2d03fbee7a64e658eaf6992c9f3e80e2a077f3436c7a0f4e0b7894624128f04b

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d03fbee7a64e658eaf6992c9f3e80e2a077f3436c7a0f4e0b7894624128f04b.docm
Size

18KB
MD5

1dbe2f9663508cd57f640ec7a5a9222c
SHA1

944f1567c3da81dfa5d4c9877822bdaf4abf6502
SHA256

2d03fbee7a64e658eaf6992c9f3e80e2a077f3436c7a0f4e0b7894624128f04b
SHA512

2f631e5563effb09c392b3d5c849a2284bd9636652b5ae58f18070c1127625908a7b9e274acab5f40c8af225cc651a3d00d31f4bf1e27a54988cf4be49839abe
SSDEEP

384:/iCkt4B7wl/aa3QNxt/ZtNNEGa6js2ZzogQuM8u:/tm4Vi/aBxllNrtAOUoM5

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

wscript.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	4688	4624	wscript.exe	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4624 WINWORD.EXE
4624 WINWORD.EXE
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

4624 WINWORD.EXE
4624 WINWORD.EXE
4624 WINWORD.EXE
4624 WINWORD.EXE
4624 WINWORD.EXE
4624 WINWORD.EXE
4624 WINWORD.EXE

pid	process
4624	WINWORD.EXE
4624	WINWORD.EXE

pid	process
4624	WINWORD.EXE
4624	WINWORD.EXE
4624	WINWORD.EXE
4624	WINWORD.EXE
4624	WINWORD.EXE
4624	WINWORD.EXE
4624	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 4624 wrote to memory of 4688	4624	WINWORD.EXE	wscript.exe
PID 4624 wrote to memory of 4688	4624	WINWORD.EXE	wscript.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2d03fbee7a64e658eaf6992c9f3e80e2a077f3436c7a0f4e0b7894624128f04b.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624

C:\Windows\SYSTEM32\wscript.exe
wscript C:\\Users\\Public\\getfonts.vbs
2⤵
- Process spawned unexpected child process
PID:4688

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\getfonts.vbs
Filesize
105B

MD5
5d971f4a3e1ee5615982912977f7b708

SHA1
48a7c309e15e888c64919dbd2dd40434c651379d

SHA256
a8d7505be13cf7a3fa0f0e7bf142aef9608732e9643463034aa83f698f295264

SHA512
0556b217f2f3ade83f002979b973c646575258672cdc3476f883d2284094ea5cc7c6352c12d684f38ed550360ba47f5824c14f48a5bc162b3c8be0ced6000a01

Download Submit
memory/4624-138-0x00007FFC42D80000-0x00007FFC42D90000-memory.dmp

Filesize
64KB

Download
memory/4624-134-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/4624-135-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/4624-136-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/4624-137-0x00007FFC42D80000-0x00007FFC42D90000-memory.dmp

Filesize
64KB

Download
memory/4624-132-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/4624-133-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/4624-142-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/4624-143-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/4624-144-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/4624-145-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/4688-139-0x0000000000000000-mapping.dmp

Download