Analysis
-
max time kernel
114s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
26-04-2022 10:04
Behavioral task
behavioral1
Sample
MEDITECH's Response to All Nations Family Health Team's Request For Information - 4. 2022 (1).docx
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
MEDITECH's Response to All Nations Family Health Team's Request For Information - 4. 2022 (1).docx
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
Nuance Dragon Medical embedded in MEDITECH Expanse.pdf
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
Nuance Dragon Medical embedded in MEDITECH Expanse.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
traverseinfographic (15).pdf
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
traverseinfographic (15).pdf
Resource
win10v2004-20220414-en
General
-
Target
MEDITECH's Response to All Nations Family Health Team's Request For Information - 4. 2022 (1).docx
-
Size
2.1MB
-
MD5
9519fe4aa02bb2bc7cf1a6b35a8f53d1
-
SHA1
bbb2a94e9afe83f4cec4fa3c0c45cc48fe4f08c4
-
SHA256
1f1a9e422eb139a9a1023ed7c1c84dac132e34a6c98cfafa4b1abb50789f89b1
-
SHA512
2f8fb8b7874ead447be9fc2a910695903640853a3057e08c963f0ba6b80a6d97275d531699e6473a40d3a4815676dc98abfe6b8c005bb4aa4f280d65d7aa36de
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4624 WINWORD.EXE 4624 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
WINWORD.EXEpid process 4624 WINWORD.EXE 4624 WINWORD.EXE 4624 WINWORD.EXE 4624 WINWORD.EXE 4624 WINWORD.EXE 4624 WINWORD.EXE 4624 WINWORD.EXE 4624 WINWORD.EXE 4624 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\MEDITECH's Response to All Nations Family Health Team's Request For Information - 4. 2022 (1).docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4624-130-0x00007FF8DFB50000-0x00007FF8DFB60000-memory.dmpFilesize
64KB
-
memory/4624-131-0x00007FF8DFB50000-0x00007FF8DFB60000-memory.dmpFilesize
64KB
-
memory/4624-132-0x00007FF8DFB50000-0x00007FF8DFB60000-memory.dmpFilesize
64KB
-
memory/4624-133-0x00007FF8DFB50000-0x00007FF8DFB60000-memory.dmpFilesize
64KB
-
memory/4624-134-0x00007FF8DFB50000-0x00007FF8DFB60000-memory.dmpFilesize
64KB
-
memory/4624-135-0x00007FF8DD240000-0x00007FF8DD250000-memory.dmpFilesize
64KB
-
memory/4624-136-0x00007FF8DD240000-0x00007FF8DD250000-memory.dmpFilesize
64KB
-
memory/4624-138-0x00007FF8DFB50000-0x00007FF8DFB60000-memory.dmpFilesize
64KB
-
memory/4624-140-0x00007FF8DFB50000-0x00007FF8DFB60000-memory.dmpFilesize
64KB
-
memory/4624-139-0x00007FF8DFB50000-0x00007FF8DFB60000-memory.dmpFilesize
64KB
-
memory/4624-141-0x00007FF8DFB50000-0x00007FF8DFB60000-memory.dmpFilesize
64KB