b988ba06d6898fda8b4513be69fd7a2a4f6fe2354ce8e89bfc0db1a25c5b34fe

Analysis

max time kernel
177s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b988ba06d6898fda8b4513be69fd7a2a4f6fe2354ce8e89bfc0db1a25c5b34fe.doc
Size

44KB
MD5

627de756499c17062a994351cc6388bd
SHA1

d9e5d2c15a0ea603986b9228e615e26f0c032f92
SHA256

b988ba06d6898fda8b4513be69fd7a2a4f6fe2354ce8e89bfc0db1a25c5b34fe
SHA512

c05bdfb7f575f64043c4a076a7996ed2e9b5865cac51ded49fd49b10109928f53c3d5be3f755b42c51b1be7c749781ce2e2330df1e79d4cc4d9ce2178a5a6bf6
SSDEEP

384:IFquLE8MHc/CArJRc7IJFEW/tCwmtKRNIlOtttZ0jQhs170:4dQ8MHc/9ccLb3P00

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

2220 WINWORD.EXE
2220 WINWORD.EXE
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

2220 WINWORD.EXE
2220 WINWORD.EXE
2220 WINWORD.EXE
2220 WINWORD.EXE
2220 WINWORD.EXE
2220 WINWORD.EXE
2220 WINWORD.EXE

pid	process
2220	WINWORD.EXE
2220	WINWORD.EXE

pid	process
2220	WINWORD.EXE
2220	WINWORD.EXE
2220	WINWORD.EXE
2220	WINWORD.EXE
2220	WINWORD.EXE
2220	WINWORD.EXE
2220	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\b988ba06d6898fda8b4513be69fd7a2a4f6fe2354ce8e89bfc0db1a25c5b34fe.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-132-0x00007FFA98710000-0x00007FFA98720000-memory.dmp

Filesize
64KB

Download
memory/2220-133-0x00007FFA98710000-0x00007FFA98720000-memory.dmp

Filesize
64KB

Download
memory/2220-134-0x00007FFA98710000-0x00007FFA98720000-memory.dmp

Filesize
64KB

Download
memory/2220-135-0x00007FFA98710000-0x00007FFA98720000-memory.dmp

Filesize
64KB

Download
memory/2220-136-0x00007FFA98710000-0x00007FFA98720000-memory.dmp

Filesize
64KB

Download
memory/2220-137-0x00007FFA966B0000-0x00007FFA966C0000-memory.dmp

Filesize
64KB

Download
memory/2220-138-0x00007FFA966B0000-0x00007FFA966C0000-memory.dmp

Filesize
64KB

Download
memory/2220-141-0x00007FFA98710000-0x00007FFA98720000-memory.dmp

Filesize
64KB

Download
memory/2220-140-0x00007FFA98710000-0x00007FFA98720000-memory.dmp

Filesize
64KB

Download
memory/2220-142-0x00007FFA98710000-0x00007FFA98720000-memory.dmp

Filesize
64KB

Download
memory/2220-143-0x00007FFA98710000-0x00007FFA98720000-memory.dmp

Filesize
64KB

Download