1c822d787c03d5fdefa8efa54a8af4ae8622223b2b01c2a6cbf040f4a218a2ce

Analysis

max time kernel
135s
max time network
137s
platform
windows10_x64
resource
win10
submitted
11-07-2020 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

accordo legale.07.20.doc
Size

134KB
MD5

8f2f3030cd7cddcd5ec80f4585a1714b
SHA1

d632b2efa2723e480b3a952a1d5a9bcb46c00248
SHA256

1c822d787c03d5fdefa8efa54a8af4ae8622223b2b01c2a6cbf040f4a218a2ce
SHA512

8880c7265e7f7e636d6c861fe288f3040882ca4bcc1e4b5c59e0a89e02f4a348a9930c5da21a16e5d6065c86eca6e4fd0eb6fb3678df3a42b5379c6cc1881c0e

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

WINWORD.EXE

pid	process
3892	WINWORD.EXE
3892	WINWORD.EXE
3892	WINWORD.EXE
3892	WINWORD.EXE
3892	WINWORD.EXE
3892	WINWORD.EXE
3892	WINWORD.EXE
3892	WINWORD.EXE
3892	WINWORD.EXE
3892	WINWORD.EXE
3892	WINWORD.EXE
3892	WINWORD.EXE
3892	WINWORD.EXE
3892	WINWORD.EXE
3892	WINWORD.EXE
3892	WINWORD.EXE
3892	WINWORD.EXE
3892	WINWORD.EXE
3892	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3892 WINWORD.EXE
3892 WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\accordo legale.07.20.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
PID:3892

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3892-0-0x000001D856FB6000-0x000001D856FBF000-memory.dmp

Filesize
36KB

Download
memory/3892-1-0x000001D854AE1000-0x000001D854B02000-memory.dmp

Filesize
132KB

Download
memory/3892-2-0x000001D857037000-0x000001D857039000-memory.dmp

Filesize
8KB

Download
memory/3892-3-0x000001D856FBF000-0x000001D856FC4000-memory.dmp

Filesize
20KB

Download
memory/3892-4-0x000001D856FBF000-0x000001D856FC4000-memory.dmp

Filesize
20KB

Download
memory/3892-5-0x000001D857039000-0x000001D85703E000-memory.dmp

Filesize
20KB

Download