c342f81da05b8da1b9f40413ce605e06e02590ef4d2edfd1cafa8a464bd46a59

Analysis

max time kernel
110s
max time network
123s
platform
windows10_x64
resource
win10-en-20210920
submitted
21-10-2021 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Purchase order_122.doc
Size

212KB
MD5

37ef290042de67ceede2ee41796fd288
SHA1

971ceccb966ae96811653501262562b2feb8d37f
SHA256

c342f81da05b8da1b9f40413ce605e06e02590ef4d2edfd1cafa8a464bd46a59
SHA512

7961f3527a0219b8d56a80e8710c06c3dcbcde78d96cb9a5e030e3aac92961b02e1ff63735f441aa820a47dab747aee1f338c3ebe5b2ec8f4f3450a3933bda3e

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

2100 WINWORD.EXE
2100 WINWORD.EXE
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

2100 WINWORD.EXE
2100 WINWORD.EXE
2100 WINWORD.EXE
2100 WINWORD.EXE
2100 WINWORD.EXE
2100 WINWORD.EXE
2100 WINWORD.EXE
2100 WINWORD.EXE

pid	process
2100	WINWORD.EXE
2100	WINWORD.EXE

pid	process
2100	WINWORD.EXE
2100	WINWORD.EXE
2100	WINWORD.EXE
2100	WINWORD.EXE
2100	WINWORD.EXE
2100	WINWORD.EXE
2100	WINWORD.EXE
2100	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Purchase order_122.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2100

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-115-0x00007FFB51920000-0x00007FFB51930000-memory.dmp

Filesize
64KB

Download
memory/2100-116-0x00007FFB51920000-0x00007FFB51930000-memory.dmp

Filesize
64KB

Download
memory/2100-117-0x00007FFB51920000-0x00007FFB51930000-memory.dmp

Filesize
64KB

Download
memory/2100-118-0x00007FFB51920000-0x00007FFB51930000-memory.dmp

Filesize
64KB

Download
memory/2100-119-0x000001E69CA10000-0x000001E69CA12000-memory.dmp

Filesize
8KB

Download
memory/2100-120-0x000001E69CA10000-0x000001E69CA12000-memory.dmp

Filesize
8KB

Download
memory/2100-121-0x00007FFB51920000-0x00007FFB51930000-memory.dmp

Filesize
64KB

Download
memory/2100-122-0x000001E69CA10000-0x000001E69CA12000-memory.dmp

Filesize
8KB

Download