Analysis
- max time kernel
135s - max time network
132s - platform
windows10_x64 - resource
win10 - submitted
28/07/2020, 06:04
General
- Target DOC_PO_07282020EX.doc
- Size 169KB
- Sample200728-t2441568qj
- SHA256 20d81ffc64ba89a114dc4ee30c643d555945ab0ec0f3a17c96b56d6087ef3b13
Score
1/10
Malware Config
Signatures
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\DOC_PO_07282020EX.doc" /o ""1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3024-0-0x000002AF8A3A1000-0x000002AF8A3A6000-memory.dmp
memory/3024-1-0x000002AF8A3A1000-0x000002AF8A3A6000-memory.dmp
memory/3024-2-0x000002AF8A3A1000-0x000002AF8A3A6000-memory.dmp
memory/3024-3-0x000002AF8A3A1000-0x000002AF8A3A6000-memory.dmp
memory/3024-4-0x000002AF8815C000-0x000002AF88163000-memory.dmp
memory/3024-5-0x000002AF8A5A5000-0x000002AF8A5AA000-memory.dmp
memory/3024-6-0x000002AF8A5A5000-0x000002AF8A5AA000-memory.dmp