Overview
overview
8Static
static
4oloo@mid.r...33.pdf
windows10_x64
1oloo@mid.r...__.pdf
windows10_x64
1oloo@mid.r...?.docx
windows10_x64
1oloo@mid.r...?.docx
windows10_x64
1oloo@mid.r...?.docx
windows10_x64
1oloo@mid.r...??.pdf
windows10_x64
1oloo@mid.r...??.exe
windows10_x64
8oloo@mid.r...13.pdf
windows10_x64
1Analysis
-
max time kernel
127s -
max time network
161s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
19-01-2022 01:04
Behavioral task
behavioral1
Sample
oloo@mid.ru/0001202110250033.pdf
Resource
win10-en-20211208
Behavioral task
behavioral2
Sample
oloo@mid.ru/20_10_2021_01_6101_21____________________________.pdf
Resource
win10-en-20211208
Behavioral task
behavioral3
Sample
oloo@mid.ru/??? ?? ??????????.docx
Resource
win10-en-20211208
Behavioral task
behavioral4
Sample
oloo@mid.ru/?????? ? ????????????????? ?? ????? ?? ???????.docx
Resource
win10-en-20211208
Behavioral task
behavioral5
Sample
oloo@mid.ru/?????? ? ??????????????? ?? ????? ?? ???????.docx
Resource
win10-en-20211208
Behavioral task
behavioral6
Sample
oloo@mid.ru/???????? ?? ????????? ???????????? ??????.pdf
Resource
win10-en-20211208
Behavioral task
behavioral7
Sample
oloo@mid.ru/????????? ??? ??????????? ???????? ? ??????????? ???????? ???????????????.exe
Resource
win10-en-20211208
Behavioral task
behavioral8
Sample
oloo@mid.ru/BMP-13.pdf
Resource
win10-en-20211208
General
-
Target
oloo@mid.ru/?????? ? ??????????????? ?? ????? ?? ???????.docx
-
Size
17KB
-
MD5
180fdd99d3e7747e1655ff2a9fa7437a
-
SHA1
b8d03b2b4a092ea1123e92c1b612ae21de74d081
-
SHA256
e2c9484eb12d1b8db4bf3db38915a291a9076e11dcc4b934a1e7907dd8ce2655
-
SHA512
fb39ad2bcc5376a9fee452a4eae667a817591b167910520d0b3b66690f0e99bcdc592acc1568bdacf3a1c4b032581f6a7704c044b852950449ea10e177b56f4a
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 2548 WINWORD.EXE 2548 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
WINWORD.EXEpid process 2548 WINWORD.EXE 2548 WINWORD.EXE 2548 WINWORD.EXE 2548 WINWORD.EXE 2548 WINWORD.EXE 2548 WINWORD.EXE 2548 WINWORD.EXE 2548 WINWORD.EXE 2548 WINWORD.EXE 2548 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\oloo@mid.ru\______ _ _______________ __ _____ __ _______.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2548-117-0x00007FFDEE7B0000-0x00007FFDEE7C0000-memory.dmpFilesize
64KB
-
memory/2548-118-0x00007FFDEE7B0000-0x00007FFDEE7C0000-memory.dmpFilesize
64KB
-
memory/2548-119-0x00007FFDEE7B0000-0x00007FFDEE7C0000-memory.dmpFilesize
64KB
-
memory/2548-120-0x00007FFDEE7B0000-0x00007FFDEE7C0000-memory.dmpFilesize
64KB
-
memory/2548-121-0x00007FFDEE7B0000-0x00007FFDEE7C0000-memory.dmpFilesize
64KB
-
memory/2548-124-0x00007FFDEBBB0000-0x00007FFDEBBC0000-memory.dmpFilesize
64KB
-
memory/2548-127-0x00007FFDEBBB0000-0x00007FFDEBBC0000-memory.dmpFilesize
64KB
-
memory/2548-320-0x00007FFDEE7B0000-0x00007FFDEE7C0000-memory.dmpFilesize
64KB
-
memory/2548-321-0x00007FFDEE7B0000-0x00007FFDEE7C0000-memory.dmpFilesize
64KB
-
memory/2548-322-0x00007FFDEE7B0000-0x00007FFDEE7C0000-memory.dmpFilesize
64KB
-
memory/2548-323-0x00007FFDEE7B0000-0x00007FFDEE7C0000-memory.dmpFilesize
64KB