Analysis
-
max time kernel
140s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
05-05-2021 18:31
Behavioral task
behavioral1
Sample
Dear Beneficiary!.doc
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Dear Beneficiary!.doc
Resource
win10v20210410
0 signatures
0 seconds
General
-
Target
Dear Beneficiary!.doc
-
Size
23KB
-
MD5
ed110c19d4541c79aa2da201c10267ab
-
SHA1
b1daa6a34826092d52fe0721711e3d55698449ca
-
SHA256
8d1aa7f9951617f0a2a9fd46f1eb9695a18914454e070b308789e70dc4e24a45
-
SHA512
fb2209dac4eddfb9f7b02c2a20c226ca2eda2500bc4d0b35b541f0816217a3e7f7bca7ef2193b67ab5fdaf9b335b9ae5c8d015c4b82d532974396b5df7b288ad
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3856 WINWORD.EXE 3856 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 3856 WINWORD.EXE 3856 WINWORD.EXE 3856 WINWORD.EXE 3856 WINWORD.EXE 3856 WINWORD.EXE 3856 WINWORD.EXE 3856 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Dear Beneficiary!.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3856-114-0x00007FFA247C0000-0x00007FFA247D0000-memory.dmpFilesize
64KB
-
memory/3856-115-0x00007FFA247C0000-0x00007FFA247D0000-memory.dmpFilesize
64KB
-
memory/3856-116-0x00007FFA247C0000-0x00007FFA247D0000-memory.dmpFilesize
64KB
-
memory/3856-117-0x00007FFA247C0000-0x00007FFA247D0000-memory.dmpFilesize
64KB
-
memory/3856-119-0x00007FFA247C0000-0x00007FFA247D0000-memory.dmpFilesize
64KB
-
memory/3856-118-0x00007FFA469A0000-0x00007FFA494C3000-memory.dmpFilesize
43.1MB
-
memory/3856-122-0x00007FFA40BD0000-0x00007FFA41CBE000-memory.dmpFilesize
16.9MB
-
memory/3856-123-0x00007FFA3D900000-0x00007FFA3F7F5000-memory.dmpFilesize
31.0MB