3a0f0986193d0dc5e03ca1229e2509287593c03247e32bb5424009bc35e80738

Resubmissions

08-10-2022 00:17

221008-alen5seafl 10

07-10-2022 06:08

221007-gv6mjsbhhn 10

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2022 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PKSJ Malware/3/VirusShare_3fb34964fa7b8c6bfad8d960380ff04e.doc
Size

34KB
MD5

3fb34964fa7b8c6bfad8d960380ff04e
SHA1

9a3aec40056ce74bac833989ed71dfb6c2626f4c
SHA256

26026b1b3d0cb660c6be6c536df679acca0b5562a3adbb507d001474d23f5650
SHA512

a82b522dfd7eac30292a9e9ab19ddac94563804e77a1090e5f44de7e794ef4e5ebe0e7fb36e5177479417c8176ae0475613700755ca015c7ce941a4740215faa
SSDEEP

384:bzIPMepSbSsG/CdPvunCpeJzKoSS3D6JO5LfBqtjbjk4Eohubn3ezta:nIPMecWsGKVunFFRDE6pqjhust

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4960 WINWORD.EXE
4960 WINWORD.EXE

Suspicious use of SetWindowsHookEx 21 IoCs

Processes:

WINWORD.EXE

pid	process
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\PKSJ Malware\3\VirusShare_3fb34964fa7b8c6bfad8d960380ff04e.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4960

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4960-132-0x00007FFD5C5D0000-0x00007FFD5C5E0000-memory.dmp

Filesize
64KB

Download
memory/4960-133-0x00007FFD5C5D0000-0x00007FFD5C5E0000-memory.dmp

Filesize
64KB

Download
memory/4960-134-0x00007FFD5C5D0000-0x00007FFD5C5E0000-memory.dmp

Filesize
64KB

Download
memory/4960-135-0x00007FFD5C5D0000-0x00007FFD5C5E0000-memory.dmp

Filesize
64KB

Download
memory/4960-136-0x00007FFD5C5D0000-0x00007FFD5C5E0000-memory.dmp

Filesize
64KB

Download
memory/4960-137-0x00007FFD5A380000-0x00007FFD5A390000-memory.dmp

Filesize
64KB

Download
memory/4960-138-0x00007FFD5A380000-0x00007FFD5A390000-memory.dmp

Filesize
64KB

Download