816676f2b24abef13e46b2
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2072 WINWORD.EXE 2072 WINWORD.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious use of SetWindowsHookEx 19 IoCs
pid Process 2072 WINWORD.EXE 2072 WINWORD.EXE 2072 WINWORD.EXE 2072 WINWORD.EXE 2072 WINWORD.EXE 2072 WINWORD.EXE 2072 WINWORD.EXE 2072 WINWORD.EXE 2072 WINWORD.EXE 2072 WINWORD.EXE 2072 WINWORD.EXE 2072 WINWORD.EXE 2072 WINWORD.EXE 2072 WINWORD.EXE 2072 WINWORD.EXE 2072 WINWORD.EXE 2072 WINWORD.EXE 2072 WINWORD.EXE 2072 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\caricare,07.20.doc" /o ""1⤵
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:2072