Analysis
-
max time kernel
185s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2022 21:26
Behavioral task
behavioral1
Sample
264bc60659b85658ee0607fd20b5398b.doc
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
264bc60659b85658ee0607fd20b5398b.doc
Resource
win10v2004-20221111-en
General
-
Target
264bc60659b85658ee0607fd20b5398b.doc
-
Size
73KB
-
MD5
264bc60659b85658ee0607fd20b5398b
-
SHA1
eed936120ced47b0e34a389eb02580fe69af4960
-
SHA256
244c639c58e30b0a5cccc7d7163ee5b14410f7ac33e36a08569948d8ef649cfe
-
SHA512
48c4e002cfdb91ea47b0b81530c2041e9ddef850e58d9352a56c536315abcd32b448deaa4f709147f988e2e040d586c6df01627752aac346048df6f8d06af5e6
-
SSDEEP
1536:ASLTdXlavIjG8JRGtEBdGJHvFG0SGKjGottaMJf+Dg16VrKjq:bL9lgxemDw6VrK+
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4708 WINWORD.EXE 4708 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 21 IoCs
Processes:
WINWORD.EXEpid process 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\264bc60659b85658ee0607fd20b5398b.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4708