b2da1683029eeaebd526bf72a88599d651816a3c756db7a80dc48282579ac137

Analysis

max time kernel
144s
max time network
147s
platform
windows10_x64
resource
win10v200722
submitted
17-09-2020 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

invoice_941235.doc
Size

12KB
MD5

c7c80f25d00778c46a8acc0385df0e58
SHA1

12cbd6f950bd590647bb40ac72a2549d715e26e8
SHA256

b2da1683029eeaebd526bf72a88599d651816a3c756db7a80dc48282579ac137
SHA512

b915001c787b4b0c0e59b9519c5de0dff56ec5c6a7807ddfbc063f7ba37c052bdadda0df44f0fccd57cacd8ff07a40a6e1102f600ab63fdca4b2c9a1012b5ab9

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

424 WINWORD.EXE
424 WINWORD.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

WINWORD.EXE

pid	process
424	WINWORD.EXE
424	WINWORD.EXE
424	WINWORD.EXE
424	WINWORD.EXE
424	WINWORD.EXE
424	WINWORD.EXE
424	WINWORD.EXE
424	WINWORD.EXE
424	WINWORD.EXE
424	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\invoice_941235.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:424

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/424-0-0x00007FFE30550000-0x00007FFE30C16000-memory.dmp

Filesize
6.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads