184c0d536e94e802fbadccc66915ae865c98134fe968e3bbc3bdb49378b37dce

Analysis

max time kernel
111s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-02-2023 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Software/About/CoreFile.docx
Size

1.3MB
MD5

71fda98dec9558a1f3fd0997da984afe
SHA1

bfa62ac61a091802a45a0c01fa9ddab5c3354adf
SHA256

d58843e02d3d29b14ecda7902721e28bbd5491d9803bc96e35c1fa4e36fdec0d
SHA512

788b6dd9c991aa9ce64f99625ab8ff9347a2deb234d453b3a37fe5be2a7e68ba5dd8991e26a5623fcac164682681fb253edfa3e11823a557078fc47b32aae2d8
SSDEEP

24576:+9k65zehP8nFJYD3yVzNiVz5cnPTzgJ/jrW1nfuxafECqduek2AAQZnlfWpes:+ke2P8ouzNgzy7kJXcYCumZnxWf

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

2996 WINWORD.EXE
2996 WINWORD.EXE
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

WINWORD.EXE

pid process

2996 WINWORD.EXE
2996 WINWORD.EXE
2996 WINWORD.EXE
2996 WINWORD.EXE
2996 WINWORD.EXE
2996 WINWORD.EXE
2996 WINWORD.EXE
2996 WINWORD.EXE
2996 WINWORD.EXE

pid	process
2996	WINWORD.EXE
2996	WINWORD.EXE

pid	process
2996	WINWORD.EXE
2996	WINWORD.EXE
2996	WINWORD.EXE
2996	WINWORD.EXE
2996	WINWORD.EXE
2996	WINWORD.EXE
2996	WINWORD.EXE
2996	WINWORD.EXE
2996	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Software\About\CoreFile.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\AB5A23B8.png
Filesize
359B

MD5
1b0c2f2cf9ec01545a939f385aa63a9b

SHA1
9c1e8631c040f8dd7fd5bae74a5ee19456f5849d

SHA256
54263f99639adf85f4113f619d594656c304af0b5263fd4fbfbf4ebce34f935f

SHA512
b2a9aec9fbff2c2c44c28df1eec4975731a1337d5d251ddef8577c2a9351a0558a7bd55734bb6acfdcef52e26ab86d278e51921f8517962a1f30b1f97d905b70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C39BCB9D.png
Filesize
2KB

MD5
56ee25041ab352ced8a18d781eac7887

SHA1
0c50e8d9056b80738585ffa29ade9a2fe91bbf15

SHA256
3ee7a5d1959af51219dfcce9c31adc117518f7678b0386f8fdcec322da14165d

SHA512
b0573430ff87c6ee2b84bb59d1eb57231735ee559061ef1bff6059ff6d32b86d987d5089577b4b44b2d783527f7fa233f0deba63950672a365ab4f660f3137c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\ED7FCB1.png
Filesize
2KB

MD5
60ec313e619049e5b3890d5a585eacf6

SHA1
a71027eebdb4f40153f28f17334d94507b7377af

SHA256
ec9c5cbd823423f9a899cdfc935c92d5cfce43c10394472e2f8616ba16d77525

SHA512
0566ffb881497b635cecb5df1fd5ed76cd35b8c53d74fa571aa4be2de0d75e02f6a13867d226a2e38bd1eaa78d0c5a1c4096cf3fda5c49c57709301a06ffb10a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/2996-136-0x00007FFA6EA70000-0x00007FFA6EA80000-memory.dmp

Filesize
64KB

Download
memory/2996-138-0x00007FFA6C270000-0x00007FFA6C280000-memory.dmp

Filesize
64KB

Download
memory/2996-139-0x00007FFA6C270000-0x00007FFA6C280000-memory.dmp

Filesize
64KB

Download
memory/2996-137-0x00007FFA6EA70000-0x00007FFA6EA80000-memory.dmp

Filesize
64KB

Download
memory/2996-133-0x00007FFA6EA70000-0x00007FFA6EA80000-memory.dmp

Filesize
64KB

Download
memory/2996-135-0x00007FFA6EA70000-0x00007FFA6EA80000-memory.dmp

Filesize
64KB

Download
memory/2996-134-0x00007FFA6EA70000-0x00007FFA6EA80000-memory.dmp

Filesize
64KB

Download
memory/2996-425-0x00007FFA6EA70000-0x00007FFA6EA80000-memory.dmp

Filesize
64KB

Download
memory/2996-426-0x00007FFA6EA70000-0x00007FFA6EA80000-memory.dmp

Filesize
64KB

Download
memory/2996-427-0x00007FFA6EA70000-0x00007FFA6EA80000-memory.dmp

Filesize
64KB

Download
memory/2996-428-0x00007FFA6EA70000-0x00007FFA6EA80000-memory.dmp

Filesize
64KB

Download