Overview

overview

5

Static

static

45f293b1b5...0.docm

windows10-1703-x64

5

Resubmissions

25/10/2022, 08:28

221025-kc4l1scac4 5

25/10/2022, 08:07

221025-jzze5scabj 10

Analysis

  • max time kernel
    298s
  • max time network
    198s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25/10/2022, 08:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    45f293b1b5a4aaec48ac943696302bac9c893867f1fc282e85ed8341dd2f0f50.docm

  • Size

    143KB

  • MD5

    f769f67681707e8f69ecdf9e62fb944c

  • SHA1

    c5f6a48fa52a279e1f3424b97662b479716229af

  • SHA256

    45f293b1b5a4aaec48ac943696302bac9c893867f1fc282e85ed8341dd2f0f50

  • SHA512

    779caa9c7efac57edc6078d212b04a930d66fa10b50967bb1b9131c9e240f40f09e6f81812583770e7ffac51d7d0e23b57e20e6a7719d73ab2f1673cb17943a9

  • SSDEEP

    3072:2e3HSOTf6Mqfb041n8Vj9SmUNRzw16vDhLfByVBZsqnCVL:2eiObpS1nY9fqzjvDZoDsqngL

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\45f293b1b5a4aaec48ac943696302bac9c893867f1fc282e85ed8341dd2f0f50.docm" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3540
  • C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1580

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1580-544-0x000000001D5DA000-0x000000001D5DF000-memory.dmp

    Filesize

    20KB

    Download

  • memory/1580-546-0x000000001D5DA000-0x000000001D5DF000-memory.dmp

    Filesize

    20KB

    Download

  • memory/3540-118-0x00007FF851770000-0x00007FF851780000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3540-119-0x00007FF851770000-0x00007FF851780000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3540-120-0x00007FF851770000-0x00007FF851780000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3540-121-0x00007FF851770000-0x00007FF851780000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3540-124-0x00007FF84DFE0000-0x00007FF84DFF0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3540-125-0x00007FF84DFE0000-0x00007FF84DFF0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3540-297-0x0000024DF1650000-0x0000024DF1654000-memory.dmp

    Filesize

    16KB

    Download

  • memory/3540-316-0x0000024DEB021000-0x0000024DEB023000-memory.dmp

    Filesize

    8KB

    Download