Analysis
- max time kernel
140s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
21/03/2022, 15:22
General
- Target 21344 P.O.rtf
- Size 11KB
- Sample220321-sr3x2adeaj
- SHA256 d55d6e9aa46e97e3900c41584e96d56d23ecc29f8536a5cf3627c7b2e0a563e7
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\21344 P.O.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2084-146-0x00007FFA57A30000-0x00007FFA57C25000-memory.dmp
memory/2084-158-0x00007FFA57A30000-0x00007FFA57C25000-memory.dmp
memory/2084-134-0x00007FFA17AB0000-0x00007FFA17AC0000-memory.dmp
memory/2084-137-0x00007FFA17AB0000-0x00007FFA17AC0000-memory.dmp
memory/2084-138-0x00007FFA17AB0000-0x00007FFA17AC0000-memory.dmp
memory/2084-139-0x00007FFA57A30000-0x00007FFA57C25000-memory.dmp
memory/2084-140-0x00007FFA57A30000-0x00007FFA57C25000-memory.dmp
memory/2084-141-0x00007FFA57A30000-0x00007FFA57C25000-memory.dmp
memory/2084-142-0x00007FFA57A30000-0x00007FFA57C25000-memory.dmp
memory/2084-143-0x00007FFA57A30000-0x00007FFA57C25000-memory.dmp
memory/2084-144-0x00007FFA57A30000-0x00007FFA57C25000-memory.dmp
memory/2084-148-0x00007FFA57A30000-0x00007FFA57C25000-memory.dmp
memory/2084-136-0x00007FFA17AB0000-0x00007FFA17AC0000-memory.dmp
memory/2084-135-0x00007FFA17AB0000-0x00007FFA17AC0000-memory.dmp
memory/2084-145-0x00007FFA57A30000-0x00007FFA57C25000-memory.dmp
memory/2084-149-0x00007FFA57A30000-0x00007FFA57C25000-memory.dmp
memory/2084-160-0x00007FFA57A30000-0x00007FFA57C25000-memory.dmp
memory/2084-159-0x00007FFA57A30000-0x00007FFA57C25000-memory.dmp
memory/2084-147-0x00007FFA57A30000-0x00007FFA57C25000-memory.dmp
memory/2084-153-0x00007FFA17AB0000-0x00007FFA17AC0000-memory.dmp
memory/2084-154-0x00007FFA17AB0000-0x00007FFA17AC0000-memory.dmp
memory/2084-155-0x00007FFA17AB0000-0x00007FFA17AC0000-memory.dmp
memory/2084-156-0x00007FFA17AB0000-0x00007FFA17AC0000-memory.dmp
memory/2084-157-0x00007FFA57A30000-0x00007FFA57C25000-memory.dmp
memory/3080-152-0x000001C05B3B0000-0x000001C05B3B4000-memory.dmp
memory/3080-151-0x000001C05B060000-0x000001C05B070000-memory.dmp
memory/3080-150-0x000001C05A760000-0x000001C05A770000-memory.dmp