Analysis
-
max time kernel
214s -
max time network
233s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 09:22
Behavioral task
behavioral1
Sample
849c085c8f78da222e15fa2b7a6fd08071b7d1863da4ed339b797e614b15a393.doc
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
849c085c8f78da222e15fa2b7a6fd08071b7d1863da4ed339b797e614b15a393.doc
Resource
win10v2004-20221111-en
General
-
Target
849c085c8f78da222e15fa2b7a6fd08071b7d1863da4ed339b797e614b15a393.doc
-
Size
16KB
-
MD5
89d90f25dde79f6ef5d8417ceff148ef
-
SHA1
3e399ea263d544bcc7a5fd6e9a4f7281fbf93546
-
SHA256
849c085c8f78da222e15fa2b7a6fd08071b7d1863da4ed339b797e614b15a393
-
SHA512
5e98c61ae84aa524804f49bab8f1bdeaf2c8cc85c1fe31834a9b225574a976e4665a2033ee4df6bc600c4e911e912cf110750f4f17700e315c95f3c38f0b9ada
-
SSDEEP
192:Kf8/9kC6gmORA5S+2Q8F8YukPCeqd+9Y5QG8YavvamST:CU96pCOpkPKb8Ya
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3492 WINWORD.EXE 3492 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
WINWORD.EXEpid process 3492 WINWORD.EXE 3492 WINWORD.EXE 3492 WINWORD.EXE 3492 WINWORD.EXE 3492 WINWORD.EXE 3492 WINWORD.EXE 3492 WINWORD.EXE 3492 WINWORD.EXE 3492 WINWORD.EXE 3492 WINWORD.EXE 3492 WINWORD.EXE 3492 WINWORD.EXE 3492 WINWORD.EXE 3492 WINWORD.EXE 3492 WINWORD.EXE 3492 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\849c085c8f78da222e15fa2b7a6fd08071b7d1863da4ed339b797e614b15a393.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3492
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3492-132-0x00007FF7FA290000-0x00007FF7FA2A0000-memory.dmpFilesize
64KB
-
memory/3492-134-0x00007FF7FA290000-0x00007FF7FA2A0000-memory.dmpFilesize
64KB
-
memory/3492-133-0x00007FF7FA290000-0x00007FF7FA2A0000-memory.dmpFilesize
64KB
-
memory/3492-135-0x00007FF7FA290000-0x00007FF7FA2A0000-memory.dmpFilesize
64KB
-
memory/3492-136-0x00007FF7FA290000-0x00007FF7FA2A0000-memory.dmpFilesize
64KB
-
memory/3492-137-0x00007FF7F7930000-0x00007FF7F7940000-memory.dmpFilesize
64KB
-
memory/3492-138-0x00007FF7F7930000-0x00007FF7F7940000-memory.dmpFilesize
64KB