Analysis
-
max time kernel
198s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 09:20
Behavioral task
behavioral1
Sample
1db479103a350c17e4ad6818220f3878594d27c69d5835d32c1981fdd7ea2148.docm
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1db479103a350c17e4ad6818220f3878594d27c69d5835d32c1981fdd7ea2148.docm
Resource
win10v2004-20221111-en
General
-
Target
1db479103a350c17e4ad6818220f3878594d27c69d5835d32c1981fdd7ea2148.docm
-
Size
139KB
-
MD5
ebe6cc35c61c8e266d6baef0f7d28380
-
SHA1
5ebe9dc1d07482296dc23d453787a88b3d299d11
-
SHA256
1db479103a350c17e4ad6818220f3878594d27c69d5835d32c1981fdd7ea2148
-
SHA512
e7b5d645f9855e05187f181c1025a79046fbf27505e35eacdac347bd9f1a064cda407c26f1914173e771fb0b3815e8c80de1e98e4e4b1d98edb3dc73d51cb83a
-
SSDEEP
3072:1gNlvk3DKWThxb+PYJUBpOQOoVF06RUdb5gDTEwosFnnoE:M23DKuLipBLOI7idVAfFnB
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4432 WINWORD.EXE 4432 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4432 WINWORD.EXE 4432 WINWORD.EXE 4432 WINWORD.EXE 4432 WINWORD.EXE 4432 WINWORD.EXE 4432 WINWORD.EXE 4432 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1db479103a350c17e4ad6818220f3878594d27c69d5835d32c1981fdd7ea2148.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4432-132-0x00007FF84E110000-0x00007FF84E120000-memory.dmpFilesize
64KB
-
memory/4432-134-0x00007FF84E110000-0x00007FF84E120000-memory.dmpFilesize
64KB
-
memory/4432-133-0x00007FF84E110000-0x00007FF84E120000-memory.dmpFilesize
64KB
-
memory/4432-135-0x00007FF84E110000-0x00007FF84E120000-memory.dmpFilesize
64KB
-
memory/4432-136-0x00007FF84E110000-0x00007FF84E120000-memory.dmpFilesize
64KB
-
memory/4432-137-0x00007FF84BCD0000-0x00007FF84BCE0000-memory.dmpFilesize
64KB
-
memory/4432-138-0x00007FF84BCD0000-0x00007FF84BCE0000-memory.dmpFilesize
64KB