10eca59c3d4df784bbb5fb581adf65dbb0c7ec4d95476816cb0f9ce4100b27e3

Analysis

max time kernel
187s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 00:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10eca59c3d4df784bbb5fb581adf65dbb0c7ec4d95476816cb0f9ce4100b27e3.doc
Size

68KB
MD5

030bbc1dc435a612d4ed7a049470ddb5
SHA1

f50ece1e3e0420fad9aa549e29e0a3e28a45daf5
SHA256

10eca59c3d4df784bbb5fb581adf65dbb0c7ec4d95476816cb0f9ce4100b27e3
SHA512

c258b99684d77b95ec6a1f43a7c7a343e9e453a6a1417e2c0efe17711063d3b7b29033958cbd62f5fbe378289d393197735d938211ec4535502e8fda2079561d
SSDEEP

768:dnw+fk+Sdcf2Lt6StWNGPcHlwnASjSgMWIn3F/7:rf5cc+LMiBnAOF01

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4276 WINWORD.EXE
4276 WINWORD.EXE
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

4276 WINWORD.EXE
4276 WINWORD.EXE
4276 WINWORD.EXE
4276 WINWORD.EXE
4276 WINWORD.EXE
4276 WINWORD.EXE
4276 WINWORD.EXE
4276 WINWORD.EXE

pid	process
4276	WINWORD.EXE
4276	WINWORD.EXE

pid	process
4276	WINWORD.EXE
4276	WINWORD.EXE
4276	WINWORD.EXE
4276	WINWORD.EXE
4276	WINWORD.EXE
4276	WINWORD.EXE
4276	WINWORD.EXE
4276	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\10eca59c3d4df784bbb5fb581adf65dbb0c7ec4d95476816cb0f9ce4100b27e3.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4276

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4276-132-0x00007FFBB44B0000-0x00007FFBB44C0000-memory.dmp

Filesize
64KB

Download
memory/4276-133-0x00007FFBB44B0000-0x00007FFBB44C0000-memory.dmp

Filesize
64KB

Download
memory/4276-134-0x00007FFBB44B0000-0x00007FFBB44C0000-memory.dmp

Filesize
64KB

Download
memory/4276-135-0x00007FFBB44B0000-0x00007FFBB44C0000-memory.dmp

Filesize
64KB

Download
memory/4276-136-0x00007FFBB44B0000-0x00007FFBB44C0000-memory.dmp

Filesize
64KB

Download
memory/4276-137-0x00007FFBB2450000-0x00007FFBB2460000-memory.dmp

Filesize
64KB

Download
memory/4276-138-0x00007FFBB2450000-0x00007FFBB2460000-memory.dmp

Filesize
64KB

Download
memory/4276-140-0x00007FFBB44B0000-0x00007FFBB44C0000-memory.dmp

Filesize
64KB

Download
memory/4276-141-0x00007FFBB44B0000-0x00007FFBB44C0000-memory.dmp

Filesize
64KB

Download
memory/4276-142-0x00007FFBB44B0000-0x00007FFBB44C0000-memory.dmp

Filesize
64KB

Download
memory/4276-143-0x00007FFBB44B0000-0x00007FFBB44C0000-memory.dmp

Filesize
64KB

Download