Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
11-07-2020 07:15
Static task
static1
Behavioral task
behavioral1
Sample
commercio,07.20.doc
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
commercio,07.20.doc
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
commercio,07.20.doc
-
Size
147KB
-
MD5
51d3dbc377be322144ebcbd5d4807f0e
-
SHA1
6faf0b17ba708e8c29bbbc1b52798456ac58d170
-
SHA256
7f2fa5e8de6a3d91a78c091f921a258aefe7c0737198c8d13c7663c453d4dbf1
-
SHA512
ca9395be04da38294baf29dc60ccbcd57ec84d164cd2c102e6c3ffd4f291f89f3586f2591a83f1165e971e1efaa313205bc1d2a179cb79b6c98203722ead7566
Score
10/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious use of SetWindowsHookEx 19 IoCs
Processes:
WINWORD.EXEpid process 1624 WINWORD.EXE 1624 WINWORD.EXE 1624 WINWORD.EXE 1624 WINWORD.EXE 1624 WINWORD.EXE 1624 WINWORD.EXE 1624 WINWORD.EXE 1624 WINWORD.EXE 1624 WINWORD.EXE 1624 WINWORD.EXE 1624 WINWORD.EXE 1624 WINWORD.EXE 1624 WINWORD.EXE 1624 WINWORD.EXE 1624 WINWORD.EXE 1624 WINWORD.EXE 1624 WINWORD.EXE 1624 WINWORD.EXE 1624 WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 1624 WINWORD.EXE 1624 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3428 1624 regsvr32.exe WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 1624 wrote to memory of 3428 1624 WINWORD.EXE regsvr32.exe PID 1624 wrote to memory of 3428 1624 WINWORD.EXE regsvr32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\commercio,07.20.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" w8.tmp2⤵
- Process spawned unexpected child process
PID:3428
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3428-3-0x0000000000000000-mapping.dmp