a949e11e4eba55b9cf6b17c195020fa33f66b5fd2fb9190a87cbaf1dbc527b02

Analysis

max time kernel
150s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2022 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4807a5443c8d0f118221fdb8d183f473.docm
Size

207KB
MD5

4807a5443c8d0f118221fdb8d183f473
SHA1

2bbf2276294da53453710e688712e36f971cc9a5
SHA256

a949e11e4eba55b9cf6b17c195020fa33f66b5fd2fb9190a87cbaf1dbc527b02
SHA512

38876c4706966ddb745aeaaa9bae4ec5b91ae46d93501c6fa7888e966b5204b80fc38271a4b36f2333bbe78966602a10911a3efa882468d91897abc94c82cff5
SSDEEP

6144:vHbHtzJky3eEGVdajJ66tAhUJOO3NNzxsegZ:fzjkyuEGfMuhU7X1Q

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

msedge.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	2492	2568	msedge.exe	WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

2568 WINWORD.EXE
2568 WINWORD.EXE
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

WINWORD.EXE

pid process

2568 WINWORD.EXE
2568 WINWORD.EXE
2568 WINWORD.EXE
2568 WINWORD.EXE
2568 WINWORD.EXE

pid	process
2568	WINWORD.EXE
2568	WINWORD.EXE

pid	process
2568	WINWORD.EXE
2568	WINWORD.EXE
2568	WINWORD.EXE
2568	WINWORD.EXE
2568	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WINWORD.EXEmsedge.exe

description	pid	process	target process
PID 2568 wrote to memory of 2492	2568	WINWORD.EXE	msedge.exe
PID 2568 wrote to memory of 2492	2568	WINWORD.EXE	msedge.exe
PID 2492 wrote to memory of 4968	2492	msedge.exe	msedge.exe
PID 2492 wrote to memory of 4968	2492	msedge.exe	msedge.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4807a5443c8d0f118221fdb8d183f473.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://spamchallenge.msftemail.com/XZGxBeE5FTTFTekl6ZW1ORVRrbDZibkp1T1ZaMVYyNWxiVTVzZVZkR05FbDBRMGRZYmxSTUwyZG9hR2xPTTIxdVNESm1lbXMxYWtoRFdGZE5MMGhpYlhoQ1dIRXlNalZyYjJvME1EaFlkbGhrTlZKb2J5OVBZakZ2YVVoRFF6bDNhblYzWld4d2VqbDRObk5vVVd4a2FYZDZiVWczWlZwSEwzcE5kVzFwWkRKdlRVcDZObTlCYzFGTE5HMVpZMnBxYTJwd2JHcHlNbFY2V2xkcmVGWktiMFJTTldwM2NpdHBOa001ZDJNeWFVeHFTa2hyVjFOTVFWUnJjRlpDV0RWcExTMVZNRUZHV2xKelZXUTNjR0ZITkZaUFVYbzFhekJSUFQwPS0tOTM0Mjc0ZDgzNjMxMjAxNzJmZmNkNDcxYjE0OGZkN2YxMGYyMWMyMQ==?cid=1358712581
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa35da46f8,0x7ffa35da4708,0x7ffa35da4718
3⤵
PID:4968

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2492-139-0x0000000000000000-mapping.dmp

Download
memory/2568-132-0x00007FFA224B0000-0x00007FFA224C0000-memory.dmp

Filesize
64KB

Download
memory/2568-133-0x00007FFA224B0000-0x00007FFA224C0000-memory.dmp

Filesize
64KB

Download
memory/2568-134-0x00007FFA224B0000-0x00007FFA224C0000-memory.dmp

Filesize
64KB

Download
memory/2568-135-0x00007FFA224B0000-0x00007FFA224C0000-memory.dmp

Filesize
64KB

Download
memory/2568-136-0x00007FFA224B0000-0x00007FFA224C0000-memory.dmp

Filesize
64KB

Download
memory/2568-137-0x00007FFA1FBA0000-0x00007FFA1FBB0000-memory.dmp

Filesize
64KB

Download
memory/2568-138-0x00007FFA1FBA0000-0x00007FFA1FBB0000-memory.dmp

Filesize
64KB

Download
memory/4968-140-0x0000000000000000-mapping.dmp

Download