Behavioral Report

Analysis

max time kernel
108s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2022 05:57

Sharing

Copy URL

Twitter E-mail

Report Files Registry Network Processes Mutex Misc

General

Target

ЗАЯВА/3_ЗАЯВА-на-отримання-компенсації-додаткової-зниж.doc
Size

33KB
MD5

9f194f11b527a774eacd27a033271d88
SHA1

7878c28a865e582064d5b54e1caf18b4c9bc00d4
SHA256

a5a20063c8699c66f5292ed1da7c860360baf6cf2a52f33c2c0b8873a995397c
SHA512

6dd9e11d2d0c4bb8ceb851d2d896ff38d26fc045c44641c40ae1a4b0f47123f93f1de42058f2dedb02d73b3c66ef11b281086a427a663289ab8323080964cd26
SSDEEP

384:xdMX1hEOC3GiyGcSdW+wRsCBItyP3v3zCDqxz99:HNAKCBd3ODqxz99

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

TTPs:

Query Registry System Information Discovery

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

TTPs:

Query Registry System Information Discovery

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4496 WINWORD.EXE
4496 WINWORD.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

WINWORD.EXE

pid	process
4496	WINWORD.EXE
4496	WINWORD.EXE
4496	WINWORD.EXE
4496	WINWORD.EXE
4496	WINWORD.EXE
4496	WINWORD.EXE
4496	WINWORD.EXE
4496	WINWORD.EXE
4496	WINWORD.EXE
4496	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ЗАЯВА\3_ЗАЯВА-на-отримання-компенсації-додаткової-зниж.doc" /o ""

Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx

PID:4496

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Query Registry

T1012

System Information Discovery

T1082

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

memory/4496-132-0x00007FFE63C70000-0x00007FFE63C80000-memory.dmp

Filesize
64KB

Download
memory/4496-133-0x00007FFE63C70000-0x00007FFE63C80000-memory.dmp

Filesize
64KB

Download
memory/4496-134-0x00007FFE63C70000-0x00007FFE63C80000-memory.dmp

Filesize
64KB

Download
memory/4496-135-0x00007FFE63C70000-0x00007FFE63C80000-memory.dmp

Filesize
64KB

Download
memory/4496-136-0x00007FFE63C70000-0x00007FFE63C80000-memory.dmp

Filesize
64KB

Download
memory/4496-137-0x00007FFE617F0000-0x00007FFE61800000-memory.dmp

Filesize
64KB

Download
memory/4496-138-0x00007FFE617F0000-0x00007FFE61800000-memory.dmp

Filesize
64KB

Download
memory/4496-140-0x00007FFE63C70000-0x00007FFE63C80000-memory.dmp

Filesize
64KB

Download
memory/4496-141-0x00007FFE63C70000-0x00007FFE63C80000-memory.dmp

Filesize
64KB

Download
memory/4496-142-0x00007FFE63C70000-0x00007FFE63C80000-memory.dmp

Filesize
64KB

Download
memory/4496-143-0x00007FFE63C70000-0x00007FFE63C80000-memory.dmp

Filesize
64KB

Download