Analysis
-
max time kernel
135s -
max time network
127s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
02-03-2021 08:13
Static task
static1
Behavioral task
behavioral1
Sample
intere_1278234.doc
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
intere_1278234.doc
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
intere_1278234.doc
-
Size
211KB
-
MD5
31eda0ce1173f892041e455dc72b5701
-
SHA1
6764dfb5e27d54c0e8b35ec47efde0a4096c87be
-
SHA256
6b1b7772df0f304b471b438f65141e24abf9dd1e781af202bc3754cc6485d538
-
SHA512
ff36af17dabdd370cc1a496a323295b422fffe3cd9e07afe2d8c1066e569543512cbe0abc985bcc939f59ff4f2c669126e70735304c1cd68a19dcd876685d017
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4712 WINWORD.EXE 4712 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
WINWORD.EXEpid process 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\intere_1278234.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4712-2-0x00007FF83FDE0000-0x00007FF83FDF0000-memory.dmpFilesize
64KB
-
memory/4712-3-0x00007FF83FDE0000-0x00007FF83FDF0000-memory.dmpFilesize
64KB
-
memory/4712-4-0x00007FF83FDE0000-0x00007FF83FDF0000-memory.dmpFilesize
64KB
-
memory/4712-5-0x00007FF860490000-0x00007FF860AC7000-memory.dmpFilesize
6.2MB
-
memory/4712-6-0x00007FF83FDE0000-0x00007FF83FDF0000-memory.dmpFilesize
64KB
-
memory/4712-7-0x00007FF83CDC0000-0x00007FF83CDD0000-memory.dmpFilesize
64KB
-
memory/4712-8-0x000001A3B8510000-0x000001A3B8514000-memory.dmpFilesize
16KB