81fe8f7d3f171aa2065b541d1fca3ac861dcb905a87016f24ff40317f044127e

General

Target

payment5001.docx
Size

10KB
MD5

4dfd0caa1bba34d41e02ac53f8d609b9
SHA1

25905cbf4be967205821ee7aa1462afb0bbdc132
SHA256

81fe8f7d3f171aa2065b541d1fca3ac861dcb905a87016f24ff40317f044127e
SHA512

36d59fffdb85163799ffb5e5399e259b13cd2ac30fdbcf7efdf848da253f217d2b7ebef54c8da7d44f939cdf2f22085c6bb051299eabe834254908c32d221ee8

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

764 WINWORD.EXE
764 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WINWORD.EXE

description pid process

Token: SeAuditPrivilege 764 WINWORD.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

WINWORD.EXE

pid process

764 WINWORD.EXE
764 WINWORD.EXE
764 WINWORD.EXE
764 WINWORD.EXE
764 WINWORD.EXE
764 WINWORD.EXE

pid	process
764	WINWORD.EXE
764	WINWORD.EXE

description	pid	process
Token: SeAuditPrivilege	764	WINWORD.EXE

pid	process
764	WINWORD.EXE
764	WINWORD.EXE
764	WINWORD.EXE
764	WINWORD.EXE
764	WINWORD.EXE
764	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\payment5001.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:764

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/764-114-0x00007FF999990000-0x00007FF9999A0000-memory.dmp

Filesize
64KB

Download
memory/764-115-0x00007FF999990000-0x00007FF9999A0000-memory.dmp

Filesize
64KB

Download
memory/764-116-0x00007FF999990000-0x00007FF9999A0000-memory.dmp

Filesize
64KB

Download
memory/764-117-0x00007FF999990000-0x00007FF9999A0000-memory.dmp

Filesize
64KB

Download
memory/764-119-0x00007FF999990000-0x00007FF9999A0000-memory.dmp

Filesize
64KB

Download
memory/764-118-0x00007FF9BA630000-0x00007FF9BD153000-memory.dmp

Filesize
43.1MB

Download
memory/764-120-0x00007FF9B5D50000-0x00007FF9B6E3E000-memory.dmp

Filesize
16.9MB

Download
memory/764-121-0x00007FF9B35B0000-0x00007FF9B54A5000-memory.dmp

Filesize
31.0MB

Download
memory/764-122-0x00007FF999990000-0x00007FF9999A0000-memory.dmp

Filesize
64KB

Download
memory/764-123-0x00007FF999990000-0x00007FF9999A0000-memory.dmp

Filesize
64KB

Download
memory/764-124-0x00007FF999990000-0x00007FF9999A0000-memory.dmp

Filesize
64KB

Download
memory/764-125-0x00007FF999990000-0x00007FF9999A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads