22353dc6c3f32010e74740394f3b8952f94a1a82febfcfc9d4960202a835ca04

Analysis

max time kernel
257s
max time network
288s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 21:36

Target

22353dc6c3f32010e74740394f3b8952f94a1a82febfcfc9d4960202a835ca04.doc
Size

87KB
MD5

e7d6aa728aa28487400cb2ae82051531
SHA1

1b648cf52196c7964d5bf5b923521de2fd1eb0e4
SHA256

22353dc6c3f32010e74740394f3b8952f94a1a82febfcfc9d4960202a835ca04
SHA512

e331b1c6bf4e756259966a7288ac981dfb0decf954e5ce40e02a41505547fe1b7bff5865f17104ec17cbbfdb19f9e0e8ef816b3c67627b35055fbcc43b910326
SSDEEP

768:VrXokmdMJSXpiIkPlx/YrIaxkrmutEIG4JXrJQihLC6:V89dMJSZXkwUvrm4G4JXrJQGLC

Score

1^/10

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

116 WINWORD.EXE
116 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

116 WINWORD.EXE
116 WINWORD.EXE

pid	process
116	WINWORD.EXE
116	WINWORD.EXE

pid	process
116	WINWORD.EXE
116	WINWORD.EXE

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/116-132-0x00007FF866290000-0x00007FF8662A0000-memory.dmp

Filesize
64KB

Download
memory/116-133-0x00007FF866290000-0x00007FF8662A0000-memory.dmp

Filesize
64KB

Download
memory/116-134-0x00007FF866290000-0x00007FF8662A0000-memory.dmp

Filesize
64KB

Download
memory/116-135-0x00007FF866290000-0x00007FF8662A0000-memory.dmp

Filesize
64KB

Download
memory/116-136-0x00007FF866290000-0x00007FF8662A0000-memory.dmp

Filesize
64KB

Download
memory/116-137-0x00007FF864080000-0x00007FF864090000-memory.dmp

Filesize
64KB

Download
memory/116-138-0x00007FF864080000-0x00007FF864090000-memory.dmp

Filesize
64KB

Download