94e9965cc66ca20e1ae3ed4f1c74159be6552ee9045b26f2c89ad5e5fa10626f

Analysis

max time kernel
149s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 07:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

S-INV-BROOKSTRO1-476006.doc
Size

92KB
MD5

b7bb1381da652290534605e5254361bd
SHA1

2047787498e75f90141cf3b243e3f1ad52501089
SHA256

94e9965cc66ca20e1ae3ed4f1c74159be6552ee9045b26f2c89ad5e5fa10626f
SHA512

5ae7a322d5156b07fa925e78fb2314b75d33517acebbec804bc60d99827d946039d25b3f6255ed96a37a9c8f6c365b2b4f1f6701985cad7e09b621e991ff95dc
SSDEEP

768:LsJgq1SnsblZc9TBFOHKHbNCIN5IZJ0i1yJctQrBwG2vJE9A/QgaltcF7ct9gYiK:Hq1SnmLrSbN3+J0H4vJHogqtbO7svdB

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3924 WINWORD.EXE
3924 WINWORD.EXE
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

3924 WINWORD.EXE
3924 WINWORD.EXE
3924 WINWORD.EXE
3924 WINWORD.EXE
3924 WINWORD.EXE
3924 WINWORD.EXE
3924 WINWORD.EXE

pid	process
3924	WINWORD.EXE
3924	WINWORD.EXE

pid	process
3924	WINWORD.EXE
3924	WINWORD.EXE
3924	WINWORD.EXE
3924	WINWORD.EXE
3924	WINWORD.EXE
3924	WINWORD.EXE
3924	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\S-INV-BROOKSTRO1-476006.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3924-132-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

Filesize
64KB

Download
memory/3924-133-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

Filesize
64KB

Download
memory/3924-134-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

Filesize
64KB

Download
memory/3924-135-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

Filesize
64KB

Download
memory/3924-136-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

Filesize
64KB

Download
memory/3924-137-0x00007FFE81370000-0x00007FFE81380000-memory.dmp

Filesize
64KB

Download
memory/3924-138-0x00007FFE81370000-0x00007FFE81380000-memory.dmp

Filesize
64KB

Download
memory/3924-139-0x000002652F0F7000-0x000002652F0F9000-memory.dmp

Filesize
8KB

Download