Analysis
-
max time kernel
156s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 10:08
Behavioral task
behavioral1
Sample
97b185729d6dd24c376f855cbf60ee1e622778691c8b2876f77fef067a9b62e2.doc
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
97b185729d6dd24c376f855cbf60ee1e622778691c8b2876f77fef067a9b62e2.doc
Resource
win10v2004-20220812-en
General
-
Target
97b185729d6dd24c376f855cbf60ee1e622778691c8b2876f77fef067a9b62e2.doc
-
Size
66KB
-
MD5
436cffad2557fd4c083414a71527b73e
-
SHA1
10a54cd5baa817ae9ffc70ccfc1f1d411ad54941
-
SHA256
97b185729d6dd24c376f855cbf60ee1e622778691c8b2876f77fef067a9b62e2
-
SHA512
1e4b3d0767f9c05bcd0a4be76fdd049e677a6955ba5a1147ded8757d5bc33bc46f3cc576405276c0d4adf6801641a9cdf24f305cf5a4254787776ea8e164cb86
-
SSDEEP
768:Nk9rDqXaKMDoIC1s6oN9d3YG+tDHQG8jvpt4V+fx3uYw4AiMQUvnqYV:NTMaq9iD8jvT50YXQ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4608 WINWORD.EXE 4608 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4608 WINWORD.EXE 4608 WINWORD.EXE 4608 WINWORD.EXE 4608 WINWORD.EXE 4608 WINWORD.EXE 4608 WINWORD.EXE 4608 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\97b185729d6dd24c376f855cbf60ee1e622778691c8b2876f77fef067a9b62e2.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4608-132-0x00007FF811CF0000-0x00007FF811D00000-memory.dmpFilesize
64KB
-
memory/4608-134-0x00007FF811CF0000-0x00007FF811D00000-memory.dmpFilesize
64KB
-
memory/4608-133-0x00007FF811CF0000-0x00007FF811D00000-memory.dmpFilesize
64KB
-
memory/4608-135-0x00007FF811CF0000-0x00007FF811D00000-memory.dmpFilesize
64KB
-
memory/4608-136-0x00007FF811CF0000-0x00007FF811D00000-memory.dmpFilesize
64KB
-
memory/4608-137-0x00007FF80F3E0000-0x00007FF80F3F0000-memory.dmpFilesize
64KB
-
memory/4608-138-0x00007FF80F3E0000-0x00007FF80F3F0000-memory.dmpFilesize
64KB