7573729345f787a51f7918f2047f2cddc6f68e3b07eb6a09b373b966b3703385

Analysis

max time kernel
148s
max time network
143s
platform
windows10_x64
resource
win10v20210408
submitted
21-07-2021 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.1850.6570.doc
Size

37KB
MD5

55eecedf8b662653b65ba780ebdf7fe0
SHA1

fd5864bfceebe809c986ba1fa87f0059c2943f43
SHA256

7573729345f787a51f7918f2047f2cddc6f68e3b07eb6a09b373b966b3703385
SHA512

9eb221c70040d0c692aa80bda151828e9d954e5cdd400b6e4e6fe8d9015f4c319ca6bd88a371657b122dbf25e568edd5c9f635562796cb2017220374d14cd307

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

656 WINWORD.EXE
656 WINWORD.EXE
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

WINWORD.EXE

pid process

656 WINWORD.EXE
656 WINWORD.EXE
656 WINWORD.EXE
656 WINWORD.EXE
656 WINWORD.EXE
656 WINWORD.EXE
656 WINWORD.EXE
656 WINWORD.EXE
656 WINWORD.EXE

pid	process
656	WINWORD.EXE
656	WINWORD.EXE

pid	process
656	WINWORD.EXE
656	WINWORD.EXE
656	WINWORD.EXE
656	WINWORD.EXE
656	WINWORD.EXE
656	WINWORD.EXE
656	WINWORD.EXE
656	WINWORD.EXE
656	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.1850.6570.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-114-0x00007FFA59300000-0x00007FFA59310000-memory.dmp

Filesize
64KB

Download
memory/656-115-0x00007FFA59300000-0x00007FFA59310000-memory.dmp

Filesize
64KB

Download
memory/656-116-0x00007FFA59300000-0x00007FFA59310000-memory.dmp

Filesize
64KB

Download
memory/656-117-0x00007FFA59300000-0x00007FFA59310000-memory.dmp

Filesize
64KB

Download
memory/656-119-0x00007FFA59300000-0x00007FFA59310000-memory.dmp

Filesize
64KB

Download
memory/656-118-0x00007FFA7A320000-0x00007FFA7CE43000-memory.dmp

Filesize
43.1MB

Download
memory/656-122-0x00007FFA74700000-0x00007FFA757EE000-memory.dmp

Filesize
16.9MB

Download
memory/656-123-0x00007FFA72800000-0x00007FFA746F5000-memory.dmp

Filesize
31.0MB

Download
memory/656-280-0x00000228262C0000-0x00000228262C4000-memory.dmp

Filesize
16KB

Download