Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2023 08:50
Behavioral task
behavioral1
Sample
2f656fb0522299e12bd55d4e6b7671de.doc
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2f656fb0522299e12bd55d4e6b7671de.doc
Resource
win10v2004-20230221-en
General
-
Target
2f656fb0522299e12bd55d4e6b7671de.doc
-
Size
12KB
-
MD5
2f656fb0522299e12bd55d4e6b7671de
-
SHA1
3cb89fad0dcf2bd002bd6c8df0cbf45f9acc8118
-
SHA256
18f0de1a2dd3d46e611210c2e933b6b754788e205b3725210a25b0079cd083be
-
SHA512
7a3c0f2184519637dab4d5e8a3dedd70ecfac4933f52480108fbe885d3e668bdc4c3e067b1fd17e05a0531907cee9b374bf9940a4e6ceccf54674538fac8c416
-
SSDEEP
96:RNOU8gAk4IG8d7fZFBeVLmL9t1OpQXb1vC+X0jnuZFK5C7qNBt55uIZY4rgCQ6cE:LrV7fr4cH1O6JN0jIFK5CGrtV5kd6Xa
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4700 WINWORD.EXE 4700 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 21 IoCs
Processes:
WINWORD.EXEpid process 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2f656fb0522299e12bd55d4e6b7671de.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4700-133-0x00007FFC4E8B0000-0x00007FFC4E8C0000-memory.dmpFilesize
64KB
-
memory/4700-134-0x00007FFC4E8B0000-0x00007FFC4E8C0000-memory.dmpFilesize
64KB
-
memory/4700-135-0x00007FFC4E8B0000-0x00007FFC4E8C0000-memory.dmpFilesize
64KB
-
memory/4700-136-0x00007FFC4E8B0000-0x00007FFC4E8C0000-memory.dmpFilesize
64KB
-
memory/4700-137-0x00007FFC4E8B0000-0x00007FFC4E8C0000-memory.dmpFilesize
64KB
-
memory/4700-138-0x00007FFC4C850000-0x00007FFC4C860000-memory.dmpFilesize
64KB
-
memory/4700-139-0x00007FFC4C850000-0x00007FFC4C860000-memory.dmpFilesize
64KB