ede0c266836e85d1ac3bc623377fda09bb0135a9746a0ecde6d7c52c7eddfc24

Analysis

max time kernel
139s
max time network
134s
platform
windows10_x64
resource
win10v20201028
submitted
24/11/2020, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MIC Taiwan RFQ.doc
Size 1.7MB
Sample201124-8dmm3cm8en
SHA256 ede0c266836e85d1ac3bc623377fda09bb0135a9746a0ecde6d7c52c7eddfc24
MD5 50fae186ae94fbff80dd36aa7b1f4ccb
SHA1 124e3f817e12c6ac42e5a4185f75fb5d62bc9513
SHA512 2132e6ee98d06084a03d9ffe66667e52122475f0e95edbadbb9acef1e8f706e4e8db344b8d6267c01f83724686a4a8387c8555d9cd4f8ed1d4b2bc200609af97
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
500	WINWORD.EXE
500	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
500	WINWORD.EXE
500	WINWORD.EXE
500	WINWORD.EXE
500	WINWORD.EXE
500	WINWORD.EXE
500	WINWORD.EXE
500	WINWORD.EXE
500	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\MIC Taiwan RFQ.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/500-0-0x00007FFC309D0000-0x00007FFC31007000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads