Analysis
-
max time kernel
156s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 10:07
Behavioral task
behavioral1
Sample
17b2a838cf97a51a957b4fdac872da5275099eafe51d9ef36e4ccd0807863cd6.doc
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
17b2a838cf97a51a957b4fdac872da5275099eafe51d9ef36e4ccd0807863cd6.doc
Resource
win10v2004-20220812-en
General
-
Target
17b2a838cf97a51a957b4fdac872da5275099eafe51d9ef36e4ccd0807863cd6.doc
-
Size
38KB
-
MD5
fceda48793964545a4f101dab47823c3
-
SHA1
f55e1cb64383ab94df8615866e45d083ffdb7fe5
-
SHA256
17b2a838cf97a51a957b4fdac872da5275099eafe51d9ef36e4ccd0807863cd6
-
SHA512
44d302338d545446c7e69b47a8f07c0a1ca17ea4bbcb47bbe9f80952e4df7dd8e01599438169534fbfe7e96bb6b325540775d7158f4bd9ccf46ad37b304b0586
-
SSDEEP
192:8/y2icT0EJJJpiZq9U2dOLeWRTnbissjg8L9tKVZ0jF/GyaqT5tWnma:8JT0AJzbKxb63LeVZ0jF/Gjq9ti
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4576 WINWORD.EXE 4576 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
WINWORD.EXEpid process 4576 WINWORD.EXE 4576 WINWORD.EXE 4576 WINWORD.EXE 4576 WINWORD.EXE 4576 WINWORD.EXE 4576 WINWORD.EXE 4576 WINWORD.EXE 4576 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\17b2a838cf97a51a957b4fdac872da5275099eafe51d9ef36e4ccd0807863cd6.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4576-132-0x00007FF862050000-0x00007FF862060000-memory.dmpFilesize
64KB
-
memory/4576-133-0x00007FF862050000-0x00007FF862060000-memory.dmpFilesize
64KB
-
memory/4576-135-0x00007FF862050000-0x00007FF862060000-memory.dmpFilesize
64KB
-
memory/4576-134-0x00007FF862050000-0x00007FF862060000-memory.dmpFilesize
64KB
-
memory/4576-136-0x00007FF862050000-0x00007FF862060000-memory.dmpFilesize
64KB
-
memory/4576-137-0x00007FF85FF60000-0x00007FF85FF70000-memory.dmpFilesize
64KB
-
memory/4576-138-0x00007FF85FF60000-0x00007FF85FF70000-memory.dmpFilesize
64KB