Analysis

  • max time kernel
    114s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    27-07-2021 14:38

General

  • Target

    DOC_scan10002.doc

  • Size

    62KB

  • MD5

    a79887f6a16088002da8171f306e1c35

  • SHA1

    61f8ebea354416303d5904f625255c8381852a2e

  • SHA256

    e6208325c155b89a626654ffbf06de21ef809ba583c9742952f006326fce8493

  • SHA512

    8fd416b2d297715dc07bee2e1c517c7f19445da4fd3a2ed5ef3500d79d5e39b74d7d5b82009c61c1e144fef797d9e94dce30c9460958a08ef3afd8e9e4493c15

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\DOC_scan10002.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3984

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3984-114-0x00007FFB8DE80000-0x00007FFB8DE90000-memory.dmp
    Filesize

    64KB

  • memory/3984-115-0x00007FFB8DE80000-0x00007FFB8DE90000-memory.dmp
    Filesize

    64KB

  • memory/3984-116-0x00007FFB8DE80000-0x00007FFB8DE90000-memory.dmp
    Filesize

    64KB

  • memory/3984-117-0x00007FFB8DE80000-0x00007FFB8DE90000-memory.dmp
    Filesize

    64KB

  • memory/3984-118-0x00007FFBAF210000-0x00007FFBB1D33000-memory.dmp
    Filesize

    43.1MB

  • memory/3984-119-0x00007FFB8DE80000-0x00007FFB8DE90000-memory.dmp
    Filesize

    64KB

  • memory/3984-122-0x00007FFBA9630000-0x00007FFBAA71E000-memory.dmp
    Filesize

    16.9MB

  • memory/3984-123-0x00007FFBA7730000-0x00007FFBA9625000-memory.dmp
    Filesize

    31.0MB

  • memory/3984-343-0x00007FFB8DE80000-0x00007FFB8DE90000-memory.dmp
    Filesize

    64KB

  • memory/3984-344-0x00007FFB8DE80000-0x00007FFB8DE90000-memory.dmp
    Filesize

    64KB

  • memory/3984-345-0x00007FFB8DE80000-0x00007FFB8DE90000-memory.dmp
    Filesize

    64KB

  • memory/3984-346-0x00007FFB8DE80000-0x00007FFB8DE90000-memory.dmp
    Filesize

    64KB