Analysis

  • max time kernel
    159s
  • max time network
    164s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    28-09-2021 03:12

General

  • Target

    OBL PN210700369.doc

  • Size

    15KB

  • MD5

    ee6900ee7f29ffb8b1c5f5b9a8a117d0

  • SHA1

    74501f04465f268c3f2bfea3b371118fe25b6aed

  • SHA256

    135dedf906bbb8eef7aef3b5966f1b933e65725cef80e653031481feb7351d62

  • SHA512

    a03958a61cc9cfa8e8a35909b3c29f8d51d1c012bba5ccb2c7d0c2b80f0f77ae42ff25f51f2e4fa5c9ccacad17be5658ad64a8e2cd64d34d2b2aa444ac2ddbfb

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\OBL PN210700369.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4796

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4796-114-0x00007FFD6E7C0000-0x00007FFD6E7D0000-memory.dmp
    Filesize

    64KB

  • memory/4796-115-0x00007FFD6E7C0000-0x00007FFD6E7D0000-memory.dmp
    Filesize

    64KB

  • memory/4796-116-0x00007FFD6E7C0000-0x00007FFD6E7D0000-memory.dmp
    Filesize

    64KB

  • memory/4796-117-0x00007FFD6E7C0000-0x00007FFD6E7D0000-memory.dmp
    Filesize

    64KB

  • memory/4796-119-0x00007FFD6E7C0000-0x00007FFD6E7D0000-memory.dmp
    Filesize

    64KB

  • memory/4796-118-0x00007FFD90550000-0x00007FFD93073000-memory.dmp
    Filesize

    43.1MB

  • memory/4796-122-0x00007FFD8C440000-0x00007FFD8D52E000-memory.dmp
    Filesize

    16.9MB

  • memory/4796-123-0x00007FFD89280000-0x00007FFD8B175000-memory.dmp
    Filesize

    31.0MB

  • memory/4796-339-0x00007FFD6E7C0000-0x00007FFD6E7D0000-memory.dmp
    Filesize

    64KB

  • memory/4796-338-0x00007FFD6E7C0000-0x00007FFD6E7D0000-memory.dmp
    Filesize

    64KB

  • memory/4796-337-0x00007FFD6E7C0000-0x00007FFD6E7D0000-memory.dmp
    Filesize

    64KB

  • memory/4796-336-0x00007FFD6E7C0000-0x00007FFD6E7D0000-memory.dmp
    Filesize

    64KB