Analysis

  • max time kernel
    128s
  • max time network
    141s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    27-07-2021 14:38

General

  • Target

    WELDED PIPES INDENT NO. 2122000642.doc

  • Size

    4KB

  • MD5

    5c0bc7c7186ad3356a5f3b8d2134e023

  • SHA1

    a4bab1a1edea203951480df4c7b94ff940561f34

  • SHA256

    95cd0e8151fd80f473f886e8c9aa98ce10d3608a8ac9542d848634a3e0f80064

  • SHA512

    e6ddfdf9e42836675d3e7f8c2f310e74a3765f708b0d70f84c9f3ad0ee683dc249911cab0cc2162e8028ef832afe6dc4ca106cb9feff4d445140fa9fb23ce970

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\WELDED PIPES INDENT NO. 2122000642.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4016

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4016-114-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp
    Filesize

    64KB

  • memory/4016-115-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp
    Filesize

    64KB

  • memory/4016-116-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp
    Filesize

    64KB

  • memory/4016-117-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp
    Filesize

    64KB

  • memory/4016-119-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp
    Filesize

    64KB

  • memory/4016-118-0x00007FF94E6A0000-0x00007FF9511C3000-memory.dmp
    Filesize

    43MB

  • memory/4016-122-0x00007FF948730000-0x00007FF94981E000-memory.dmp
    Filesize

    16MB

  • memory/4016-123-0x00007FF946830000-0x00007FF948725000-memory.dmp
    Filesize

    30MB

  • memory/4016-333-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp
    Filesize

    64KB

  • memory/4016-335-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp
    Filesize

    64KB

  • memory/4016-336-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp
    Filesize

    64KB

  • memory/4016-334-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp
    Filesize

    64KB