7859fd95c60a0d76fa99eb42277501b20f76a377c1395b504acff5dd22533027

Analysis

max time kernel
100s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2022 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12-09-2022 SİPARİŞ.docx
Size

252KB
MD5

7e8133cf5f56adcfafb9bc91390c9fe7
SHA1

2cc6471245901e51565ad69df6b8586629965cf1
SHA256

7859fd95c60a0d76fa99eb42277501b20f76a377c1395b504acff5dd22533027
SHA512

943c44eb826863181891fa7f3eaba59546656c10aad65815f9a21d0ac277d21ec3715f71b1359b962c2057ee234f16be2edc0629e6a5889ff1abd4d2fd1f6d67
SSDEEP

6144:CsjU1vruW+UztmXtb2wDayQ7B4Y6/EcKbiCW:tjaumMXtb2w+yM4YhVWCW

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3284 WINWORD.EXE
3284 WINWORD.EXE
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

3284 WINWORD.EXE
3284 WINWORD.EXE
3284 WINWORD.EXE
3284 WINWORD.EXE
3284 WINWORD.EXE
3284 WINWORD.EXE
3284 WINWORD.EXE
3284 WINWORD.EXE

pid	process
3284	WINWORD.EXE
3284	WINWORD.EXE

pid	process
3284	WINWORD.EXE
3284	WINWORD.EXE
3284	WINWORD.EXE
3284	WINWORD.EXE
3284	WINWORD.EXE
3284	WINWORD.EXE
3284	WINWORD.EXE
3284	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\12-09-2022 SİPARİŞ.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3284

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3284-132-0x00007FF963870000-0x00007FF963880000-memory.dmp

Filesize
64KB

Download
memory/3284-133-0x00007FF963870000-0x00007FF963880000-memory.dmp

Filesize
64KB

Download
memory/3284-134-0x00007FF963870000-0x00007FF963880000-memory.dmp

Filesize
64KB

Download
memory/3284-135-0x00007FF963870000-0x00007FF963880000-memory.dmp

Filesize
64KB

Download
memory/3284-136-0x00007FF963870000-0x00007FF963880000-memory.dmp

Filesize
64KB

Download
memory/3284-137-0x00007FF9617E0000-0x00007FF9617F0000-memory.dmp

Filesize
64KB

Download
memory/3284-138-0x00007FF9617E0000-0x00007FF9617F0000-memory.dmp

Filesize
64KB

Download
memory/3284-140-0x00007FF963870000-0x00007FF963880000-memory.dmp

Filesize
64KB

Download
memory/3284-141-0x00007FF963870000-0x00007FF963880000-memory.dmp

Filesize
64KB

Download
memory/3284-143-0x00007FF963870000-0x00007FF963880000-memory.dmp

Filesize
64KB

Download
memory/3284-142-0x00007FF963870000-0x00007FF963880000-memory.dmp

Filesize
64KB

Download