7fe770f2a75d693076b3f2c81baa8bf27ba82d84b287bb5df381cc214b95eb6b

Analysis

max time kernel
137s
max time network
133s
platform
windows10_x64
resource
win10v20201028
submitted
22-01-2021 07:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQSDCL1005C1N5STDFM01.doc
Size

991KB
MD5

09d4af0b227dc3974954cc05f28bf8bc
SHA1

473e5ddb68275afba681213c7293219f93c8a7d4
SHA256

7fe770f2a75d693076b3f2c81baa8bf27ba82d84b287bb5df381cc214b95eb6b
SHA512

8d1a0be85fb32f53975d9aabf4510690aa4561eb81aa558e2404211595ba7288bdb5798d8389d3c3fd77fe4ba7d65c999f3b92f01626a9e18d6d9d91ca976689

Score

5^/10

ransomware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

504 WINWORD.EXE
504 WINWORD.EXE
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

504 WINWORD.EXE
504 WINWORD.EXE
504 WINWORD.EXE
504 WINWORD.EXE
504 WINWORD.EXE
504 WINWORD.EXE
504 WINWORD.EXE
504 WINWORD.EXE

pid	process
504	WINWORD.EXE
504	WINWORD.EXE

pid	process
504	WINWORD.EXE
504	WINWORD.EXE
504	WINWORD.EXE
504	WINWORD.EXE
504	WINWORD.EXE
504	WINWORD.EXE
504	WINWORD.EXE
504	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\RFQSDCL1005C1N5STDFM01.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:504

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/504-2-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmp

Filesize
64KB

Download
memory/504-3-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmp

Filesize
64KB

Download
memory/504-4-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmp

Filesize
64KB

Download
memory/504-5-0x00007FF8005C0000-0x00007FF800BF7000-memory.dmp

Filesize
6.2MB

Download
memory/504-6-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmp

Filesize
64KB

Download
memory/504-7-0x00007FF7DC8A0000-0x00007FF7DC8B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads