5e0c9ae3d220d6e59d934fdc7cfae2ab70c2a1dc268d5beaf9c041ab5f3973df

Analysis

max time kernel
139s
max time network
134s
platform
windows10_x64
resource
win10v200430
submitted
17/07/2020, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wordx.doc
Size 12KB
Sample200717-ansvrr9vlx
SHA256 5e0c9ae3d220d6e59d934fdc7cfae2ab70c2a1dc268d5beaf9c041ab5f3973df
MD5 33aefeba3f56df4b2300763d91dedf8c
SHA1 6c4fe304bca37549aaac14277dd26838a9d7722d
SHA512 839e360b6d017a42cf43c7211a677fcbd071ef51e266ddb1bad9db4ea5bbb2bab76323216c64b4f1c0e28e508fc2e6e5594c56374dd30caa5b38357fb76c62de
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1600	WINWORD.EXE
1600	WINWORD.EXE
1600	WINWORD.EXE
1600	WINWORD.EXE
1600	WINWORD.EXE
1600	WINWORD.EXE
1600	WINWORD.EXE
1600	WINWORD.EXE
1600	WINWORD.EXE
1600	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1600	WINWORD.EXE
1600	WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\wordx.doc" /o ""
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
- Enumerates system info in registry
PID:1600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads