Analysis
-
max time kernel
151s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 09:52
Static task
static1
Behavioral task
behavioral1
Sample
f094bf9d9198a1fffd008322049cf6410926df330f8a3da98d1acb2b784ee43f.doc
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f094bf9d9198a1fffd008322049cf6410926df330f8a3da98d1acb2b784ee43f.doc
Resource
win10v2004-20220812-en
General
-
Target
f094bf9d9198a1fffd008322049cf6410926df330f8a3da98d1acb2b784ee43f.doc
-
Size
57KB
-
MD5
b330f13bc3b9de661ee94807bf640a93
-
SHA1
1ee6f299fbcf596d6cf546c054615724df95a24a
-
SHA256
f094bf9d9198a1fffd008322049cf6410926df330f8a3da98d1acb2b784ee43f
-
SHA512
01b22f42e72a9c73632b43a2a00e1cf19789c8360ac1e96cb5642e9241b4cb53eb54deb9d9f7506ca150b030fb44fd0a51771644cfe89040b348288d240bc77b
-
SSDEEP
768:gCqkhIGRW+IQQSLRwmoBodTfuR88888mct1ysTsPAe0GJn2wNKqoQ2:gcbsUd7uR88888mQW0GxBH
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 988 WINWORD.EXE 988 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
WINWORD.EXEpid process 988 WINWORD.EXE 988 WINWORD.EXE 988 WINWORD.EXE 988 WINWORD.EXE 988 WINWORD.EXE 988 WINWORD.EXE 988 WINWORD.EXE 988 WINWORD.EXE 988 WINWORD.EXE 988 WINWORD.EXE 988 WINWORD.EXE 988 WINWORD.EXE 988 WINWORD.EXE 988 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f094bf9d9198a1fffd008322049cf6410926df330f8a3da98d1acb2b784ee43f.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/988-132-0x00007FFA4CB50000-0x00007FFA4CB60000-memory.dmpFilesize
64KB
-
memory/988-134-0x00007FFA4CB50000-0x00007FFA4CB60000-memory.dmpFilesize
64KB
-
memory/988-133-0x00007FFA4CB50000-0x00007FFA4CB60000-memory.dmpFilesize
64KB
-
memory/988-135-0x00007FFA4CB50000-0x00007FFA4CB60000-memory.dmpFilesize
64KB
-
memory/988-136-0x00007FFA4CB50000-0x00007FFA4CB60000-memory.dmpFilesize
64KB
-
memory/988-137-0x00007FFA4A2F0000-0x00007FFA4A300000-memory.dmpFilesize
64KB
-
memory/988-138-0x00007FFA4A2F0000-0x00007FFA4A300000-memory.dmpFilesize
64KB
-
memory/988-140-0x00007FFA4CB50000-0x00007FFA4CB60000-memory.dmpFilesize
64KB
-
memory/988-141-0x00007FFA4CB50000-0x00007FFA4CB60000-memory.dmpFilesize
64KB
-
memory/988-142-0x00007FFA4CB50000-0x00007FFA4CB60000-memory.dmpFilesize
64KB
-
memory/988-143-0x00007FFA4CB50000-0x00007FFA4CB60000-memory.dmpFilesize
64KB