e11f59ce9dae9fcff7ff4c8d3d119dd663a1918d084f8cda7b30c474cd141642

Analysis

max time kernel
136s
max time network
128s
platform
windows10_x64
resource
win10v20201028
submitted
25-11-2020 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e77f5e642756206d8f21e0230a134040.rtf
Size

13KB
MD5

e77f5e642756206d8f21e0230a134040
SHA1

d4b3eb5fe7af003da6141a57cb641bd960506a70
SHA256

e11f59ce9dae9fcff7ff4c8d3d119dd663a1918d084f8cda7b30c474cd141642
SHA512

75c1c081adcb5115580c52daeaa9af08fd7d7b8a9d8ec29fb19f9c3efb5543af3acf0e0ba54fe4832cc5d4a5b1efa73f042b3ac5d90f34b6555bf17dc4c1b9bc

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

696 WINWORD.EXE
696 WINWORD.EXE
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

696 WINWORD.EXE
696 WINWORD.EXE
696 WINWORD.EXE
696 WINWORD.EXE
696 WINWORD.EXE
696 WINWORD.EXE
696 WINWORD.EXE
696 WINWORD.EXE

pid	process
696	WINWORD.EXE
696	WINWORD.EXE

pid	process
696	WINWORD.EXE
696	WINWORD.EXE
696	WINWORD.EXE
696	WINWORD.EXE
696	WINWORD.EXE
696	WINWORD.EXE
696	WINWORD.EXE
696	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e77f5e642756206d8f21e0230a134040.rtf" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:696

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/696-0-0x0000020A38270000-0x0000020A388A7000-memory.dmp

Filesize
6.2MB

Download