Analysis

  • max time kernel
    136s
  • max time network
    129s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    18-01-2021 18:46

General

  • Target

    IMG_78011.doc

  • Size

    378KB

  • MD5

    8f0e485e9f232c84f78c011167c38f28

  • SHA1

    8eac77339b0ab53717dee58e81bc6bc532521737

  • SHA256

    a37120959c7a4cd33bebb1d205848e82db6676948da5e2ae7ce313547486da6e

  • SHA512

    7d002e4ebfbd92e9eb9b60e1791b44f5097629811d17798a04130ce9ecae75ffdd3d90eb064a1185f2c443927b4aae6c53385505360d8082576a5cf0a34a6ec2

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\IMG_78011.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1308

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1308-2-0x00007FF8B5E60000-0x00007FF8B5E70000-memory.dmp
    Filesize

    64KB

  • memory/1308-3-0x00007FF8B5E60000-0x00007FF8B5E70000-memory.dmp
    Filesize

    64KB

  • memory/1308-4-0x00007FF8B5E60000-0x00007FF8B5E70000-memory.dmp
    Filesize

    64KB

  • memory/1308-5-0x00007FF8D6510000-0x00007FF8D6B47000-memory.dmp
    Filesize

    6.2MB

  • memory/1308-6-0x00007FF8B5E60000-0x00007FF8B5E70000-memory.dmp
    Filesize

    64KB