f983216ab0b076ff26e29d7055d8319dd38bdb5cf2e19370ea63b8926b3aa77e

Analysis

max time kernel
207s
max time network
218s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f983216ab0b076ff26e29d7055d8319dd38bdb5cf2e19370ea63b8926b3aa77e.doc
Size

118KB
MD5

e4a6063140a90f2008c4aba4c1dffcde
SHA1

5b6130bf69425f2a481a675005edecba5763048a
SHA256

f983216ab0b076ff26e29d7055d8319dd38bdb5cf2e19370ea63b8926b3aa77e
SHA512

0a04cf7ef1b86a5dd7449061d488c21ad4a9db385760128b8fb3da0b7aa64dcc445428d0d476a548d9b2d2760225feb5255bf685b35507125f09cac8a9e496c5
SSDEEP

384:S1BoWf/Kx84TKvb1G8nz9VqpBO4zOAXLlfkSjXjGHnjyHxaEndvR4TIDWYJlUvbR:8zgpODSpA4z1LlMa3ImGAMVNH2bK7pZ

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3424 WINWORD.EXE
3424 WINWORD.EXE
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

3424 WINWORD.EXE
3424 WINWORD.EXE
3424 WINWORD.EXE
3424 WINWORD.EXE
3424 WINWORD.EXE
3424 WINWORD.EXE
3424 WINWORD.EXE

pid	process
3424	WINWORD.EXE
3424	WINWORD.EXE

pid	process
3424	WINWORD.EXE
3424	WINWORD.EXE
3424	WINWORD.EXE
3424	WINWORD.EXE
3424	WINWORD.EXE
3424	WINWORD.EXE
3424	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f983216ab0b076ff26e29d7055d8319dd38bdb5cf2e19370ea63b8926b3aa77e.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3424-132-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmp

Filesize
64KB

Download
memory/3424-134-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmp

Filesize
64KB

Download
memory/3424-133-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmp

Filesize
64KB

Download
memory/3424-135-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmp

Filesize
64KB

Download
memory/3424-136-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmp

Filesize
64KB

Download
memory/3424-137-0x00007FFBDA980000-0x00007FFBDA990000-memory.dmp

Filesize
64KB

Download
memory/3424-138-0x00007FFBDA980000-0x00007FFBDA990000-memory.dmp

Filesize
64KB

Download
memory/3424-140-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmp

Filesize
64KB

Download
memory/3424-141-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmp

Filesize
64KB

Download
memory/3424-142-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmp

Filesize
64KB

Download
memory/3424-143-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmp

Filesize
64KB

Download