Analysis
-
max time kernel
147s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-09-2022 14:27
Behavioral task
behavioral1
Sample
90813559ec856e8b9753c1789a1d1f471e40c917b8ce5aa38a00dbef1dbe0cb0.doc
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
90813559ec856e8b9753c1789a1d1f471e40c917b8ce5aa38a00dbef1dbe0cb0.doc
Resource
win10v2004-20220812-en
General
-
Target
90813559ec856e8b9753c1789a1d1f471e40c917b8ce5aa38a00dbef1dbe0cb0.doc
-
Size
93KB
-
MD5
6789e5775691d375d642a6a2ee2bebec
-
SHA1
c8989d117588297d66ab1222a892ff84fb29e5c0
-
SHA256
90813559ec856e8b9753c1789a1d1f471e40c917b8ce5aa38a00dbef1dbe0cb0
-
SHA512
0b8065b5681395cb1ec6b4d96fc4e64774f9e4239ba7675736521d310d981d379b12ee7ed011f917d97d423f7c21f09ad438f334cfd27b02e4ea622841508ae7
-
SSDEEP
1536:KQEJFFOMaEt+rAALWQOBdaGuDg16Vb8tTwL:j0nDaESAwWXa3Dw6Vb8EL
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2440 WINWORD.EXE 2440 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\90813559ec856e8b9753c1789a1d1f471e40c917b8ce5aa38a00dbef1dbe0cb0.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2440