5824c16d81c4f3579f89a4af8c26ab13a74d2c261f58203d30e473977bc5a24d

Analysis

max time kernel
119s
max time network
129s
platform
windows10_x64
resource
win10-en-20211014
submitted
22-11-2021 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Our Company Profile.pdf(~42KB).doc
Size

17KB
MD5

fe7d49735b0d980896a7d988d5d70d11
SHA1

c1308c711a67aea2efa2a5b88f4d1d676b869a03
SHA256

8b68d05e339a37d38b051ef6a01f590c944a8eda9498b57526b7b6edafdde69c
SHA512

6ff01778bfe7596dd31b9f404cd043ade4baa25d69df542c3d5e0e0c0099eb6dea02c7c54a5efecb5f6e090707586166382e62b8f6c7c278ac4925dbe3513e70

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3020 WINWORD.EXE
3020 WINWORD.EXE
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

3020 WINWORD.EXE
3020 WINWORD.EXE
3020 WINWORD.EXE
3020 WINWORD.EXE
3020 WINWORD.EXE
3020 WINWORD.EXE
3020 WINWORD.EXE
3020 WINWORD.EXE

pid	process
3020	WINWORD.EXE
3020	WINWORD.EXE

pid	process
3020	WINWORD.EXE
3020	WINWORD.EXE
3020	WINWORD.EXE
3020	WINWORD.EXE
3020	WINWORD.EXE
3020	WINWORD.EXE
3020	WINWORD.EXE
3020	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Our Company Profile.pdf(~42KB).doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3020-115-0x00007FFCF9770000-0x00007FFCF9780000-memory.dmp

Filesize
64KB

Download
memory/3020-116-0x00007FFCF9770000-0x00007FFCF9780000-memory.dmp

Filesize
64KB

Download
memory/3020-117-0x00007FFCF9770000-0x00007FFCF9780000-memory.dmp

Filesize
64KB

Download
memory/3020-118-0x00007FFCF9770000-0x00007FFCF9780000-memory.dmp

Filesize
64KB

Download
memory/3020-119-0x00007FFCF9770000-0x00007FFCF9780000-memory.dmp

Filesize
64KB

Download
memory/3020-120-0x000001F3AF320000-0x000001F3AF322000-memory.dmp

Filesize
8KB

Download
memory/3020-121-0x000001F3AF320000-0x000001F3AF322000-memory.dmp

Filesize
8KB

Download
memory/3020-122-0x000001F3AF320000-0x000001F3AF322000-memory.dmp

Filesize
8KB

Download