a8757b9054c074e21c7e76d9c0e1a7ee87f3accde91a0b8c0d33cf6cbed6cc02

Analysis

max time kernel
140s
max time network
141s
platform
windows10_x64
resource
win10v20201028
submitted
24-02-2021 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

заявка 16 марта.doc
Size

108KB
MD5

6df2cab8f0511b0f47adf7433a4250e3
SHA1

19c9206e1cf9a31f21bd9f2d14003908e3369074
SHA256

a8757b9054c074e21c7e76d9c0e1a7ee87f3accde91a0b8c0d33cf6cbed6cc02
SHA512

2c3ca9f3ce315135874374d878b7e26a0531cc0058f40f83dd90c0858c2d83619b27664c05c7cb4a56af5a35ce6f537eb49c80d7033b77cf5b96547440787860

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

68 WINWORD.EXE
68 WINWORD.EXE
Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

WINWORD.EXE

pid process

68 WINWORD.EXE
68 WINWORD.EXE
68 WINWORD.EXE
68 WINWORD.EXE
68 WINWORD.EXE
68 WINWORD.EXE
68 WINWORD.EXE
68 WINWORD.EXE
68 WINWORD.EXE
68 WINWORD.EXE

pid	process
68	WINWORD.EXE
68	WINWORD.EXE

pid	process
68	WINWORD.EXE
68	WINWORD.EXE
68	WINWORD.EXE
68	WINWORD.EXE
68	WINWORD.EXE
68	WINWORD.EXE
68	WINWORD.EXE
68	WINWORD.EXE
68	WINWORD.EXE
68	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\заявка 16 марта.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:68

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/68-2-0x00007FF8A2B20000-0x00007FF8A2B30000-memory.dmp

Filesize
64KB

Download
memory/68-3-0x00007FF8A2B20000-0x00007FF8A2B30000-memory.dmp

Filesize
64KB

Download
memory/68-4-0x00007FF8A2B20000-0x00007FF8A2B30000-memory.dmp

Filesize
64KB

Download
memory/68-5-0x00007FF8A2B20000-0x00007FF8A2B30000-memory.dmp

Filesize
64KB

Download
memory/68-6-0x00007FF8C1FC0000-0x00007FF8C25F7000-memory.dmp

Filesize
6.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads