Analysis
- max time kernel
101s - max time network
120s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
03/03/2023, 15:05
General
- Target Request For P.I.docx
- Size 10KB
- Sample230303-sgccbshd6y
- SHA256 324280b29e2831413f5e77ddbf2f84dc30fe06533915ba676175d3ed4b415cea
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Request For P.I.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4696-133-0x00007FFCD9FF0000-0x00007FFCDA000000-memory.dmp
memory/4696-134-0x00007FFCD9FF0000-0x00007FFCDA000000-memory.dmp
memory/4696-135-0x00007FFCD9FF0000-0x00007FFCDA000000-memory.dmp
memory/4696-136-0x00007FFCD9FF0000-0x00007FFCDA000000-memory.dmp
memory/4696-137-0x00007FFCD9FF0000-0x00007FFCDA000000-memory.dmp
memory/4696-138-0x00007FFCD79B0000-0x00007FFCD79C0000-memory.dmp
memory/4696-139-0x00007FFCD79B0000-0x00007FFCD79C0000-memory.dmp
memory/4696-176-0x00007FFCD9FF0000-0x00007FFCDA000000-memory.dmp
memory/4696-177-0x00007FFCD9FF0000-0x00007FFCDA000000-memory.dmp
memory/4696-178-0x00007FFCD9FF0000-0x00007FFCDA000000-memory.dmp
memory/4696-179-0x00007FFCD9FF0000-0x00007FFCDA000000-memory.dmp