Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    19-10-2021 08:07

General

  • Target

    SWIFT COPY.doc

  • Size

    96KB

  • MD5

    e1bae052d5a86db65ee38990c31e0423

  • SHA1

    c3f4d4d6e77b8f3d57812d0429b8af8c5fbbca5e

  • SHA256

    ee64931dac0ae1f14004a8ad48b72bb09c7fe456e8e52015ea9fef7b69c0fde5

  • SHA512

    8325f061f961cae5983d5caddec3c305004c786b05bb84aa53dd0c9d4b07eb5d30a3488c55802283462367987dce659f160c60fde16eea045f255d06d8010ac3

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SWIFT COPY.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3736

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3736-115-0x00007FFC1A9F0000-0x00007FFC1AA00000-memory.dmp
    Filesize

    64KB

  • memory/3736-116-0x00007FFC1A9F0000-0x00007FFC1AA00000-memory.dmp
    Filesize

    64KB

  • memory/3736-117-0x00007FFC1A9F0000-0x00007FFC1AA00000-memory.dmp
    Filesize

    64KB

  • memory/3736-118-0x00007FFC1A9F0000-0x00007FFC1AA00000-memory.dmp
    Filesize

    64KB

  • memory/3736-119-0x00000258B2E00000-0x00000258B2E02000-memory.dmp
    Filesize

    8KB

  • memory/3736-120-0x00000258B2E00000-0x00000258B2E02000-memory.dmp
    Filesize

    8KB

  • memory/3736-121-0x00007FFC1A9F0000-0x00007FFC1AA00000-memory.dmp
    Filesize

    64KB

  • memory/3736-122-0x00000258B2E00000-0x00000258B2E02000-memory.dmp
    Filesize

    8KB