dbce51476607367164aadfa5eebd41c902e77d9ddde745420e75682391dcfbff

Analysis

max time kernel
101s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2023 08:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a4282d3dc4bde4e4f5bb8148f7e1bbe.dotm
Size

22KB
MD5

1a4282d3dc4bde4e4f5bb8148f7e1bbe
SHA1

d45583f56aa2fa04834a4852fbeb9072d7abb644
SHA256

dbce51476607367164aadfa5eebd41c902e77d9ddde745420e75682391dcfbff
SHA512

acd9abef45b919cac272e077e3a5d7cc422927f98843d54ad3bdcea8bb3c8cd412cad0dc09e10dc362ed198767b8742f1cbd0f7b5d692d649fee10af81ca3c50
SSDEEP

384:C6LXTTNn0i13L6tk4vigfwrg/4LQNrPle2YbcREsZDGSBjzfUrlKF6j5EGYJ3W4:BXTJv13YDfZPlvjzUoUj5y3B

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

1824 WINWORD.EXE
1824 WINWORD.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

WINWORD.EXE

pid	process
1824	WINWORD.EXE
1824	WINWORD.EXE
1824	WINWORD.EXE
1824	WINWORD.EXE
1824	WINWORD.EXE
1824	WINWORD.EXE
1824	WINWORD.EXE
1824	WINWORD.EXE
1824	WINWORD.EXE
1824	WINWORD.EXE
1824	WINWORD.EXE
1824	WINWORD.EXE
1824	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1a4282d3dc4bde4e4f5bb8148f7e1bbe.dotm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1824

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp
Filesize
23KB

MD5
5f5fe23dc8d07558a5b72bd0895db8a8

SHA1
0f04be672b0bfa562b97da17efd8ae3952a7f0bd

SHA256
2a28c10e9eed9b1f2ac3c2964bdfef7f7be52daf709f0692f7483af57898eb19

SHA512
285dd3ea3177a155d686b621b64d0ef24f23fedbdf53346979f6c774560108a55cd1bdf9a2eb8047089230d4a968cc1881dd46305c109337c2187fdc361a57bd

Download Submit
C:\temp.tmp
Filesize
2KB

MD5
67f2dc4406aff1072a9a85c952bb6e47

SHA1
90089ee0521108b46296d30c7d73505c203dca4e

SHA256
a8f2f476881c4910bd391677649c68dd87c6c1cf9c566e6430a1ccc414f9de59

SHA512
ca0ddd4f657e685cdf02115ad8b77ff95e163666d3a15e2d9f39bb90620c899a628d02d16826c1056eaeb3b00d6020c42350693562f6feaaf393ba9e3bcdb62a

Download Submit
C:\temp.tmp
Filesize
225B

MD5
519755378e58a854e2bd4652f7195193

SHA1
eca94844a06772a58cafa8bb4fccb054cdb450c0

SHA256
b5aa96f3f7930aced20f57e7f4fe5957e37be0f504fb2f49606f80b19e79bf20

SHA512
b1e3a0dc5562e558bb8542c4f9288ce4493ddc9c5c533fff9a07e008a6acef0fbacfc03d867d5ff54fb602e9f3148fa073bb93a1ca386ea42f88b063f0726d52

Download Submit
C:\temp.tmp
Filesize
2KB

MD5
063316a03d574bb57353c69150d44288

SHA1
b8bc6a2763aa92aa53f262977abb38ad128acb02

SHA256
7b8c2944f03e44a66192a30881033b4f8ff472cfb5e256fac95ddb3ac5bee3fc

SHA512
6b229d03e1b2b76c8442a3cb46c13000c257bed0877d2f2d367e959c42c162c6e9ad516ee560196ae72f197fbbd8bb1ecb5cf1e90b9c16cabcc81b53ec5f95b2

Download Submit
memory/1824-136-0x00007FFC17050000-0x00007FFC17060000-memory.dmp

Filesize
64KB

Download
memory/1824-138-0x00007FFC14FC0000-0x00007FFC14FD0000-memory.dmp

Filesize
64KB

Download
memory/1824-139-0x00007FFC14FC0000-0x00007FFC14FD0000-memory.dmp

Filesize
64KB

Download
memory/1824-137-0x00007FFC17050000-0x00007FFC17060000-memory.dmp

Filesize
64KB

Download
memory/1824-133-0x00007FFC17050000-0x00007FFC17060000-memory.dmp

Filesize
64KB

Download
memory/1824-135-0x00007FFC17050000-0x00007FFC17060000-memory.dmp

Filesize
64KB

Download
memory/1824-134-0x00007FFC17050000-0x00007FFC17060000-memory.dmp

Filesize
64KB

Download
memory/1824-269-0x00007FFC17050000-0x00007FFC17060000-memory.dmp

Filesize
64KB

Download
memory/1824-270-0x00007FFC17050000-0x00007FFC17060000-memory.dmp

Filesize
64KB

Download
memory/1824-271-0x00007FFC17050000-0x00007FFC17060000-memory.dmp

Filesize
64KB

Download
memory/1824-272-0x00007FFC17050000-0x00007FFC17060000-memory.dmp

Filesize
64KB

Download