a93281216e4eac91f4df122936142a3c82075a665202c5a2cd7f8cfce5cc7cc0

Analysis

max time kernel
206s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a93281216e4eac91f4df122936142a3c82075a665202c5a2cd7f8cfce5cc7cc0.doc
Size

68KB
MD5

7bfaf508be27a74c23f08b9138992562
SHA1

1b9f15cd2ec197a94927461ad77df66479199c72
SHA256

a93281216e4eac91f4df122936142a3c82075a665202c5a2cd7f8cfce5cc7cc0
SHA512

c883627e417b371836c7da1c77f6f1b1c1c771bc80f0f4e9f1ae0a1528bde30152005e8c5a07e064466f65bf03dd626ca178966c5f00e91171db18bee66feb9b
SSDEEP

768:tWMNhQAPoSA8j+hq/AVjuhUrqZWltcVV1DExdCKQ7BSLau:ZgAPoSvK

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

1700 WINWORD.EXE
1700 WINWORD.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

WINWORD.EXE

pid	process
1700	WINWORD.EXE
1700	WINWORD.EXE
1700	WINWORD.EXE
1700	WINWORD.EXE
1700	WINWORD.EXE
1700	WINWORD.EXE
1700	WINWORD.EXE
1700	WINWORD.EXE
1700	WINWORD.EXE
1700	WINWORD.EXE
1700	WINWORD.EXE
1700	WINWORD.EXE
1700	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a93281216e4eac91f4df122936142a3c82075a665202c5a2cd7f8cfce5cc7cc0.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1700

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-132-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

Filesize
64KB

Download
memory/1700-133-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

Filesize
64KB

Download
memory/1700-134-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

Filesize
64KB

Download
memory/1700-135-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

Filesize
64KB

Download
memory/1700-136-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

Filesize
64KB

Download
memory/1700-137-0x00007FFC1F9F0000-0x00007FFC1FA00000-memory.dmp

Filesize
64KB

Download
memory/1700-138-0x00007FFC1F9F0000-0x00007FFC1FA00000-memory.dmp

Filesize
64KB

Download