cfaf0a949a71ada54af11b81354abb914a0bc8500de9836cb568b011abda1e6b

Analysis

max time kernel
157s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2022 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3簡章附表/4專用信封-專用信封封面-橫式.docx
Size

24KB
MD5

3a16780b6b7fe094912a344ea089c4fd
SHA1

85f6f25d1cf7bb97c3d74d38fa3d8868a3b0ef0a
SHA256

ae3f8475bdabfac6361f608bb5c53c2f599dc8ddebc61b92aab3ab82d4ba98af
SHA512

76ba26298d5ceb0ab0a545884229802d46a1ea715df5dc718057349a6fa6bc5052b39639be73f7233bac3e419b888a04c513e0d9f87d5d7508744a06939d9099
SSDEEP

768:MHLYzqEGKAJXJBpwVNpO0Nm1mv1VrgBYt:AYzq3XJn0Q1mdmut

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3232 WINWORD.EXE
3232 WINWORD.EXE
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

3232 WINWORD.EXE
3232 WINWORD.EXE
3232 WINWORD.EXE
3232 WINWORD.EXE
3232 WINWORD.EXE
3232 WINWORD.EXE
3232 WINWORD.EXE
3232 WINWORD.EXE

pid	process
3232	WINWORD.EXE
3232	WINWORD.EXE

pid	process
3232	WINWORD.EXE
3232	WINWORD.EXE
3232	WINWORD.EXE
3232	WINWORD.EXE
3232	WINWORD.EXE
3232	WINWORD.EXE
3232	WINWORD.EXE
3232	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\3簡章附表\4專用信封-專用信封封面-橫式.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3232

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3232-132-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp

Filesize
64KB

Download
memory/3232-133-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp

Filesize
64KB

Download
memory/3232-134-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp

Filesize
64KB

Download
memory/3232-135-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp

Filesize
64KB

Download
memory/3232-136-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp

Filesize
64KB

Download
memory/3232-137-0x00007FFDBBF80000-0x00007FFDBBF90000-memory.dmp

Filesize
64KB

Download
memory/3232-138-0x00007FFDBBF80000-0x00007FFDBBF90000-memory.dmp

Filesize
64KB

Download
memory/3232-140-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp

Filesize
64KB

Download
memory/3232-141-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp

Filesize
64KB

Download
memory/3232-142-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp

Filesize
64KB

Download
memory/3232-143-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp

Filesize
64KB

Download