General
Target

HealthcareDirective_159.doc

Filesize

219KB

Completed

21-05-2022 12:47

Task

behavioral2

Score
1/10
MD5

2e0ef931fd3e5d1c6850a10bada1d318

SHA1

819577bf6d9830b14944b2f6d2265e42b5fbff4f

SHA256

d021532bbc51db3ba1e273e427e9788d21c32069d77869593ac6acce7c5f55e9

SHA512

8dc1cf64f67c56db82749a6ff2f21ca3e2a2e319ee306737a373dcb65c6fe418a1c1ca7c120274ddbe02072ce291fba114fb7e1106efc6154c8454751f498fae

Malware Config
Signatures 5

Filter: none

Discovery
  • Checks processor information in registry
    WINWORD.EXE

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0WINWORD.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzWINWORD.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameStringWINWORD.EXE
  • Enumerates system info in registry
    WINWORD.EXE

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamilyWINWORD.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKUWINWORD.EXE
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\BIOSWINWORD.EXE
  • Suspicious behavior: AddClipboardFormatListener
    WINWORD.EXE

    Reported IOCs

    pidprocess
    4476WINWORD.EXE
    4476WINWORD.EXE
  • Suspicious use of FindShellTrayWindow
    WINWORD.EXE

    Reported IOCs

    pidprocess
    4476WINWORD.EXE
    4476WINWORD.EXE
  • Suspicious use of SetWindowsHookEx
    WINWORD.EXE

    Reported IOCs

    pidprocess
    4476WINWORD.EXE
    4476WINWORD.EXE
    4476WINWORD.EXE
    4476WINWORD.EXE
    4476WINWORD.EXE
    4476WINWORD.EXE
    4476WINWORD.EXE
Processes 1
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\HealthcareDirective_159.doc" /o ""
    Checks processor information in registry
    Enumerates system info in registry
    Suspicious behavior: AddClipboardFormatListener
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    PID:4476
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • memory/4476-130-0x00007FF9ED310000-0x00007FF9ED320000-memory.dmp

                        • memory/4476-132-0x00007FF9ED310000-0x00007FF9ED320000-memory.dmp

                        • memory/4476-131-0x00007FF9ED310000-0x00007FF9ED320000-memory.dmp

                        • memory/4476-133-0x00007FF9ED310000-0x00007FF9ED320000-memory.dmp

                        • memory/4476-134-0x00007FF9ED310000-0x00007FF9ED320000-memory.dmp

                        • memory/4476-135-0x00007FF9EA9B0000-0x00007FF9EA9C0000-memory.dmp

                        • memory/4476-136-0x00007FF9EA9B0000-0x00007FF9EA9C0000-memory.dmp

                        • memory/4476-137-0x000001B72CA00000-0x000001B72CA04000-memory.dmp

                        • memory/4476-138-0x000001B72A72C000-0x000001B72A72E000-memory.dmp

                        • memory/4476-140-0x00007FF9ED310000-0x00007FF9ED320000-memory.dmp

                        • memory/4476-141-0x00007FF9ED310000-0x00007FF9ED320000-memory.dmp

                        • memory/4476-142-0x00007FF9ED310000-0x00007FF9ED320000-memory.dmp

                        • memory/4476-143-0x00007FF9ED310000-0x00007FF9ED320000-memory.dmp