00bde6c99f1bdf5ce2b92e043e4672d35c6280dd22e5bb0d19f18f751b38b620

Analysis

max time kernel
146s
max time network
142s
platform
windows10_x64
resource
win10v20210408
submitted
26-09-2021 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00bde6c99f1bdf5ce2b92e043e4672d35c6280dd22e5bb0d19f18f751b38b620.doc
Size

31KB
MD5

5a40a53eea87034fd56aacdf1315970c
SHA1

6800cf53bbd6a6f814f2e35e57cf01a002df1f3a
SHA256

00bde6c99f1bdf5ce2b92e043e4672d35c6280dd22e5bb0d19f18f751b38b620
SHA512

b6de1c49991c86ce162e317c4339c7e05573565ca76400e94fdf9f74261a863edcc570c244ccf73bc091e97bde2a8052e1a31e12dacdbe9ada0fd0c9f28e43bc

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

1096 WINWORD.EXE
1096 WINWORD.EXE
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

WINWORD.EXE

pid process

1096 WINWORD.EXE
1096 WINWORD.EXE
1096 WINWORD.EXE
1096 WINWORD.EXE
1096 WINWORD.EXE
1096 WINWORD.EXE
1096 WINWORD.EXE
1096 WINWORD.EXE
1096 WINWORD.EXE

pid	process
1096	WINWORD.EXE
1096	WINWORD.EXE

pid	process
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\00bde6c99f1bdf5ce2b92e043e4672d35c6280dd22e5bb0d19f18f751b38b620.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1096

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-114-0x00007FF861870000-0x00007FF861880000-memory.dmp

Filesize
64KB

Download
memory/1096-115-0x00007FF861870000-0x00007FF861880000-memory.dmp

Filesize
64KB

Download
memory/1096-116-0x00007FF861870000-0x00007FF861880000-memory.dmp

Filesize
64KB

Download
memory/1096-117-0x00007FF861870000-0x00007FF861880000-memory.dmp

Filesize
64KB

Download
memory/1096-118-0x00007FF861870000-0x00007FF861880000-memory.dmp

Filesize
64KB

Download
memory/1096-119-0x00007FF883DC0000-0x00007FF8868E3000-memory.dmp

Filesize
43.1MB

Download
memory/1096-122-0x00007FF87FCB0000-0x00007FF880D9E000-memory.dmp

Filesize
16.9MB

Download
memory/1096-123-0x00007FF87B220000-0x00007FF87D115000-memory.dmp

Filesize
31.0MB

Download