58f1e98f2ea3934a6f3a4669f3f802f3f140972f97ef36bad032023faddc47cd

Analysis

max time kernel
103s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21-05-2022 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Complaint_233.doc
Size

238KB
MD5

7aa83b9568c48e952c104b8837b6b961
SHA1

6d2ef23f7416ed01965224986aebfe33dc23a6f0
SHA256

39cd9bd6d501184b00f48c1fd162acf2e513d3b46a391fc56dfaaa2abbc1b9e4
SHA512

796a96f931cb7b5bd453c666d6bcb8014da7a75ba0218c07d20c49026ecaa3675eb595b54a18caed132996e6d5abd4a498e6d2842e86991fb6f3a8d01809dd1b

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4732 WINWORD.EXE
4732 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

4732 WINWORD.EXE
4732 WINWORD.EXE
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

4732 WINWORD.EXE
4732 WINWORD.EXE
4732 WINWORD.EXE
4732 WINWORD.EXE
4732 WINWORD.EXE
4732 WINWORD.EXE
4732 WINWORD.EXE

pid	process
4732	WINWORD.EXE
4732	WINWORD.EXE

pid	process
4732	WINWORD.EXE
4732	WINWORD.EXE

pid	process
4732	WINWORD.EXE
4732	WINWORD.EXE
4732	WINWORD.EXE
4732	WINWORD.EXE
4732	WINWORD.EXE
4732	WINWORD.EXE
4732	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Complaint_233.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4732

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4732-130-0x00007FF8574B0000-0x00007FF8574C0000-memory.dmp

Filesize
64KB

Download
memory/4732-131-0x00007FF8574B0000-0x00007FF8574C0000-memory.dmp

Filesize
64KB

Download
memory/4732-132-0x00007FF8574B0000-0x00007FF8574C0000-memory.dmp

Filesize
64KB

Download
memory/4732-133-0x00007FF8574B0000-0x00007FF8574C0000-memory.dmp

Filesize
64KB

Download
memory/4732-134-0x00007FF8574B0000-0x00007FF8574C0000-memory.dmp

Filesize
64KB

Download
memory/4732-135-0x00007FF854BB0000-0x00007FF854BC0000-memory.dmp

Filesize
64KB

Download
memory/4732-136-0x00007FF854BB0000-0x00007FF854BC0000-memory.dmp

Filesize
64KB

Download
memory/4732-137-0x000001C8A7D70000-0x000001C8A7D74000-memory.dmp

Filesize
16KB

Download
memory/4732-138-0x000001C8A3BCA000-0x000001C8A3BCC000-memory.dmp

Filesize
8KB

Download
memory/4732-140-0x00007FF8574B0000-0x00007FF8574C0000-memory.dmp

Filesize
64KB

Download
memory/4732-141-0x00007FF8574B0000-0x00007FF8574C0000-memory.dmp

Filesize
64KB

Download
memory/4732-142-0x00007FF8574B0000-0x00007FF8574C0000-memory.dmp

Filesize
64KB

Download
memory/4732-143-0x00007FF8574B0000-0x00007FF8574C0000-memory.dmp

Filesize
64KB

Download