afbea9050cf76d3a393f4efe786212944c9629e2b11d7dd7939d152397501bb0

Analysis

max time kernel
102s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2023 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EES Aprende.Química.e.Ingeniería.con.Toño/Userlib/Heat Transfer/Radiation Properties/gas emittance.doc
Size

923KB
MD5

17d8db9ce9a3579496c9b76499b8be23
SHA1

a6ff2433a72d821de0ec35ffa714edc6e307c1fc
SHA256

af0b7cd17046e4bbeb42896e3f8c9483669bfc14b36d9832191d4fb40b2ba210
SHA512

a62ccb727fcd4e592224f8c0a7a80888fa25852e147bac5a1da472487a89ebab454f05980e9ebafb92bf1db6db8101a82c03ae58050104301bdd15065fa1085b
SSDEEP

24576:/TKyxBE+s6NhLeIeteB0ZE57CnwhH2lgZ:tET6PLeIet4kuak

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4116 WINWORD.EXE
4116 WINWORD.EXE
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

4116 WINWORD.EXE
4116 WINWORD.EXE
4116 WINWORD.EXE
4116 WINWORD.EXE
4116 WINWORD.EXE
4116 WINWORD.EXE
4116 WINWORD.EXE
4116 WINWORD.EXE

pid	process
4116	WINWORD.EXE
4116	WINWORD.EXE

pid	process
4116	WINWORD.EXE
4116	WINWORD.EXE
4116	WINWORD.EXE
4116	WINWORD.EXE
4116	WINWORD.EXE
4116	WINWORD.EXE
4116	WINWORD.EXE
4116	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\EES Aprende.Química.e.Ingeniería.con.Toño\Userlib\Heat Transfer\Radiation Properties\gas emittance.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4116

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F153173E.wmf
Filesize
784B

MD5
15c66a2bb540315646894b9f5543d8d4

SHA1
46ee4d6530feee3c35b1e9c7ee21b964c5a444c5

SHA256
229d3acbae6e2042998d970fd293d4faad2accb0eaac63249c4a4cb5cdd0b1e6

SHA512
b73a1f3a580e477c02d9735d0a379d1218567d9a155d30d79d1ac536298e49cabb590d4caeb5667f603d5af25dd0de002e47702dc6093bdb9420f3748b3909be

Download Submit
memory/4116-133-0x00007FFC07B10000-0x00007FFC07B20000-memory.dmp

Filesize
64KB

Download
memory/4116-135-0x00007FFC07B10000-0x00007FFC07B20000-memory.dmp

Filesize
64KB

Download
memory/4116-134-0x00007FFC07B10000-0x00007FFC07B20000-memory.dmp

Filesize
64KB

Download
memory/4116-136-0x00007FFC07B10000-0x00007FFC07B20000-memory.dmp

Filesize
64KB

Download
memory/4116-137-0x00007FFC07B10000-0x00007FFC07B20000-memory.dmp

Filesize
64KB

Download
memory/4116-138-0x00007FFC051B0000-0x00007FFC051C0000-memory.dmp

Filesize
64KB

Download
memory/4116-139-0x00007FFC051B0000-0x00007FFC051C0000-memory.dmp

Filesize
64KB

Download
memory/4116-188-0x00007FFC07B10000-0x00007FFC07B20000-memory.dmp

Filesize
64KB

Download
memory/4116-189-0x00007FFC07B10000-0x00007FFC07B20000-memory.dmp

Filesize
64KB

Download
memory/4116-190-0x00007FFC07B10000-0x00007FFC07B20000-memory.dmp

Filesize
64KB

Download
memory/4116-191-0x00007FFC07B10000-0x00007FFC07B20000-memory.dmp

Filesize
64KB

Download